41% of 340B Audits Fail on a Federal Registry Typo. The Monitor That Catches It Before HRSA Does.

The Problem

Start with the number that runs the whole program: in July 2026, the Health Resources and Services Administration reported that outpatient drug purchases under the 340B Drug Pricing Program crossed $100 billion in calendar 2025, up roughly 23 percent from $81.4 billion in 2024. For reference, purchases were $66.3 billion in 2023, $53.7 billion in 2022, and $43.9 billion in 2021 and $16.2 billion in 2016. At list prices, IQVIA puts the wholesale acquisition cost value of those 2025 purchases at $179.5 billion, which means roughly $79.5 billion in discounts changed hands in a single year. 340B is now the second-largest federal prescription drug program behind Medicare Part D, larger than net Medicaid drug spending ($58.5 billion), and it has compounded at about 22 percent a year since 2010, and nothing about that growth is slowing.

Congress created 340B in 1992 with a straightforward bargain: drug manufacturers must sell outpatient drugs at a discount to "covered entities," safety-net hospitals and clinics serving low-income and uninsured patients, as a condition of having their drugs covered by Medicaid and Medicare Part B. Nothing in the statute requires the savings to reach patients, so a hospital that buys at 40 percent off and bills the insurer at full price keeps the spread, legally, which is exactly why the program now spans 15,249 covered entities and 49,214 associated sites as of April 2026. Disproportionate share hospitals account for $79.2 billion of the $100 billion, with health center programs at $5.9 billion, children's hospitals at $2.5 billion, rural referral centers at $2.5 billion, critical access hospitals at $1.5 billion, and Ryan White HIV entities at $3.1 billion.

Every dollar of that discount rides on paperwork, and HRSA checks the paperwork through an audit program running since 2012 that examines roughly 200 covered entities a year. An independent count of every finalized fiscal 2025 audit result HRSA has published, 176 audits as of late September 2026, found that 98 of them, 55.7 percent, came back with at least one adverse finding. Rank the findings and a pattern jumps out: an incorrect 340B OPAIS record, the federal registry entry for the entity, showed up in 72 audits, 40.9 percent. Duplicate discount or Medicaid Exclusion File problems hit 47 audits (26.7 percent) and diversion, drugs dispensed to ineligible patients, hit 34 (19.3 percent); HRSA ordered repayment to manufacturers in 56 audits (31.8 percent) and terminated a site or contract pharmacy in 20 (11.4 percent). Every result is published by entity name, which makes reputation the collateral.

Read the OPAIS findings closely and they are almost insulting in their banality: a shipping address nobody updated, an offsite outpatient facility never listed, a contract pharmacy still registered after its written contract lapsed, a Medicare cost-report filing date off by a quarter, a duplicate registration nobody removed. Recordkeeping and registration data, not clinical judgment, produce the majority of findings: boring failures with expensive consequences. Meanwhile the program keeps getting harder to administer. Contract pharmacy arrangements have exploded to more than 31,000 locations and nearly 240,000 contractual relationships across roughly 12,500 covered entities as of mid-2026. Manufacturers began restricting contract-pharmacy shipments in 2020 and the restrictions have kept spreading. Nine states now demand their own annual 340B reports on top of the federal requirements, with Minnesota and Idaho due April 1 and Ohio due July 1, according to the same audit-data analysis.

For a rural health center or a Ryan White clinic, 340B savings are not a margin story; they fund the uncompensated care, the sliding-scale pharmacy, and the outreach worker. A repayment finding or a terminated contract pharmacy defunds the mission, and the single most common way to earn one is a registry nobody at the clinic is paid to watch. Nobody is paid to watch.

The Audit Lottery: An Original Calculation

Nobody in the 340B software business publishes the expected-value math on an audit, so here it is.

Two hundred audits a year across 15,249 covered entities means any given entity faces about a 1.3 percent chance of being audited in a given year, and conditional on an audit, 55.7 percent draw at least one finding while 31.8 percent are ordered to repay. Multiply through to roughly a 0.7 percent annual chance of a finding and 0.4 percent of a repayment order, which sound like lottery odds until you price the ticket. Findings are published by name, a reputational event for a nonprofit hospital board, while repayments are uncapped because manufacturers can claw back the full discount on every tainted unit across the lookback period. HRSA can terminate sites and contract pharmacies, which for a small entity can mean losing the program economics entirely, so a 0.4 percent annual chance of an uncapped, public, program-threatening event is not a risk a CFO ignores. It is a risk a CFO buys software against: lottery odds with uncapped downside.

Now the working-capital math behind the rebate pilot, because January 1 changes the cash mechanics for every affected entity. Under the pilot, covered entities buy selected drugs at wholesale acquisition cost and claim back the difference between WAC and the 340B ceiling price, submitting claims-level data within 45 days of dispense while manufacturers get 10 days to pay or deny. Average discount depth across the program runs about 44.3 percent ($79.5 billion in discounts on $179.5 billion of WAC value). Apply that to a $12,000 WAC specialty script: the ceiling price lands near $6,684, so the entity floats about $5,316 per claim for up to 55 days. A clinic dispensing 30 such scripts a month carries roughly $160,000 in permanent working-capital float it never carried before. That float is modeled from program averages, not measured at any single entity, and the pilot covers less than 5.5 percent of 340B sales, so treat it as the shape of the problem rather than anyone's invoice. But the shape is new, it starts in 63 days, and every affected entity has to build the 45-day submission workflow from scratch, and time is short.

Then the typo economics, which are the whole wedge: preventing an OPAIS finding costs a registry diff run on a schedule, while remediating one costs a corrective action plan, a public finding, and repayment exposure. Forty-one percent of audits fail on the thing that costs the least to watch. That ratio is the business.

Where Compliance Breaks Down

Follow a typical failure the way HRSA sees it. A community health center signs its third contract pharmacy in March and faxes the agreement to a drawer; nobody updates OPAIS, because the person who knew the login left in January and recertification is not due until October. In June the center's Medicaid Exclusion File entry goes stale after a billing-system migration changes the NPI taxonomy on two claims lines, and duplicate discounts accrue quietly for eleven months. HRSA selects the entity for a routine audit the following year, pulls the OPAIS record, and finds a pharmacy listed with no written contract on file plus Medicaid billing that contradicts the exclusion file, producing two findings, one repayment order, and one corrective action plan, all published. Nothing about the underlying patient care was ever in question. Every failure happened in a database: no patients harmed, only spreadsheets.

Notice what the health center never had, a single screen showing what HRSA sees, while OPAIS, the exclusion file, the contract pharmacy roster, and the recertification calendar live in four different places, and the incumbents' answer is a quarterly consulting engagement that costs more than the clinic's pharmacy director makes in a month.

The Gap in the Market

340B software exists, but it splits between entity-side TPAs that serve big hospitals and manufacturer-side platforms that serve drugmakers, and almost none of it watches the registry for the long tail.

Company	What They Do	What's Missing
Macro Helix (McKesson)	340B Architect administration software; 1,000+ covered entity clients in 48 states, roughly 40 percent of 340B hospitals. Monthly release cycle, high-touch service.	Built for health systems with pharmacy IT staff. Owned by McKesson, one of the three national drug wholesalers, which means the company selling the compliance software also sells the drugs being discounted. Pricing and onboarding exclude small entities.
Sentry Data Systems (Craneware)	Enterprise 340B TPA; acquired by Craneware for $400 million in 2021 in a wave of 13+ PE transactions in the sector.	Enterprise contracts, enterprise timelines. A 340B program doing $2 million in annual purchases cannot justify the engagement.
Verity Solutions	Purchase analytics; NDC-level price optimization claiming 10 to 13 percent savings on drug spend.	Procurement optimization, not audit readiness. Does not monitor OPAIS, exclusion files, or recertification.
340B ESP (Omnicell)	Claims clearinghouse that manufacturers use to police contract-pharmacy eligibility under their restriction policies.	Manufacturer-side by design. It tells drugmakers which claims to deny, not entities how to stay clean.
Kalderos	Drug discount management, heavily duplicate-discount detection.	Manufacturer-side. Covered entities are the inspected, not the customer.
Consultants and regional TPAs	Manual mock audits, policy binders, quarterly reviews.	$15,000 to $30,000 engagements with no continuous monitoring. Health centers, critical access hospitals, Ryan White clinics, and STD and TB programs, the 12,000-entity long tail, cannot buy them and would not need to if the registry watched itself.

Two structural gaps fall out of that table: first, nobody sells continuous OPAIS monitoring as a standalone product, even though registration errors are the single most common audit finding and the cheapest to prevent, and nobody sells it. Second, the rebate pilot creates a brand-new workflow, claims-level submission inside 45 days with denial reconciliation, that every small entity needs by January 1 and no small-entity product covers. Incumbents will eventually ship both, but their roadmaps serve the hospitals that pay enterprise retainers, not the clinics that fail audits on typos.

The Solution

An audit-readiness platform priced for the 12,000 covered entities the incumbents ignore, built around the registry first and the rebate pilot second:

1. Registry Monitor (the wedge): continuous diffing of the entity's OPAIS record against its real-world footprint. Shipping addresses, contract pharmacy rosters with written-contract verification, offsite facility listings, EIN and Medicare cost-report dates, recertification deadlines. Every drift generates an alert with the exact HRSA finding it would have become, citing the FY2025 audit data. This is the 40.9 percent finding turned into a push notification.

2. Recertification and exclusion-file autopilot: annual recertification calendar with owner assignment and evidence collection, Medicaid Exclusion File checks on a schedule instead of at audit time, and GPO prohibition guardrails for the hospital types the statute restricts. Software replaces the spreadsheet nobody opens as the compliance calendar.

3. Rebate-pilot claims engine: NDC-11 eligibility checks against the published Medicare selected-drug lists for 2026 and 2027, 45-day submission tracking from dispense date, 10-day manufacturer payment reconciliation, and denial documentation packaged for the dispute process. Ships before January 1, while every small entity is still asking its wholesaler rep how the pilot works.

4. State reporting module: the nine state annual reports generated from the same underlying data, with Minnesota, Idaho, and Ohio deadlines calendared. States are not going away; a second compliance calendar is a second moat.

5. One-click HRSA audit binder: policies, self-audit logs, corrective-action templates, and the registry history that proves the entity monitored itself. When the 1.3 percent lottery ticket gets drawn, the binder is already built. Before the letter arrives.

Independence is the pitch. A vendor owned by none of the inspected parties sells trust the incumbents structurally cannot.

Revenue Model

Revenue Stream	Amount	Notes
Core SaaS (clinics)	$700/mo	Registry monitor, recertification autopilot, exclusion-file checks. Annual contract. Targets health centers, Ryan White clinics, STD/TB programs.
Core SaaS (small hospitals)	$2,500/mo	Adds GPO guardrails, multi-site OPAIS management, diversion risk scoring on dispense feeds.
Rebate-pilot claims processing	$3/claim	Per-claim fee on pilot-eligible NDCs; scales with specialty volume, not headcount.
State filing service	$1,500/state/year	Nine states and counting; pure margin once the module exists.
Audit response pack	$7,500/audit	Binder assembly, finding-response drafting support, corrective-action templates. Flat fee; scoped to one audit cycle.

Unit economics on 350 entities: blended $1,200 a month across the two SaaS tiers yields $5.04 million ARR. Claims processing on pilot-eligible specialty volume adds an estimated $200,000 to $500,000 a year at $3 per claim, which implies 65,000 to 165,000 pilot-eligible claims across the base. That range assumes specialty-heavy clinics; it is upside, not the plan. Customer acquisition through the 340B Coalition winter and summer conferences, state primary-care association partnerships, and outbound to newly registered entities runs an estimated $4,500 per entity, with payback inside five months on SaaS gross margin alone. Gross margins sit near 85 percent: the product is scheduled diffs, calendars, and document assembly, not headcount. Software margins.

Market Size

TAM: Start from HRSA's 15,249 covered entities, of which about 2,670 are hospitals, inferred from the American Hospital Association's figure that HRSA audits roughly 160 hospitals a year, about 6 percent of participating hospitals. Price hospitals at $30,000 a year for $80 million, and price the remaining 12,580 non-hospital entities at $8,400 a year ($700 a month) for $106 million; that non-hospital base, rounded, is the 12,000-entity long tail referenced throughout this piece. Combined software TAM: approximately $186 million a year.

That hospital count is an inference, not a published table, so treat it as one. It is inferred, not published as a single HRSA table, and the $30,000 hospital ARPA assumes the product eventually climbs into small-hospital budgets it does not start in. If the true hospital count is 2,200, the TAM is $176 million, and if non-hospital willingness to pay is $500 a month instead of $700, it is $155 million. Every step is linear and the uncertainty is stated.

SAM: The segment the incumbents structurally underserve, health centers, critical access hospitals, rural referral centers, Ryan White entities, and the smaller grantee types with real 340B dollars and no pharmacy IT department, is estimated at 8,000 entities, roughly two-thirds of the non-hospital base, at $700 a month, a serviceable market of approximately $67 million a year.

SOM (year 3): 350 entities on the platform at a blended $1,200 a month, or $5.04 million ARR and about 7.5 percent of the SAM, which is one 340B Coalition conference's worth of booth traffic converted over three years, or roughly 2.3 percent of all covered entities. Expansion revenue on top comes from the pilot claims engine and state filing module.

Why Now

The rebate pilot goes live in 63 days. HRSA's August 3, 2026 notice sets a January 1, 2027 effective date for the Rebate Model Pilot: up to 25 Medicare-selected drugs, less than 5.5 percent of 340B sales, ten manufacturers approved covering 18 of 20 products, with manufacturers joining voluntarily while covered entities acquiring those drugs must buy at WAC and chase claims-level rebates on a 45-day clock. Almost none has the workflow. Every affected entity needs it built before January. HRSA's own estimate puts the claims-submission burden at $537 million a year; the hospital association's complaint puts full operational costs above $1 billion a year for hospitals alone. Someone counted.

Scale guarantees scrutiny. One hundred billion dollars growing at 23 percent a year is a political fact, not just a market fact. On October 9, 2026, the American Hospital Association sued HHS and HRSA over the pilot, calling it compulsory for 15,000+ entities while voluntary for drug companies. Regulatory flux favors nimble software over incumbent consulting retainers, because guidance changes arrive as Federal Register notices and software ships weekly.

Contract-pharmacy restrictions keep spreading. What began in 2020 as a handful of manufacturers limiting 340B shipments to contract pharmacies has become standard manufacturer practice, forcing every entity to manage site-by-site eligibility instead of assuming the discount follows the prescription, which makes eligibility tracking exactly the registry-adjacent problem the monitor already solves.

States are building a second compliance layer. Nine states now require their own annual 340B covered-entity reports, and state mandates do not get vacated by federal lawsuits, which makes the state reporting module the durable half of the product even if the pilot wobbles.

Courts centralized the rulebook. Manufacturers cannot go unilateral: the D.C. Circuit held that HRSA must approve rebate models before anyone can use them, rejecting unilateral manufacturer models, while leaving room for HRSA-designed pilots. One agency writing the rules means one moving target, and a single moving target is a software-shaped problem. One target.

Startup Costs

Category	Cost	Notes
Platform engineering (12 months)	$330K	2 backend + 1 frontend. OPAIS diffing engine, recertification workflow, claims ingestion, audit binder generation, state report templates.
340B subject-matter expert	$120K	Ex-TPA consultant or former covered-entity pharmacy director. Interprets HRSA guidance faster than lawyers and sells credibility to pharmacy directors.
Healthcare counsel + HIPAA/SOC 2	$90K	Outside counsel for guidance interpretation; SOC 2 Type II because the product touches dispensing data and PHI. Non-negotiable for hospital buyers.
EHR and wholesaler integrations	$70K	Dispense-feed ingestion (the diversion-risk scoring needs it), wholesaler EDI for purchase data. Start with the two largest EHRs in community health.
Sales and marketing (year 1)	$80K	340B Coalition conferences, state primary-care association sponsorships, pilot concierge for first 20 entities.
Cloud and data infrastructure	$30K	OPAIS snapshots, exclusion-file mirrors, claims storage. Boring and cheap.
Operating buffer	$80K	Twelve months of contingency against slower clinic sales cycles and HRSA guidance churn.
Total	$800K

Limitations

Start with the softest input: the hospital count is inferred from audit-coverage math, not published as a single HRSA table, and the TAM scales linearly with it. Audit statistics cover finalized FY2025 audits (176), not every audit HRSA initiated, and GATP Solutions' finding counts are one analyst's tally of HRSA's published rows, careful but unofficial. Behind the rebate-float math sit program-average discount depths applied to a hypothetical $12,000 script; real spreads vary wildly by NDC, and the pilot covers under 5.5 percent of 340B sales, so the claims engine is a wedge, not the whole revenue story. This analysis cannot size the average repayment either, because HRSA publishes findings but not dollar sanctions in aggregate, which means the expected-value math prices the probability but not the severity. Finally, small clinics are price-sensitive buyers with 12-month budget cycles; $700 a month is cheap for software and real money for a Ryan White clinic, and the SOM assumes they buy at something like enterprise speed. They will not. And one more honest accounting: the business monetizes fear of the audit lottery among safety-net providers, so published, capped panic-pricing and a free tier for sub-$2M entities would keep the product from deepening the compliance gap it sells against.

Strongest Counterargument

The market is finite and the top is taken. Fifteen thousand entities is the whole universe, it grows slowly, and Macro Helix already serves roughly 40 percent of 340B hospitals with McKesson's distribution relationship behind it. Selling against an incumbent that also ships the drugs is a special kind of hard. Worse, the rebate pilot that supplies the urgency could be vacated: the first pilot was enjoined in December 2025 and vacated on agreed remand in February 2026, and the hospital association's October lawsuit makes the same arguments louder. HRSA writes guidance the way other agencies write weather, so any feature can be obsoleted by a Federal Register notice. And Congress keeps the program itself under existential review, with reform drafts that could narrow eligibility and shrink the TAM this piece is built on. Stripped of politeness, this objection says the ceiling is a niche inside a program that might get smaller, sold against an entrenched incumbent, on a regulatory timetable nobody controls.

Take it seriously, because most of it is true. Build the rule-agnostic half first instead: OPAIS monitoring does not care whether the pilot survives, because registration errors predate the pilot and will outlive it. State reporting does not care what Congress does, because states write their own mandates. Price for clinics, where Macro Helix does not bother to compete, and let the pilot claims engine be the upsell rather than the foundation. If the pilot is vacated, the company still owns the cheapest audit finding in the program. If 340B narrows, the survivors need compliance more, not less. Finite markets with mandatory compliance are exactly where small software companies outmaneuver big ones: the TAM never justifies the incumbent's attention, which is why the gap exists in the first place. That is the opening.

What You Can Do

If you run pharmacy at a covered entity: Pull your OPAIS record today and diff it against reality: every shipping address, every contract pharmacy with its written contract date, every offsite facility, the EIN, the Medicare cost-report dates. HRSA publishes what it found at entities like yours; 41 percent of the findings are this diff. Then check whether your state is one of the nine with its own annual report and calendar the deadline before it calendars you.

If you dispense any of the Medicare-selected drugs: Map your NDC-11s against the 2026 and 2027 selected-drug lists now, because if the pilot touches your volume, the 45-day submission clock starts January 1 whether your workflow is ready or not. Price the working-capital float at your own WAC-minus-ceiling spreads and take the number to your CFO before the manufacturer does.

If you are building this: Start with the OPAIS diff, because it is public data, it is the most common finding, and it demos in a week. Sign the 340B subject-matter expert before the second engineer, because pharmacy directors buy from people who have survived an HRSA audit. Ship the pilot claims engine by December, because January 1 is a forcing function no marketing budget can buy. Independence from wholesalers and manufacturers is the pitch; put it on the homepage. Ship it.

The Bottom Line

A $100 billion program now runs on paperwork, and the most common way to fail an audit is a typo in a federal registry. HRSA publishes the failures by name, orders repayment in nearly a third of audits, and is about to add a claims-based rebate workflow that every small entity must operate starting January 1. Incumbents sell to the hospitals; the 12,000 smaller covered entities get consultants they cannot afford or nothing at all. A registry monitor that turns the cheapest finding in the program into a push notification, priced for clinics and independent of every wholesaler and manufacturer, is not another TPA. It is the compliance layer a $100 billion program assumed someone would build, sold to the entities that need it most, at the exact moment the rules change.