.png)
Most covered entities treat OPAIS the way they treat a business license: register it, hang it on the wall, and forget about it until something forces a second look. That approach is the single most common source of HRSA audit findings, and it's also the easiest one to fix.
OPAIS is the source of truth HRSA auditors use to confirm what your 340B program actually looks like on paper. If your records don't match your operations, the mismatch becomes the finding, regardless of whether your program is otherwise compliant. Treating OPAIS as a living record, not a one-time registration task, is the foundation everything else in audit readiness is built on.
Keeping OPAIS current means reviewing it on a regular schedule, not just when a change happens to cross someone's desk. Four areas deserve consistent attention.
Contacts. Your authorizing official and primary contact need to reflect who currently holds those roles. When someone leaves the organization, OPAIS should be updated before the next registration window, not whenever an audit forces the issue.
Site eligibility. Every registered site should still be an active, eligible part of your program. New sites need to be added as they come online. Sites that have closed or changed function need to be terminated in OPAIS, not just internally.
Shipping addresses. These need to match exactly what your program is actually doing, including any in-house pharmacy locations that should be listed as shipping destinations.
Contract pharmacy arrangements. OPAIS should reflect every active contract pharmacy relationship, including pharmacy addresses that match your signed agreements precisely. This means periodically pulling your actual contract pharmacy agreements and addendums to confirm OPAIS still lines up, and knowing where those documents live so the comparison is easy to do.
Medicaid carve-in and carve-out status. This is one of the most frequently inaccurate fields in OPAIS. If you carve in, every applicable site needs to be correctly identified on the Medicaid Exclusion File, with additions and removals kept current as your billing practices change.
OPAIS accuracy and policy accuracy are two sides of the same problem. Your policies and procedures need to describe how your organization actually operates day to day, not a generic version of the 340B statute. HRSA's patient definition is intentionally broad, which means your policy has to do the work of narrowing it down for your specific program: how eligibility is determined, who makes that determination, what data supports it, and at what point in the workflow the decision happens.
This gets more complicated with referral prescriptions, specialty pharmacy arrangements, or any prescription that originates outside a typical patient encounter. A policy that only restates the regulation won't hold up when an auditor asks whether you can prove a specific patient was eligible. The policy needs to match your actual operational flow closely enough that the answer to that question is always yes.
Structure matters too. Your policy should make clear who owns each major function of the program, whether that's a named team, a department, or a specific role. Naming a specific software platform or TPA is worth avoiding, since that detail changes more often than the policy should need to. Describing the function in general terms keeps the document accurate longer.
A few practices keep OPAIS and your policies aligned without turning it into a recurring emergency.
Review on a set cadence. OPAIS and policy reviews should happen at least annually, and immediately after any major operational or regulatory change. Waiting for the next scheduled review to catch a change that happened six months ago is how gaps accumulate.
Bring in an outside perspective. A team that works inside the program every day can read its own policy and see exactly what it means, even when the words on the page say something slightly different. An outside 340B consulting resource reviewing your policy annually is one of the more effective ways to catch that gap before an auditor does.
Treat every change as an OPAIS trigger. A new site, a terminated contract pharmacy, a staffing change in the authorizing official role: each of these should prompt an OPAIS update as part of the process, not as a follow-up task that might get missed.
We work through OPAIS and policy reviews with covered entities as a standing part of the relationship, not a one-time engagement. That includes comparing OPAIS against actual contract pharmacy agreements, flagging Medicaid election mismatches, and reviewing policy language against real operational practice. The covered entity's job is running the program. Ours is making sure the paperwork behind it never falls out of step with what's actually happening.
Audit readiness that starts the week a notification letter arrives is already behind. Building it into routine program maintenance is what keeps that letter from being stressful when it does come.
