Key Takeaways

• HRSA’s 340B rebate pilot shifts financial and operational burden to covered entities, requiring upfront drug purchases with delayed, uncertain rebate recovery.
• Manufacturers can opt in, but covered entities cannot opt out, and face complex compliance obligations with limited recourse for withheld rebates.
• The pilot raises serious legal, regulatory and privacy concerns, including APA challenges and HIPAA risks tied to manufacturer-selected IT platforms.
• Comments are due by September 2, 2025, covered entities should evaluate legal options and consider targeted advocacy before the program launches January 1, 2026.

HRSA published an announcement outlining a rebate pilot program (the rebate program) that would change how the 340B program has been operating since its inception. The rebate program would require covered entities, including hospitals and clinics, to front the costs of high-cost drugs in exchange for a theoretical post-purchase rebate, rather than being afforded the discounted 340B pricing at the time of purchase. The program would initially run as a pilot and would only be applicable to 10 drugs (regardless of payer) that were selected under the Medicare Drug Price Negotiation Program (MDPNP), a program designed to help lower the costs of drugs. The rebate program is “voluntary” in that manufacturers can opt in to participate by submitting plans for consideration and approval according to HRSA criteria by September 15, 2025 with a go live of January 1, 2026.

The rebate program raises a slew of concerns for covered entities, including operational, compliance, financial and privacy concerns. It’s very possible that HRSA’s rebate pilot program will have a long lasting impact on the 340B program, but the announcement is extremely short given potential long-term consequences. HRSA’s rebate pilot announcement outlines how manufacturers must submit plans to opt into the rebate program, but it provides no opportunity for covered entities to opt out, though they will be primarily impacted by the announcement. The announcement includes a request for comments, but HRSA makes it clear that OPA is not obligated to respond to or act on the comments. Thus, covered entities may not be able to influence or receive clarity on the proposed model.  

It is likely that the announced rebate program will be subject to legal challenges. As an initial matter, a legal question remains whether HRSA’s rebate pilot announcement could carry the force and effect of law such that HRSA is required to strictly adhere to the notice and comment requirements of the Administrative Procedure Act. In addition, arguments can likely be made that the proposed program is contrary to statute and Congressional purpose in enacting the 340B program. Given the significant impact of the proposed program, covered entities should carefully evaluate their legal options in order to preserve the value and purpose of the 340B program.

Under the rebate program, manufacturers cannot deny rebates based on concerns of duplicate discounts or diversion, and the announcement states that manufacturers should use other statutory avenues to address these concerns, such as audits or administrative dispute resolution (ADR). However, there are no clear and immediate penalties for manufacturers who withhold rebates, and there is no recourse for covered entities (CEs) except ADR, which means covered entities could be waiting months to years without seeing the rebate if the manufacturer withholds it. HRSA’s current ADR process simply is not designed to handle the sheer volume of claims that are potentially at issue, particularly if manufacturers opt to use a dispense-level (versus package level) rebate process. Incorrectly denied rebates could accumulate quickly.

We strongly encourage providers to submit comments to HRSA in response to this pivotal change in the 340B Program. Once enacted, the rebate model could become the new status quo and apply to other drugs in the 340B Program. As evidenced by manufacturer contract pharmacy restrictions, being complicit could be detrimental to the intent of the 340B program. Comments are due by September 2, 2025. In addition, covered entities should consider targeted lobbying efforts directed at HHS, others within the Trump Administration, and advocates within Congress in order to influence the direction of the proposed program.

Covered Entities’ Role in the Pilot Program

CEs must use the manufacturer-selected IT platform to submit pharmacy claims data within 45 days of dispensing in order to receive rebates from the manufacturers. HRSA outlines the data required for rebates in the announcement, but manufacturers are permitted to go beyond the criteria in their plan proposals, which means manufacturers could choose to request additional data (if their proposal is accepted by HRSA).

Minimum Required Data Elements:

1. Date of Service
2. Date Prescribed
3. Prescription Number (Rx #)
4. Fill Number
5. 11-digit National Drug Code (NDC)
6. Quantity Dispensed
7. Prescriber ID
8. Service Provider ID (pharmacy)
9. Covered Entity 340B ID
10. Rx Bank Identification Number (BIN)
11. Rx Processor Control Number (PCN)

Risk Considerations for Covered Entities

1. Manufacturers’ Unilateral Ability to Withhold Rebates

HRSA has not proposed adequate processes to prevent manufacturers from withholding rebates. CEs are at risk of serious financial losses for rebates that they are statutorily entitled to for these drugs. Without a mechanism to prevent or penalize manufacturers for denying rebates for any reason, including concerns of duplicate discounts, diversion, or contract pharmacy utilization, CEs will have few options to argue for their rightful reimbursements. Covered entities must advocate for a more robust dispute resolution process.

2. Operational Disruption

The rebate program will force covered entities to rethink their pharmacy operations, including purchasing, stocking and data collection processes. CEs will have to redo policies and procedures to account for the rebate program and work on updating documentation for rebates, ADR and audits. This model will add substantial administrative cost to  CE’s 340B program as it will take personnel time to build reports, routinely manage data submissions and track and dispute rebate denials. HRSA should consider whether there is an appropriate way to require manufacturers to reimburse covered entities for these costs if they participate in the rebate pilot and future rebate models.

Since CEs will be paying the high-cost drug prices up front, they will need to account for this from a financial perspective. The announcement does not require manufacturers to issue rebates within a certain timeframe, so CEs will not have immediate 340B savings for these drugs right away and will have to do budgeting with this major uncertainty. This will impact on how the CEs plan to use the 340B savings for patient care.

Lastly, since the rebates are for drugs regardless of payor, the rebate program may impact payor billing and reimbursement, particularly Medicaid. Unless states change their billing requirements, which is unlikely to happen quickly, CEs could lose out on reimbursement from Medicaid agencies. HRSA does not address Medicaid billing impacts or how this rebate program will interact with state statutes and regulations. CEs will need to analyze state Medicaid regulations to determine how best to bill for these drugs and coordinate with the state agencies to avoid duplicate discounts or no discount at all.

3. Third Party IT Software Risks

HRSA’s announcement permits manufacturers to choose which IT platform it uses to collect the data for the rebates but does not address any security or privacy risks that CEs will face. Currently, IT software that manufacturers are imposing on CEs have terms and conditions that conflict with HIPAA requirements and require the CEs to endure all liability. Some of the data elements being requested are considered PHI (e.g., RX number and date of service), so CEs need to analyze the risks associated with using these software systems before submitting data. HRSA should clearly state why these exercises are HIPAA compliant, what HIPAA authorization applies to the data submission, and require manufacturers and their IT platform vendors to hold covered entities harmless for data breaches and other data-related issues since this program is not voluntary for covered entities.

Drug manufacturers are making a choice to convert a longstanding discount program into a rebate program. HRSA should consider that fact very carefully and issue more balanced rules around the 340B rebate pilot so liability for errors largely shifts to the manufacturers.

CEs and related stakeholders must remember that dispute resolution options are extremely limited in the 340B space. As a reminder, there is no private right of action for 340B program violations including overcharges (soon to be denied rebates) by manufacturers. Given these limited rights, a proactive approach is critical.