Loading compliance resources…
Our analysis is not legal, medical, financial, tax, or regulatory advice. Read the original source and talk to a qualified professional before you act.
Our analysis is not legal, medical, financial, tax, or regulatory advice. Read the original source and talk to a qualified professional before you act.
We use Google Analytics, Vercel Web Analytics, and Vercel Speed Insights to improve the site. Select Decline to turn them off in this browser. We honor GPC and Do Not Track.
Read our Privacy Policy.
FQHC regulations with CFR citations, practical implications, and primary sources.
The foundational statute authorizing FQHC grants. Defines required services, governance structure, sliding fee requirements, and eligible populations.
Every FQHC must comply with all Section 330 requirements to maintain grant funding. Non-compliance can result in conditions of award, restricted funding, or grant termination.
The definitive guide to FQHC compliance. 20 chapters covering every program requirement from governance to clinical services to financial management.
This is the primary reference HRSA reviewers use during OSVs. Every FQHC compliance officer should have this bookmarked and use it for self-assessment.
Detailed HRSA guidance on implementing sliding fee schedules. Requires nominal or no charges for patients at/below 100% FPL and discounts through 200% FPL.
Most common OSV finding: FQHCs charging nominal fees to patients below 100% FPL (must be zero). Second: not updating to current year FPL levels.
Annual reporting requirements for all Section 330 grantees. Covers patient demographics, services, staffing, clinical quality, financial data, and health outcomes.
UDS data determines HRSA Quality Recognition badges, influences grant funding, and is publicly available. Late or inaccurate submission can trigger HRSA review.
Establishes standards for protected health information (PHI). Defines patient rights to access, amend, and restrict use of their health records.
FQHCs must respond to patient access requests within 30 days. Must provide Notice of Privacy Practices. Cannot use/disclose PHI without authorization except for TPO (treatment, payment, operations).
Requires administrative, physical, and technical safeguards for electronic PHI (ePHI). Includes risk analysis, workforce training, access controls, and encryption.
Annual risk assessment is REQUIRED (45 CFR § 164.308(a)(1)). Most common HIPAA violation for FQHCs: failure to conduct risk assessment. Must encrypt all devices storing ePHI.
Requires notification to individuals, HHS, and media (if 500+ affected) within 60 days of discovering a PHI breach. Breaches affecting fewer than 500 must be logged and reported annually.
Cost of notification can exceed $100K for large breaches (postage, credit monitoring, legal). Small breaches (under 500) still must be logged on HHS portal by March 1 annually.
Any entity that creates, receives, maintains, or transmits PHI on behalf of an FQHC must sign a BAA. Includes EHR vendors, clearinghouses, cloud storage, billing services.
Missing BAA = automatic HIPAA violation if that vendor has a breach. FQHCs must inventory ALL vendors handling PHI and ensure current BAAs. Common gap: telehealth platform vendors.
California state privacy laws that may apply to FQHC operations beyond HIPAA. CCPA/CPRA covers employee data and non-patient data. More restrictive than HIPAA in some areas.
While HIPAA-covered patient data is largely exempt, employee data, volunteer data, and non-clinical research data may be subject to CCPA/CPRA. FQHCs with 50+ employees should assess applicability.
FQHCs receive a per-visit PPS rate from Medicaid (and cost-based from Medicare). Rate covers all services in a single encounter. Must understand same-day billing rules.
Key rules: (1) Same-day medical + BH with different providers = 2 encounters for Medicare, 1 for most Medi-Cal. (2) FQHCs cannot bill incident-to. (3) PPS rate is all-inclusive — no separate lab/supply charges.
Imposes civil penalties for knowingly submitting false claims to the government. Penalties: $13,946 to $27,894 per false claim plus treble damages. Whistleblower (qui tam) provisions.
FQHCs billing Medicaid/Medicare face FCA liability for: upcoding, billing without face-to-face encounter, incident-to billing (not allowed for FQHCs), and 340B duplicate discounts. Staff can report violations as qui tam relators.
Requires drug manufacturers to offer outpatient drugs at significantly reduced prices to eligible entities including FQHCs. Savings of 25-50% on drug costs.
Critical revenue source for FQHCs but heavily audited. Key compliance: (1) No duplicate discounts (340B + Medicaid rebate). (2) Only eligible patients. (3) Contract pharmacy arrangements must follow HRSA guidance. (4) HRSA can audit at any time.
Prohibits offering, paying, soliciting, or receiving anything of value to induce referrals for services covered by federal healthcare programs. Criminal penalties.
FQHCs must ensure referral relationships, physician recruitment agreements, and vendor contracts don't create kickback risk. Safe harbors exist for employment, space rental at FMV, and personal services contracts.
Prohibits physicians from referring Medicare/Medicaid patients to entities with which the physician has a financial relationship, unless an exception applies. Strict liability — no intent required.
Relevant for FQHCs with physician-owned labs, imaging centers, or specialty practices. In-office ancillary exception may apply. Key: document all physician financial relationships.
Phases in a $25/hour healthcare minimum wage for FQHCs by July 1, 2027 (Group 4 schedule). The $22/hour step took effect July 1, 2026 and is the rate in force now; $25/hour follows on July 1, 2027. The $21 rate ran from October 16, 2024 through June 30, 2026 and is historical. Applies to all healthcare workers in qualifying facilities.
FQHCs must plan for wage compression (MAs at $25/hr approach LVN wages). Budget impact: 15-25% increase in labor costs for lowest-paid staff. Must also comply with pay equity requirements.
On July 14, 2026, HHS-OIG posted its first published favorable advisory opinion on a provider-run 'food-as-medicine' program. The requestor — identified in the opinion as an entity 'designated as a federally qualified health center' under Section 330 — offers $20-30/week of produce (boxes or vouchers) to roughly 50 low-income diabetes and hypertension patients, tied to health assessments. OIG found the arrangement technically implicates the federal Anti-Kickback Statute and the Beneficiary Inducements CMP but said it would not impose sanctions, citing low fraud risk and clinical safeguards.
Gives FQHCs a concrete compliance roadmap for structuring nutrition and social-determinants-of-health programs (produce prescriptions, medically tailored food) without triggering Anti-Kickback or Beneficiary Inducement liability: modest per-patient value, a clinical nexus, and eligibility tied to a documented condition. The opinion binds only the requestor but signals OIG's analytical framework for similar FQHC programs nationwide.
Analyses published in June-July 2026 of HRSA Office of Pharmacy Affairs FY2025 audit data report that 49% of 115 audited 340B covered entities received adverse findings (down from 64% in FY2024), driven mainly by OPAIS registry errors (about 75% of adverse findings) and duplicate-discount / Medicaid Exclusion File issues. Federally qualified health centers — with Ryan White and STD clinics — made up 16% of FY2025 audits (hospital-based programs were 84%). Sanctions followed in 64% of adverse-finding cases, with 50% requiring manufacturer repayment and 21% resulting in site termination.
Most FQHC 340B audit failures stem from administrative registry (OPAIS) accuracy, not fraud, so audit-readiness means keeping OPAIS records, contract-pharmacy listings, and Medicaid billing/exclusion status current and reconciled. With about 1 in 5 adverse findings ending in site termination, compliance officers should self-audit OPAIS and duplicate-discount controls ahead of any HRSA audit notice.
HRSA's FY 2026 manufacturer audit results page, updated July 30, 2026, posts finalized results for three audits. Neolpharma, Inc. (labeler code 55466, Caguas, Puerto Rico) had incorrect 340B OPAIS records, did not offer covered outpatient drugs to eligible covered entities at the 340B ceiling price, and did not submit quarterly pricing to OPAIS; Zydus Pharmaceuticals (USA), Inc. (labeler codes 70710, 68382 and 82182, Pennington, New Jersey) failed to refund covered entities for charges above the 340B ceiling price. Both carry a sanction of repayment to covered entities, and HRSA lists both corrective action plans as approved. Shield Therapeutics, Inc. (Massachusetts) had no adverse findings, and the page does not publish dollar amounts.
Manufacturer audits are the part of 340B enforcement that can send money back to covered entities, a group that includes health centers. HRSA recommends that covered entities not contact audited manufacturers about sanctions until a corrective action plan has been approved and posted; for Neolpharma and Zydus that has happened, and the page lists a contact for each manufacturer. Pharmacy and 340B staff can check purchase records for products under these labeler codes and watch for repayment notices, including on HRSA's Manufacturer Notices to Covered Entities page.
HRSA's performance-year 2026 revision of the Uniform Data System, submitted to OMB with a 30-day public comment period that closed July 16, 2026, streamlines and updates the required annual reporting for all Section 330 awardees and look-alikes (nearly 1,400 health centers, 16,200+ sites, 32M+ patients). Key changes: the Selected Service Detail Addendum (integrated MH/SUD lines 20a01-21h) is removed and folded into the core of Table 5; specific mental-health personnel types including PMHNPs are added to Line 20b; four Patient Support Services measures (case management, eligibility assistance, transportation, language assistance) are added as Table 6A lines 35-38; and four Upstream Drivers of Health screening/service measures move from Appendix D into core Table 6A lines 39-42. HRSA estimates total burden falls about 72,701 hours (roughly 42 hours per health center), from 377,317 to 304,616 hours.
Compliance and data teams must update EHR templates, UDS field mapping, and staffing crosswalks before the performance-year 2026 reporting cycle: retire the Selected Service Detail Addendum, classify PMHNPs correctly on Line 20b, and stand up capture for the new patient-support-services and upstream-drivers core measures. The comment window has closed, so the changes should be treated as finalizing; the exact submission deadline will appear in the forthcoming 2026 UDS Manual.