Referral Capture and 340B: What Compliance Actually Requires

If you run a 340B program at a covered entity, you have already had this conversation: a patient you have been seeing for years gets referred to a cardiologist down the street. The cardiologist writes a prescription. Can you fill it through your 340B program?

The answer is almost always "it depends," and the depending part is exactly where HRSA audit findings come from. Every year, the federal Health Resources and Services Administration audits about 200 covered entities. Diversion findings — dispensing a 340B drug to someone who does not meet the patient definition — are among the most common results.

~200

HRSA AUDITS OF COVERED
ENTITIES EACH YEAR

82%

FY24 DIVERSION FINDINGS AT CONTRACT PHARMACIES

18%

FY24 AUDITS REQUIRING MANUFACTURER REPAYMENT

That contract-pharmacy concentration matters because most referral prescriptions flow through contract pharmacies. Referral capture, in other words, is where the audit risk lives. Done well, it can meaningfully expand a covered entity's 340B savings. Done sloppily, it is the fastest path to manufacturer repayment and contract-pharmacy termination.

Detailed below is what a compliant, audit-ready, referral capture actually requires.

The regulatory foundation, in plain English

The 340B statute prohibits dispensing 340B drugs to anyone who is not a "patient of the entity." That is the whole rule. And, the statute does not define "patient". For that, HRSA points to a notice it published in 1996 (61 Fed. Reg. 55156), which sets out a three-prong test that still governs every audit:

1. Established relationship. The covered entity has an established relationship with the individual and maintains records of their health care.

2. Eligible provider, responsibility retained. The individual receives health care services from a provider who is employed by, contracted with, or under "other arrangements (e.g., referral for consultation)" with the covered entity — such that responsibility for the care remains with the entity.

3. Service consistent with scope. For grantees (FQHCs, FQHC look-alikes, Ryan White, and other federally funded entities), the service is consistent with the scope for which grant funding was provided.

The phrase "e.g., referral for consultation" in Prong 2 is the entire legal hook for capturing referral prescriptions. HRSA reinforced this in its operative referral FAQ (Apexus 340B FAQ #1493): if the covered entity can document that it retained responsibility for the health care services provided to the referred individual, the prescription can be 340B-eligible — and the covered entity must put its referral-counting methodology in writing.

What HRSA expects you to document

A defensible referral 340B claim has seven moving parts. Miss any one and you are looking at a diversion finding when the audit comes.

1- A qualifying encounter at your facility
A documented visit with a provider you employ or contract with, at a site listed in 340B OPAIS, within a reasonable look-back window before the referral.

2- Auditable records in your EMR
The covered entity needs to own — or have direct access to — the full medical record. Not just a referral receipt or a faxed prescription. Auditors look for clinical notes that show the entity is actually managing care.

3-An outgoing referral, documented at your end
Specifically: a referral order in your EMR identifying the receiving provider, their specialty, and the clinical reason. If you cannot show that you initiated the referral, the prescription does not qualify.

4-A consult note coming back
The referred-to provider's note needs to land in your record within a defined timeframe of the prescription. Industry practice is that the note (a) comes from the prescriber or their office, (b) actually references the medication beyond a passive medication-list entry, and (c) is filed in your patient's chart.

5-A documented link between the referral and the prescription
A take-home prescription written by an outside physician does not qualify unless there is a documentation trail tying it to your referral. An unrelated independent visit between the patient and the specialist does not cut it.

6-Service alignment with your scope (for grantees)
FQHCs and other grantees can only capture referrals for services within their HRSA-approved scope — the Form 5A/5B/5C services. A referral to a specialty your scope does not cover may be clinically appropriate, but it will not be 340B-eligible.

7-Eligible site, outpatient status, eligible pharmacy
The qualifying visit has to occur at an OPAIS-listed site, the patient must be outpatient at the time of dispense, and the prescription must be filled at a CE in-house pharmacy or at a contract pharmacy listed in OPAIS.

The five fastest ways to fail an audit of your referral capture claims

Across documented HRSA audit findings from FY22 through FY25, the same patterns repeat. If you are doing referral capture, these are the findings that show up first.

No outgoing referral in the EMR

The specialist's prescription cannot be linked to a covered-entity-initiated referral.

No consult note returned

Or a note returned outside the timeline required in your policy, or filed somewhere other than the patient's record.

Specialist not credentialed, contracted, or documented under "other arrangement"

With no evidence demonstrating retained responsibility of care.

Service outside HRSA-approved scope (grantees)

A common stumble when covered entities expand referral relationships faster than they update their scope or hyper focus only on revenue potential.

Patient Inactive at the prescription date

The patient falls outside the covered entity's policy-defined active relationship window when the specialist writes the prescription.

The piece that requires the most discipline - demonstrating ongoing responsibility for care

As we've established, the 1996 standard requires that "responsibility for the care provided remains with the covered entity." This is the prong that gets stretched the furthest in practice and seems to be scrutinized the hardest in audits.

In real terms, retained responsibility looks like:

• A defined active-patient window in your policy. Commonly 6, 12, or even 24 months but the right answer depends on your clinical model. There is no universal HRSA guidance.

• Bidirectional information flow. Specialist notes come back, and your providers actually review and integrate them into the treatment plan.

• Care coordination evidence: follow-up encounters, medication reconciliation, active care management at your site after the specialist visit.

• Documented limits on the referral chain. A second specialist your first specialist further refers to is almost never an eligible prescriber under your 340B program.

What kills audit defensibility is the gap between policy language and actual practice. HRSA will check whether what you say in your P&P is what you actually do.

Designing compliant policies and procedures

HRSA expects every covered entity to maintain written, site-specific 340B policies and procedures. Further the covered entity is expected to follow them. The referral-capture section needs to address, at minimum:

• The active-patient definition and look-back window

• Which referral types you capture (CE-initiated consults vs. downstream specialist-to-specialist referrals — the latter usually should not be captured)

• The required documentation set per claim

• Required timeframe for the consult note to arrive

• Refill handling, particularly for refills initiated by specialists without a new visit

• Scope mapping for grantees

• Self-audit cadence (monthly claim-level review is the prevailing standard)

• Material-breach threshold and HRSA self-disclosure protocol.

Where most covered entities fall short

The covered entities with clean referral-capture programs share four habits:

1-They have built the data infrastructure. Data Use Agreements or Business Associate Agreements with their high-volume referral partners so consult notes actually flow back. Where possible, Health Information Exchange connectivity. They do not rely on manual faxing or scanned paper document uploads.

2-They reconcile prescriber rosters monthly. HR, credentialing, contract, and TPA prescriber lists agree with each other. Locum tenens and residents are explicitly handled in policy.

3-Their automation logic mirrors their policy. Whatever look-back window, refill rule, and consult-note timeframe their policy defines, the referral capture system actually enforces. Any manual approvals are logged and reviewed.

4-They run monthly internal self-audits. Not annual mock audits, although those are recommended for overall program integrity, but monthly claim-level reviews, with sample sets designed to include specialists and all contract pharmacies. The covered entity turns up their own findings before HRSA ever does.

Covered entities that have not built these habits often capture referral prescriptions opportunistically and accept the audit risk. Or they leave the savings on the table entirely because they do not trust their documentation. Both are avoidable and both impact organizational sustainability.

A NOTE ON WHAT MIGHT CHANGE IN 2026

Two things are worth watching. First, recent litigation around HRSA's interpretation of the 1996 patient definition (Genesis Health Care) has clarified that HRSA cannot unilaterally require covered entities to have "initiated the health care service resulting in the prescription" beyond what the 1996 framework already requires — but the 1996 standard itself still governs day-to-day audit posture.

Second, the rollout of manufacturer rebate models is raising real questions about how referral claims will be supported under specific manufacturers' rebate operations. If you participate in referral capture, this is a conversation worth having with your TPA before the 2026 rebate model is in production for your covered entity.

Is your referral-capture program audit-ready?

CoreWise Advisors supports covered entities across the full 340B compliance stack — policy and procedure design, program integrity audits, referral-capture program build, TPA logic alignment, contract pharmacy oversight, optimization, self-disclosure preparation, and fractional 340B officer engagements. If you're not certain your program would survive an HRSA audit, the conversation is worth having before the audit notice arrives, not after.

Primary Sources:

• 42 U.S.C. § 256b (Section 340B of the Public Health Service Act), §§ (a)(5)(B), (a)(5)(C)

• HRSA, Patient and Entity Eligibility, 61 Fed. Reg. 55156 (Oct. 24, 1996)

• Apexus 340B Prime Vendor Program FAQ #1493 (referrals — retained responsibility for care)

• HRSA, February 2016 Program Update on 340B Policies and Procedures

• Annual HRSA audit findings summaries, FY22–FY25

• National Association of Community Health Centers, Leveraging Health Center Referral Arrangements for the 340B Program (Feb. 2023)

• Genesis Health Care, Inc. v. Becerra (D.S.C.) and subsequent proceedings