HRSA audit readiness is the ability to explain, with evidence, why a 340B program operated the way it did on an ordinary day, not just the ability to assemble a binder quickly after an audit letter arrives. That distinction sits at the center of a recent episode of 340B Pulse, the NorthArc Health podcast powered by PureLogics. Host Muhammad Atif spoke with Mark Capuano, PharmD, MBA, who leads 340B and supply chain work in corporate pharmacy at NYC Health plus Hospitals, the largest public health system in the country, with 11 hospitals and a large FQHC network.
Mark’s 340B career began at NYU Langone in 2015, where he helped build the program from its formation and took it through an HRSA audit. He moved to NYC Health + Hospitals in 2021, and between the two systems, he has now been through 10 HRSA audits. Few people in the 340B community have that many repetitions to draw patterns from, and this conversation goes past the standard audit primer into what those patterns actually teach an operator.
Why Do Documentation Problems and Workflow Problems Look the Same From the Outside?
An HRSA finding is rarely one catastrophic gap. It is usually a documentation, data, and workflow story that stopped matching, quietly, until an auditor traced a transaction and exposed it. Mark was direct about where he sees this happen most: “Something slips through the cracks, or there’s just something you’re unaware of, right? And there’s a lot of logic that’s in play to keep 340B eligibility accurate.”
He pointed to a concrete example most teams never think to audit on a schedule: the Epic build logic that appends a UD modifier, or the logic that calculates actual acquisition cost for 340B drugs. Rules change. If the underlying build does not change with them, the mismatch does not announce itself. It sits there until a transaction sample finds it. “It’s not like a major failure,” Mark said. “It’s something small that you just inevitably, if you’re not checking for that, it’s easy to miss.”
How Does Medicaid Billing Complicate HRSA Audit Readiness?
Medicaid billing complicates HRSA audit readiness because every state applies different rules to how 340B claims and Medicaid claims interact, and those rules shift depending on whether the drug moves through the pharmacy benefit or the medical benefit. A health system billing Medicaid for a retail pharmacy fill follows a different rulebook than one billing Medicaid for a clinic-administered infusion.
Mark called this one of the two areas HRSA auditors consistently probe hardest, alongside location eligibility. Different modifiers, different actual acquisition cost requirements, and different carve-in and carve-out elections all stack on top of state-by-state variation. Getting this wrong is also the single outcome Mark says he tries hardest to avoid across his entire career: “You don’t want to be involved with Medicaid fraud; you don’t want to have a False Claims Act problem. Those are issues that really cause headaches for the entire organization, not just 340B.”
What Is a Location Crosswalk, and Why Does HRSA Care About Child Sites?
A location crosswalk is the connective record that proves an off-site clinic, hospital department, or outpatient facility is the same eligible location across every system that touches it, from OPAIS to the Medicare cost report to the trial balance to the EHR, billing, and the TPA. HRSA requires hospital-based covered entities to list these locations as child sites under the parent, and that listing has to hold up under direct questioning.
Mark did not soften how much this matters: “Location auditing is a huge, huge problem, and the more off-site clinics and the more locations you have, it just gets very, very complicated.” An auditor will ask for the child site’s MCR line number, its charges and expenses, and whether it operates as a clean site or a mixed-use site. A team that cannot answer immediately has already lost ground. NYC Health + Hospitals treats this as a standing annual project, not a one-time setup: every year, the team rechecks every off-site clinic against the current Medicare cost report and trial balance, because those underlying facts never sit still.
How Do You Walk a Single 340B Transaction Through an Audit?
Walking a single 340B transaction through an audit means proving, in sequence, that the patient was an outpatient at the time of administration or accumulation, that the location and provider were eligible, and that the payer and medication were not excluded. HRSA can select one claim from six months earlier and ask a covered entity to reconstruct the entire chain, and the order of proof matters.
Mark laid out the sequence he uses at NYC Health + Hospitals:
- Confirm the patient’s class at the time of administration or accumulation was outpatient, since 340B is strictly an outpatient drug program.
- Confirm the department or clinic is 340B-eligible, listed on the Medicare cost report, and registered at the correct address with HRSA.
- Confirm the ordering or administering provider is credentialed to the institution.
- Check the insurance plan for any carve-in or carve-out treatment under the organization’s Medicaid election.
- Check the medication itself against 340B’s exclusion list, since some categories, like certain vaccines, do not qualify regardless of everything else.
Third-party administrators run this checklist logic automatically against every claim today. When a claim fails, Mark’s team does not treat the rejection as final. They investigate whether the logic itself missed something and manually re-qualify the claim when the underlying facts support it.
When Does a Recurring Exception Become a Process Problem Instead of a Claim Problem?
A recurring exception becomes a process problem, not a claim problem, once the same issue shows up across multiple claims rather than a single isolated transaction. Mark’s team treats the fifth repeat of an exception as a decision point, not a coincidence. The team meets, discusses the pattern, and asks a direct question: is this a one-and-done fix, like correcting a wrong NDC on a price file, or does it require pulling in RevCycle, the Epic build team, compliance, internal audit, or legal?
That distinction protects two things at once. It keeps small, real fixes from being over-engineered into committee work, and it stops a genuine systemic gap from being closed claim by claim while the root cause keeps generating new exceptions underneath.
Can You Trust a TPA’s Explanation During an Audit?
A TPA’s explanation deserves scrutiny, not automatic acceptance, when a covered entity is preparing to defend a transaction to HRSA. Mark was candid that “the TPA handled that” is the kind of answer that makes him uncomfortable on its own. He values vendor partners and credits them with catching problems his internal team missed. But he still trusts an in-house team’s knowledge of “the inner workings of the organization” over a vendor’s word alone, and he pushes his team to research and validate before accepting a system-logic explanation as the final answer.
Where Can Agentic AI Actually Help HRSA Audit Readiness?
Agentic AI can strengthen HRSA audit readiness by pulling disparate 340B claims data, across mixed-use, clean-site, and retail outpatient pharmacy settings, into one master data warehouse where inconsistencies surface early. Mark described the opportunity in plain terms: a small problem often behaves like a hairline crack that slowly widens undetected. Catch it early, and the downstream cost is a fraction of what it becomes months later.
He was equally clear about the limit. Right now, he sees AI’s role as document preparation and pattern detection, not final judgment. “I think there’s probably, for us, still a component of a validation or checking,” he said, describing a future where AI-prepared evidence could eventually “pass muster” once that validation layer proves reliable. Today, NYC Health + Hospitals combines local auditing, central-office auditing, and close to 100 percent claims testing, and Mark sees AI as a way to strengthen that structure, not replace it.
What Will Change About 340B Audit Readiness as the Program Moves Toward Rebates?
340B audit readiness is shifting from a periodic compliance exercise toward continuous transaction-level validation as HRSA moves the program toward claims-based rebate models. HRSA’s revised 340B Rebate Model Pilot Program, announced in mid-2026, requires qualifying manufacturers to submit plans by August 24, 2026, with any approvals expected by September 24 and an effective date of January 1, 2027, for approved plans. Approved plans must support at least a 45-day claims-submission window, real-time reconciliation, and payment or denial of qualifying rebates within 10 calendar days of complete data submission.
Mark does not expect 340B to disappear. Federal law ties Medicare and Medicaid participation to offering 340B pricing, so the program’s legal foundation is not in question. What he does expect is that generating the same level of savings will get harder, alongside more transparency and more data-sharing, ideally routed through a neutral third-party clearinghouse rather than directly to manufacturers. The same weaknesses that create HRSA findings today- weak location mapping, incomplete evidence, unclear ownership- are the weaknesses that will create rebate denials and reconciliation gaps tomorrow.
Conclusion
Ten HRSA audits gave Mark Capuano ten opportunities to see where a 340B program’s assumptions hold up and where they quietly fail. The pattern that runs through all of it is not dramatic: small, unmonitored logic drift, an unclear location map, or an unvalidated vendor answer, left unchecked long enough to become an audit finding. [Internal Link: NorthArc Services] helps covered entities build the location crosswalks, transaction evidence, and Agentic AI tooling that keep those small cracks from becoming findings. For the full HRSA data request list and audit expectations, see the HRSA 340B Program Requirements
Frequently Asked Questions (FAQ)
What is the single biggest cause of HRSA audit findings?
The single biggest cause is not missing documentation but unmonitored drift between policy, data, and daily workflow, such as back-end billing logic that stops matching current 340B rules because nobody rechecked it.
How often should a covered entity review its location crosswalk?
A covered entity should review its location crosswalk at least once a year against the current Medicare cost report and trial balance, and immediately after any clinic move, name change, or department consolidation.
What should a covered entity do when it cannot answer an auditor’s question on the spot?
The strongest response is to tell the auditor the question needs a more thorough look, then return with a validated answer after the team has properly investigated, rather than guessing in the moment.
Should a covered entity trust its TPA’s explanation of why a claim was included or excluded?
A covered entity should treat a TPA’s explanation as a starting point that still needs internal validation, not a final answer, since in-house teams typically understand their own organization’s workings best.
Is 340B at risk of being eliminated?
340B is not at risk of elimination in the near term, since federal law requires manufacturers participating in Medicare and Medicaid to offer 340B pricing to covered entities.
How is the 340B rebate model changing audit readiness?
The 340B rebate model is pushing audit readiness from a periodic compliance exercise toward continuous transaction validation, since approved rebate plans will require real-time reconciliation and fast turnaround on submitted claims.