HRSA’s FY 2027 DRL: Audit Preparation for Grantees and Hospitals

For grantees: connect eligibility evidence to daily operations

The grantee eligibility portion of Section 2 now contains six items. Together, they ask you to connect the organization, its locations, its source of eligibility and the way it purchases and dispenses 340B drugs. The right documentation depends on the entity type and funding arrangement. ^[1]

Confirm the organization and all relevant locations

Section 2A asks for official documentation of the covered entity’s name, address and employer identification number (EIN). Private nonprofits are asked for their most recently filed IRS Form 990. Publicly owned and other grantees should provide documentation from an appropriate official source, such as a government authority or Indian Health Service. ^[1]

The location list in Section 2B should include the names, physical addresses and electronic health record (EHR) location codes for the places where care is provided to individuals for whom the grantee considers itself responsible for 340B eligibility purposes. As a practical check, compare those names and codes with the ones used in your dispensing and administration reports. An unexplained abbreviation can make an otherwise complete file difficult to trace.

Explain sites registered under more than one entity type

If a location is registered under multiple covered entity types, Section 2C asks for its site information and corresponding 340B IDs, along with an explanation of how purchasing and dispensing are segregated by entity type. A shared address does not make the IDs interchangeable. ^[1]

For example, a site operating both a Ryan White program and a sexually transmitted disease program should be able to explain which purchasing account and dispensing process belongs to each. We recommend tracing a transaction through the applicable program, account and inventory record to confirm that the written explanation matches the system’s operation.

Assemble the applicable award or designation evidence

These alternatives matter: a look-alike designation or tribal agreement serves a different role from a federal grant award. Use the evidence specified for your entity type. ^[1]

Check the executed subgrantee agreement

Where applicable, Section 2E calls for an executed agreement with the primary grantee identified in the NoA. Examples include a subaward, contract, memorandum of understanding or memorandum of agreement. The sample excludes community health centers (CH) and look-alikes (FQHCLA) from this item. ^[1]

The agreement should identify both parties and the subgrantee service locations, the grant and Notice of Funding Opportunity (NOFO) numbers, the purpose of the support, each party’s responsibilities, the term and the financial or in-kind arrangements. Review the actual executed document for these elements. A description of the relationship in an internal policy may not supply the evidence requested.

Document in-kind support for STD and TB subgrantees

Section 2F applies to sexually transmitted disease (STD) and tuberculosis (TB) subgrantees receiving in-kind support under Sections 318 or 317. It asks for documentation from the primary grantee describing the goods or services purchased with those funds and provided to the subgrantee since the beginning of the sample period. Examples include an email confirmation, receipts or a certification. ^[1]

A useful preparation step is to request that evidence before an audit begins and match it to the applicable agreement, locations and dates. A document describing what support may be provided does not necessarily establish what was actually provided during the period under review.

Review the audit data and operating records

The following requests apply to hospitals as well as grantees. Grantee teams should include them in their readiness review alongside eligibility documentation.

The sample DRL contains the underlying requests; the October 28 presentation identified these sections as updated for FY 2027. The preparation checks above are our recommendations. ^{[1] [2]}

For the 340B universe, replenishment is not the cutoff. A qualifying dispense may have been designated as 340B without enough units accumulating to replenish a package. The webinar described inclusion of those records as clarification of an existing expectation. A report limited to replenished claims can therefore omit part of the requested universe. ^{[1] [2]}

Section 3 also asks for the systems, report names, methodology and limitations behind the data, plus a crosswalk explaining column headers. That methodology request was not itself new for FY 2027. Prepare a short table for each relevant setting, such as clinic-administered drugs, an entity-owned pharmacy or contract pharmacies. Explain exclusions and handling of reversals instead of leaving the auditor to infer how the file was built. ^{[1] [2]}

For shipping locations, identify what happens there. A warehouse, loading dock or repackager serves a different function from a pharmacy dispensing directly to patients. For a pharmacy covered by Section 7 that furnishes, administers or dispenses directly to patients, in person or by mail, the sample asks for a state pharmacy license and evidence of covered-entity ownership. Examples include a business license, liability insurance documentation or inclusion on the grant or Medicare cost report with its trial balance. More than one document may be needed. ^[1]

HRSA’s separate October 1 OPAIS update added shipping-address questions and documentation fields. HRSA expressly stated that those system updates do not change the underlying statutory eligibility requirements. Check that your 340B Office of Pharmacy Affairs Information System (OPAIS) record and audit evidence describe the same operations. ^[3]

Keep the rest of the DRL in the review

The five changed sections are not the entire audit request. The sample also covers policies and procedures, eligible providers, self-disclosures, Medicaid billing, applicable combined purchasing and distribution models, and follow-up from previous audits. It includes instructions to exclude protected health information and personally identifiable information from specified uploads. Apply the full request and its submission instructions when assembling the files. ^[1]

For hospitals: reconcile the cost report, sites and eligibility records

Hospitals should apply the shared data and operating-record checks above, then address the hospital-specific portion of Section 2. Grantee award and subaward documentation does not substitute for hospital eligibility evidence.

Confirm identity documentation and the applicable cost reports

Section 2A requests the most recently filed IRS Form 990 for private nonprofit hospitals and official-source identity documentation for other hospitals. Section 2B asks for the Medicare cost report (MCR) filed most recently before the sample period began, plus reports filed from the start of that period through the audit, including amendments and the Worksheet S encrypted signature stamp. The FY 2027 webinar identified the identity-document language as a clarification. ^{[1] [2]}

Build a crosswalk that reaches the underlying location

Section 2C requests the unbundled trial balance submitted to the Centers for Medicare & Medicaid Services (CMS) with the applicable MCR and a corresponding crosswalk. The clarified scope includes locations where the hospital considers itself responsible for the care supporting 340B eligibility, including service areas that administer drugs or generate prescriptions deemed eligible at entity-owned or contract pharmacies. ^[1]

The crosswalk should connect the 340B ID, OPAIS name and address, MCR worksheet lines and cost centers, trial-balance department or account, and EHR location code. It also asks whether 340B drugs are used during encounters at the site. We recommend testing the crosswalk with an actual encounter or prescription so finance and pharmacy can follow the same location across their systems.

Keep the hospital’s classification evidence current

Sections 2D–2F address government ownership or operation, a private nonprofit hospital’s contract with state or local government, and formally granted governmental powers. The webinar did not identify changes to these items for FY 2027. Retain the documents supporting the hospital’s applicable eligibility pathway, including relevant terms, signatures and effective dates. ^{[1] [2]}