Not legal or compliance advice: This note is educational. It describes KPI categories and data practices at a conceptual level. It does not prescribe specific thresholds, targets, or audit-safe metrics. Consult your 340B compliance officer, your legal counsel, your external 340B auditor, HRSA OPA, and Apexus before implementing any measurement or dashboard.
The word optimization shows up often in 340B discussions. It is worth pausing on. Section 340B of the Public Health Service Act was enacted so that covered entities could "stretch scarce federal resources as far as possible, reaching more eligible patients and providing more comprehensive services." The statutory intent is access and reach. The frame that best fits that intent is stewardship: the careful, accountable management of a program whose benefits are meant to flow to patients and mission.
This article proposes that covered entities build their data and analytics practice around stewardship — measuring what makes the program compliant, operationally healthy, and demonstrably tied to mission.
Core data sources
A 340B program's data picture is inherently multi-source.
- Electronic Health Record (EHR). The authoritative source for patient encounters, clinical responsibility, provider credentialing, and services rendered.
- Pharmacy dispensing systems. In-house pharmacies run their own dispensing platforms.
- Claims data. Payer claims document what was billed, what was paid, and in what setting.
- Third-Party Administrator (TPA) / split-billing software. Maintains accumulators, applies eligibility logic, flags qualifying dispenses, manages replenishment.
- Wholesaler data. Purchase history at 340B, WAC, and other price types.
- Medicaid state feeds and MCO data.
- Contract pharmacy data. Dispense files from each contract pharmacy, normalized into a common schema.
- Manufacturer-restriction tracking. Internal records of each manufacturer's current policy and the entity's response.
Authoritative sources vary: For any given data element, ask: which system is authoritative? Ambiguity is where reporting errors originate.
Data hygiene basics
Before sophisticated analytics, invest in basic hygiene.
- Mapping files. Provider-to-site mappings, department-to-service-area mappings, and NDC crosswalks need named owners.
- Reference data currency. Registered sites and associated providers must reflect the current state of OPAIS.
- Reconciliation routines. Dispense-to-replenishment, purchase-to-inventory, and accumulator-bank reconciliation should run on a schedule.
- Exception handling. Records that fail eligibility logic need a queue, an owner, and a target resolution time.
- Change control. Changes to TPA configuration, mapping files, or eligibility rules should be logged with effective date, reason, approver, and downstream impact assessment.
- Data retention. Aligned with HRSA audit look-back expectations.
Hygiene is a prerequisite, not an achievement: An entity that cannot reliably tell you which providers were credentialed at which registered site on a given date will struggle to defend any eligibility determination built on that data.
A layered KPI framework
Layer 1: Compliance KPIs
The purpose of compliance KPIs is to show that the program is operating within HRSA's rules and the entity's own policies.
- Eligibility determination completeness.
- Duplicate-discount prevention indicators.
- Self-audit findings closure.
- Policy and procedure refresh cadence.
- Training completion.
- Recertification readiness.
- External audit findings.
Describe, do not promise: Compliance KPIs describe the state of the program. They do not promise audit outcomes. A clean dashboard is not an audit pass.
Layer 2: Operational KPIs
Operational KPIs tell you whether the plumbing is working.
- Accumulator bank health (as a concept). Whether accumulators are behaving as your operating model expects.
- Replenishment cycle times.
- Prescription capture indicators.
- Inventory variance flags.
- Wholesaler purchase mix.
- Rejection and reversal rates.
- System availability.
Layer 3: Stewardship and impact KPIs
This is where the program's mission shows up in the numbers — carefully.
- Reinvestment documentation. Mission-aligned services, staff, sites, or supports that exist in part because of 340B.
- Patient access metrics. Indicators that the entity is serving the populations 340B was intended to reach.
- Services funded or sustained. Concrete programs, described factually without forward-looking promises.
- Community benefit context. For hospitals, alignment with community health needs assessment priorities.
Stewardship metrics require narrative: Numbers alone rarely tell the stewardship story. Pair each impact metric with a short, factual narrative. Avoid language that promises outcomes or implies a return-on-investment frame.
Layer 4: Risk KPIs
- Aged holds. Dispenses held for eligibility review beyond target windows.
- Manual override frequency.
- Contract pharmacy anomaly flags.
- Manufacturer-restriction exposure.
- Medicaid-exclusion drift.
- Provider and site changes.
- Turnover in key program roles.
A sample risk-layer conversation: Each month, the compliance officer reviews the risk layer with the 340B committee. For any indicator outside its expected range, the owner presents a brief root-cause and remediation plan. Items are closed only with documentation, not with assurance.
Reporting cadence
- Daily / weekly operational. Accumulator, replenishment, rejection, and system-health indicators.
- Monthly compliance and risk. The 340B committee reviews compliance and risk layers.
- Quarterly governance. Broader review including operational trends and manufacturer-restriction posture.
- Annual board-facing. A stewardship-focused report pairing numbers with narrative.
Dashboards vs. deep-dives
A dashboard shows whether indicators are within expected ranges. Good dashboards are boring — most of the time, they tell you nothing is wrong. A deep-dive is a focused analytical review of a specific question. Deep-dives produce decisions; dashboards surface the need for deep-dives.
Do not let the dashboard become the program: Dashboards measure what you instrumented, and you did not instrument everything. Schedule deep-dives proactively, including in areas the dashboard says are fine.
Governance: who reviews what
- Operational owners review daily and weekly indicators.
- Compliance officer reviews compliance and risk layers monthly.
- 340B committee reviews compliance, risk, and operational summaries monthly or quarterly.
- Executive leadership and board receive stewardship-focused reporting annually.
- External auditors receive the data they need for their scope.
Audit trail and data retention principles
- Methodology documentation. Written definitions for every KPI.
- Point-in-time reproducibility. The ability to rerun a metric for a prior period.
- Change logs. A record of definition changes, with effective dates and rationale.
- Access controls.
- Retention periods. Aligned with HRSA audit look-back expectations.
- Back-ups and immutability.
Retention is a legal question: Retention periods should be set with counsel. Do not rely on a vendor default.
Common pitfalls
Pitfall: vanity metrics. A quarterly "340B dollars" headline, shorn of context, often falls in this category.
Pitfall: over-reliance on a single TPA dashboard. An independent check catches issues a TPA dashboard cannot surface.
Pitfall: chasing metrics that don't tie to compliance or mission.
Pitfall: under-investing in hygiene.
Pitfall: lack of narrative.
Pitfall: no one owns the KPI.
A practical checklist
- Documented data inventory with named authoritative source per element.
- Mapping files, reference data, and change-control practices with named owners.
- Written definitions for every KPI across the four layers.
- Reporting cadence defined and honored.
- Dashboards distinguished from deep-dives.
- Governance body that actually reviews the risk layer and acts on exceptions.
- Audit trail: reproducible metrics, change logs, retention aligned with counsel guidance.
- Stewardship narrative paired with stewardship numbers.
- Annual review of the KPI framework itself.
References
- Section 340B of the Public Health Service Act, 42 U.S.C. § 256b.
- HRSA Office of Pharmacy Affairs (OPA): program guidance, 340B OPAIS, Medicaid Exclusion File.
- Apexus Answers: operational and pricing questions.
- Office of Inspector General (OIG), HHS reports on 340B program integrity.
- AICPA and relevant external-audit standards.
- HIPAA Privacy and Security Rules.
- Entity-type trade associations.
This article is educational and does not constitute legal, tax, regulatory, compliance, or financial advice. Program rules change; verify current guidance with HRSA's Office of Pharmacy Affairs, Apexus, and qualified counsel before acting.