.png)
Once the welcome call ends, the data request list becomes the focus, and it can feel overwhelming the first time you open it. It genuinely is a lot. It reaches into nearly every part of your 340B program, and the window to respond is typically three to four weeks from the welcome call, though it can be as short as two.
At a high level, HRSA is asking you to demonstrate program eligibility, and the list usually covers your policies and procedures, covered entity eligibility documentation, your 340B claims universes, provider lists, purchasing accounts, and contract pharmacy agreements. A more recently added category is unregistered 340B locations, meaning any location outside your registered sites, such as an in-house pharmacy that isn't itself a registered 340B site. The list also typically includes Medicaid fee-for-service documentation, including billing numbers and sample claims.
The most effective approach is to take every item on the data request list and assign it to a specific team or resource, then track who's responsible for it, where the information will come from, and its current status. Some items will sit with pharmacy, some with finance, some will require a report from your TPA, and some will need to come from your contract pharmacies directly. Building this out as a tracked checklist, rather than working through the list linearly, is what keeps large teams coordinated against a hard deadline.
When documents are ultimately uploaded, they go into a portal organized into folders that mirror each section of the data request list. The most effective long-term habit is maintaining that same folder structure internally at all times, not just when an audit notification arrives. Organizing your documentation this way year-round means you're never starting from scratch when the letter comes. It also means your team already has a clear, consistent story of how your 340B program operates, which is ultimately what the audit is testing.
Roughly three days before the actual audit day, you'll receive the sample of claims selected for review, typically somewhere between sixty and seventy claims split across contract pharmacy, entity-owned, and mixed-use settings. This is a tight window, and a few things need to start immediately.
Reach out to credentialing. Have your credentialing staff pull employment or contract documentation for every provider included in the sample. If forty different providers appear across the sample, you'll need documentation for all forty.
Reach out to your pharmacies. Confirm they can obtain hard copies of any selected scripts included in the sample.
Review every claim in detail. This is the most time-intensive step, and it makes the biggest difference in how the audit day actually goes. The person who will be running the EMR during the audit should walk through each claim in the sample ahead of time, practicing exactly what they'll need to navigate to and show the auditor.
A few specific notes, taken claim by claim, significantly speed up the audit day itself.
Where information lives in the EMR, especially anything unusual or in a nonstandard location for a particular claim.
High-risk or less straightforward claims, along with a plan for what documentation you'll show and how you'll explain them.
Medicaid billing details, including any applicable modifiers, for claims tied to carve-in status. If the person running the EMR doesn't have direct access to billing information, loop in your billing department ahead of time and keep a billing contact available during the audit itself.
Referral claims, since supporting documentation for these often sits in a different part of the EMR than a standard encounter. Knowing that ahead of time, and flagging it to the auditor immediately, keeps the review moving.
Patient identifiers. The sample you receive will have PHI removed, so jotting down MRNs, patient names, and dates of birth ahead of time makes it much faster to locate the correct patient during the actual review. Contract pharmacy claims in particular may only include an RX number, which means looking up the corresponding patient ahead of time is worth the effort.
The difference this preparation makes is significant. A well-prepared entity can complete what would otherwise be a two-day audit in a single day. An entity that walks in without having reviewed the sample claims in advance can see a one-day audit stretch into two. Clearing your team's schedule for the week of the audit, and treating the sample review as the priority it is, pays off directly in how smoothly the audit day goes.
We help covered entities build and maintain the DRL folder structure year-round, so the response to an actual data request list is closer to an export than a scramble. When the sample claims arrive, we work through the claim-by-claim review process alongside the entity's team, flagging high-risk claims and referral documentation before audit day begins. The covered entity's job is knowing their patients and their records. Ours is making sure that knowledge is organized and ready to present.
