FQHC Compliance Requirements Across Funding Streams

The HRSA 19 Program Requirements

The 19 Program Requirements are the core compliance framework for every Section 330 grantee and FQHC Look-Alike. Established by HRSA's Bureau of Primary Health Care (BPHC), these requirements define what it means to be a health center — covering governance, services, management, and operations. Failure to meet these requirements can result in conditions of award, progressive action, and ultimately loss of FQHC designation. For the complete breakdown, see our HRSA 330 Health Center Program Guide.

The 19 requirements are organized into five categories:

Need (Requirements 1–3)

The health center must serve a defined service area that is a federally-designated Medically Underserved Area (MUA) or Medically Underserved Population (MUP), or demonstrate need through other documented evidence. The service area must be reflected in the scope of project approved by HRSA through the Electronic Handbooks (EHBs), and any changes to the service area require a Change in Scope (CIS) request.

Services (Requirements 4–8)

The health center must provide comprehensive primary care services either directly or through formal written referral arrangements. Required service categories include primary medical care, diagnostic laboratory, diagnostic radiology, screening, preventive dental, pharmaceutical, emergency medical, and hospital services. Behavioral health services, enabling services (transportation, case management, translation), and after-hours coverage are also required. The specific services must be documented in the approved scope of project and reflected in UDS reporting.

Management and Finance (Requirements 9–13)

The health center must maintain financial management and accounting systems that meet federal requirements under 2 CFR Part 200, conduct an annual independent financial audit, maintain a sliding fee discount program (SFDP), ensure that no patient is denied services based on inability to pay, and establish billing and collection policies that comply with federal requirements. The organization must also maintain a quality improvement / quality assurance (QI/QA) program that tracks clinical outcomes, patient satisfaction, and operational performance.

Governance (Requirements 14–17)

The health center board must have a patient majority — at least 51% of board members must be patients who use the health center as their primary source of care. The board must meet at least monthly (or as required by bylaws), approve the health center's annual budget and grant applications, select and evaluate the CEO/Executive Director, and approve the sliding fee discount schedule. Board composition must reflect the demographics of the service area population.

Administrative (Requirements 18–19)

The health center must maintain its status as a public or nonprofit 501(c)(3) organization, file required reports and applications through EHBs, comply with all terms and conditions of the Notice of Award, and maintain compliance with federal civil rights requirements, including Section 504 (disability), Title VI (race, color, national origin), and the Age Discrimination Act.

2 CFR Part 200 (Uniform Guidance) Requirements

All federal grant recipients, including FQHCs, must comply with the Uniform Administrative Requirements, Cost Principles, and Audit Requirements codified in 2 CFR Part 200. This regulation applies across every federal funding stream the FQHC holds — Section 330, Ryan White, SAMHSA, CDC, and any other direct federal awards or pass-through funds.

Key 2 CFR 200 compliance areas for FQHCs include:

• Financial management systems — accounting systems must track expenditures by grant, budget category, and cost center; must support preparation of accurate financial reports; and must provide adequate internal controls (Subpart D)
• Cost principles — all costs charged to federal awards must be allowable, allocable, reasonable, and consistently treated; time-and-effort documentation is required for personnel charging time across multiple funding sources (Subpart E)
• Procurement standards — purchases must follow documented procurement procedures including competition requirements, conflict of interest policies, and documentation retention (Subpart D, §200.317–327)
• Property and equipment management — equipment purchased with federal funds must be tracked in a property inventory, used for the authorized purpose, and disposed of according to federal rules (Subpart D, §200.310–316)
• Single Audit — organizations expending $750,000 or more in federal awards in a fiscal year must complete a Single Audit that covers all federal programs (Subpart F)

For FQHCs holding multiple federal awards, the 2 CFR 200 cost allocation requirement is particularly demanding. Shared costs — the CEO's salary, facility rent, IT systems, billing department staff — must be allocated across all benefiting programs using a methodology that is documented, consistently applied, and defensible under audit. Most FQHCs use either a direct allocation method or an indirect cost rate to distribute shared costs. Organizations with a negotiated indirect cost rate agreement (NICRA) or that elect the 10% de minimis rate under §200.414 must apply that rate consistently.

FTCA Deeming Requirements

Section 330 grantees (not Look-Alikes) are eligible for deemed Public Health Service (PHS) employment status under the Federal Tort Claims Act (FTCA), which provides medical malpractice coverage for the health center and its clinical staff at no cost. FTCA coverage replaces the need for commercial malpractice insurance, saving health centers hundreds of thousands of dollars annually.

Maintaining FTCA deeming requires:

• Annual deeming application through EHBs with required documentation of credentialing, privileging, and risk management policies
• Credentialing and privileging of all clinical providers according to HRSA's credentialing and privileging standards
• Risk management program with incident reporting, claims tracking, and quality improvement based on incident trends
• Coverage limited to services within the approved scope of project at approved sites — services outside scope or at non-approved locations are not covered
• Timely reporting of malpractice claims to the HHS Office of the General Counsel

The FTCA deeming process intersects with scope of project management — services provided outside the approved scope are not covered, which means that scope changes must be approved by HRSA before services begin at new locations or in new clinical areas. This has direct implications for FQHCs expanding services through other funding streams: if a SAMHSA grant funds a new behavioral health service at a new site, that site and service must also be added to the HRSA scope of project before FTCA coverage applies.

340B Drug Pricing Program Compliance

The 340B Drug Pricing Program, established by Section 340B of the Public Health Service Act, allows FQHCs and other covered entities to purchase outpatient drugs at significantly reduced prices from drug manufacturers. For many health centers, 340B savings represent a critical revenue stream that subsidizes pharmacy operations and funds expanded services. 340B compliance is overseen by HRSA's Office of Pharmacy Affairs (OPA).

Key 340B compliance requirements include:

• Eligible patient definition — 340B drugs can only be dispensed to patients who have an established relationship with the health center and receive a health care service from a provider who is employed by or contracted with the covered entity
• Prohibition on duplicate discounts — the health center cannot receive both a 340B price and a Medicaid drug rebate on the same prescription; this requires systems to prevent overlap between the 340B program and Medicaid managed care
• Prohibition on diversion — 340B drugs cannot be resold, transferred, or dispensed to individuals who do not meet the eligible patient definition
• Contract pharmacy oversight — FQHCs that use contract pharmacies to dispense 340B drugs must maintain written agreements, ensure eligible patient verification at the contract pharmacy, and prevent diversion and duplicate discounts in the contract pharmacy relationship
• Annual recertification — FQHCs must recertify annually through the 340B OPAIS system, confirming compliance and updating covered entity information

340B compliance has become increasingly scrutinized in recent years, with OPA conducting more frequent audits and manufacturers imposing restrictive conditions on contract pharmacy arrangements. FQHCs should maintain robust 340B policies and procedures, conduct regular self-audits, and track 340B program integrity metrics monthly. For common 340B audit findings, see our audit findings guide.

HIPAA and Patient Privacy

FQHCs are covered entities under the Health Insurance Portability and Accountability Act (HIPAA) and must comply with the Privacy Rule, Security Rule, and Breach Notification Rule. While HIPAA compliance is a requirement for all healthcare providers, FQHCs face unique challenges because of their multi-funder reporting obligations.

Health centers routinely share patient data with HRSA (through UDS and EHBs), with Ryan White program administrators (through the RSR), with state agencies (through various reporting systems), and with research partners and quality improvement collaboratives. Each of these data sharing relationships must be supported by appropriate HIPAA authorizations, business associate agreements, or statutory exceptions. The intersection of HIPAA with 42 CFR Part 2 (substance use disorder records) creates additional complexity for FQHCs providing SUD treatment services — Part 2 imposes stricter consent requirements that apply in addition to HIPAA.

Sliding Fee Discount Program (SFDP) Requirements

The SFDP is one of the most distinctive compliance requirements of FQHC status. All Section 330 grantees and Look-Alikes must offer a sliding fee discount based on family size and income, using the Federal Poverty Level (FPL) as the benchmark. No patient may be denied services due to inability to pay, and patients at or below 100% FPL must not be charged for services.

HRSA expects the SFDP to meet specific design criteria:

• The schedule must include at least three discount pay classes between 100% and 200% FPL, plus a full-pay class above 200% FPL and a nominal or no-charge class at or below 100% FPL
• Discounts must apply to all services within the approved scope of project, including pharmacy, dental, behavioral health, and enabling services
• The schedule must be posted in public areas and made available to all patients; staff must be trained to apply it consistently
• Income verification processes must be documented, and the SFDP must be updated annually to reflect current FPL guidelines
• The governing board must approve the SFDP and any changes to the fee schedule

SFDP compliance is one of the most frequently cited areas in HRSA Operational Site Visits. Common issues include failing to apply discounts to all services, using an outdated FPL schedule, having insufficient discount levels between 100% and 200% FPL, and billing or collection practices that effectively deny access to patients who cannot pay.

Board Governance Requirements

FQHC governance requirements are among the most specific in the nonprofit sector. The governing board must maintain a composition where at least 51% of members are registered patients who use the health center as their primary source of care and who, as a group, reasonably represent the patient population served. This patient-majority requirement is designed to ensure community accountability and is strictly enforced by HRSA.

Board members who are patients cannot be employees of the health center. The remaining board members (non-patient seats) should include individuals with expertise in finance, law, healthcare administration, and community affairs. The board is required to:

• Meet at least monthly (or per bylaws, but no less frequently than quarterly with HRSA approval), with documented minutes
• Approve key organizational documents: annual budget, grant applications, sliding fee discount schedule, bylaws, and the annual independent audit
• Select, evaluate, and if necessary dismiss the CEO/Executive Director, with authority over compensation
• Adopt a conflict of interest policy and ensure board members disclose and manage conflicts
• Ensure the health center's mission, strategic plan, and quality goals reflect community needs

Scope of Project Management

The scope of project is the official record of what services the FQHC provides, where it provides them, and how it provides them. It is maintained in HRSA's Electronic Handbooks (EHBs) and includes the list of approved service sites, the services available at each site, the service delivery method (direct or referral), provider types, and operating hours.

Any change that alters the scope of project requires a Change in Scope (CIS) request through EHBs, which must be approved by HRSA before implementation. Common CIS triggers include:

• Adding or removing a service delivery site
• Adding a new service type (e.g., dental, pharmacy, behavioral health)
• Adding or removing a target population
• Changing from direct service delivery to referral (or vice versa)
• Significant changes to service capacity or operating hours

Scope management is particularly important for FQHCs that add services through non-330 funding streams. If a SAMHSA CCBHC grant funds a new behavioral health program at a new site, that site and service must be added to the 330 scope of project — otherwise FTCA coverage will not apply, UDS data may be incomplete, and the health center risks compliance findings on both the 330 and SAMHSA grants.

How Requirements Overlap Across Funding Streams

The compliance challenge for FQHCs is not just the volume of requirements but how they interact. A single operational area — say, financial management — may be simultaneously governed by the HRSA 19 Program Requirements, 2 CFR 200, Ryan White program terms, state contract provisions, and the health center's own board-approved policies. The following table illustrates key overlap areas:

The practical implication is that health centers cannot manage compliance in silos. A policy change that affects financial management must be evaluated against every applicable framework. A new procurement policy must satisfy both 2 CFR 200 standards and any additional requirements in specific grant terms. The compliance officer or grants manager must maintain a cross-referenced compliance matrix that maps every operational policy to every applicable requirement set.

FQHC Compliance Calendar

Managing the annual compliance cycle requires tracking deadlines across multiple programs and portals. The following calendar represents the major recurring obligations for a typical FQHC:

This calendar represents only the major recurring deadlines. State-level grants, SAMHSA programs, and local contracts each add their own reporting cycles. The effective compliance calendar for a health center managing 10+ funding streams may include 50 or more distinct deadlines per year, many of which have different fiscal year boundaries. Building and maintaining a comprehensive deadline tracking system is not optional — it is a core operational requirement for any FQHC managing multi-stream funding.