340B contract-pharmacy policy and litigation

HRSA's FY24 340B audit results page, updated August 28, 2026, lists repayment to manufacturers as the sanction for three California clinics. Bay Area Community Health (340B ID CH091220) had grant-associated sites missing from or misnamed in 340B OPAIS and inaccurate or incomplete HRSA Medicaid Exclusion File information; its corrective action plan is implemented and the audit closed April 22, 2026. Mathiesen Memorial Health Clinic (FQHC638549) had offsite outpatient facilities missing from OPAIS and contract pharmacies billing Medicaid without notifying HRSA (audit closed January 2, 2026), and SAC Health System (CHC28992-00) was cited for an incorrect OPAIS parent-site address and Medicaid Exclusion File information, with its corrective action status still pending. The table lists no repayment amounts, and HRSA recommends that manufacturers not contact audited entities about sanctions until a corrective action plan is approved and posted.

GovInfo identifies the August 5, 2026 proposal as S. 5244, introduced by Sen. Moran with Sens. Baldwin, Capito, Kaine, Boozman, and Hickenlooper, read twice, and referred to the Senate Committee on Health, Education, Labor, and Pensions. The introduced text proposes contract-pharmacy, patient-definition, clearinghouse, reporting, audit, and other 340B changes. Section 5 would require HHS—only after enactment—to conclude the 340B Rebate Model Pilot within one year, not expand it, discontinue it at one year, and transition to the proposed data clearinghouse. As of the August 29 review, GovInfo lists an introduced bill, not enacted law: the introduction changes no current 340B rule, patient definition, contract-pharmacy duty, or pilot status. Separately, HRSA's revised pilot notice, published August 3 at 91 FR 48883, set an August 24 manufacturer-plan submission deadline and a planned January 1, 2027 effective date for approved plans covering selected drugs. Submission is not approval, and the current HRSA pilot page reviewed does not publish an approved-plan list. Continue to use current law and current HRSA materials unless Congress enacts legislation or HRSA publishes a later agency action. Date trap: this bill reuses the name of the February 2, 2024 SUSTAIN 340B proposal; verify S. 5244, the 2026 sponsor list, and current status before citing it.

HRSA placed Notice 2026-15633 on public inspection July 31; official Federal Register publication is scheduled for August 3, and the pilot's effective date is January 1, 2027. Covered-entity commenters asked HRSA to exclude or phase in some entity types. HRSA declined, reasoning that differences between hospitals and FQHCs do not justify splitting the pilot and that duplicate-discount risk follows selected drugs across every covered-entity type. The notice reports $64.1B in disproportionate-share-hospital purchases (about 79% of total 340B purchases) versus $5.2B for FQHCs and Look-Alikes (about 6%). DEADLINE BOUNDARY: August 24 is the deadline for eligible manufacturers to submit plans, not a public-comment deadline. Approved plans must pay or deny rebates within 10 calendar days after a completed data submission. The 15-day grace period applies only to rebate requests for up to two unreplenished accumulated packages dispensed before the pilot's effective date; it is not a general implementation extension. HRSA predicts limited cash-flow harm while acknowledging cited modeling that financing burdens may be disproportionately larger for small entities. Those are agency positions and modeled estimates, not observed FQHC outcomes. No manufacturer approvals are named. The notice describes commenters generically, so this record does not attribute the exemption request to NACHC.

Arkansas Attorney General Tim Griffin filed suit July 22, 2026 in Polk County Circuit Court against 22 defendants — 13 drug manufacturers and related entities including Pfizer, Bristol Myers Squibb, AstraZeneca, Eli Lilly, Sanofi and Novo Nordisk, plus data-management firm Second Sight Solutions, LLC — alleging violations of Act 1103 of 2021 and the Arkansas Deceptive Trade Practices Act. WHY THIS IS STRUCTURALLY DIFFERENT FROM EVERY OTHER 340B CASE WE TRACK: in Washington, North Dakota, Missouri, West Virginia/Maryland, Vermont and New Mexico, the pattern is a MANUFACTURER SUING A STATE to block a contract-pharmacy law. This is the inverse — a state attorney general enforcing an enacted 340B shield law against manufacturers, in state court, seeking $10,000 per violation with total civil penalties the coverage puts above $1 billion, plus an injunction barring the restrictions. Act 1103 is the strongest possible platform for it: the 8th Circuit upheld the law and the Supreme Court declined to review it. THE ALLEGED MECHANISM IS THE PART FQHC LEADERS SHOULD READ: the state says manufacturers, unable to restrict contract pharmacies directly, pivoted to conditions Act 1103 does not expressly forbid — chiefly REQUIRING COVERED ENTITIES TO HAND OVER CLAIMS OR MEDICAL DATA to receive 340B pricing — and that each manufacturer adopted near-identical restrictions with little variance. That is the same play as the already-tracked Eli Lilly five-day claims-data ultimatum. Community Health Centers of Arkansas CEO Lanita White appeared at the announcement alongside Griffin. HONEST LIMITS: a complaint is an allegation, not a finding; no ruling exists; and the $1B figure is a sought-penalty ceiling, not a recovery. Its value to California is precedential rather than immediate — it tests whether a state 340B shield law is worth anything without an enforcer, which is the open question hanging over AB 1460.

On July 21, 2026 the U.S. Court of Appeals for the D.C. Circuit upheld a lower court and ruled that Section 340B does not permit manufacturers (Novartis and Johnson & Johnson) to unilaterally replace up-front 340B discounts with a post-purchase rebate model unless the HHS Secretary approves it — holding, in effect, that the statute puts the Secretary and not the manufacturers in control of the program. The decision preserves the up-front-discount structure that community health centers and their contract pharmacies depend on, while leaving open whether HHS could authorize a rebate model in the future. It is a defensive win, not a permanent fix: other manufacturer proposals and HHS's own rebate-pilot review remain live.

Eli Lilly's June 1 five-day ultimatum escalated on June 18, 2026, when the manufacturer cut off 340B pricing for covered entities that refused to share in-house pharmacy claims data — Lilly directed wholesaler McKesson to end Tampa General Hospital's discounts after it missed the deadline, per the hospital's complaint. Tampa General sued Lilly on July 2 in the U.S. District Court for the Middle District of Florida, alleging the cutoff raised its average costs for Lilly medications 25-50% — losses the complaint pegs at roughly $24.7 million a year, including a 35.9% jump on Mounjaro. Separately, 72 bipartisan U.S. House members — led by Reps. Doris Matsui (D-CA) and Jack Bergman (R-MI) — signed an early-July letter to HHS Secretary Kennedy and HRSA Administrator Engels urging use of 'any enforcement mechanisms available' against Lilly's move and restoration of 340B pricing. Coverage so far documents hospitals as the entities cut off; no health-center termination has been confirmed, but FQHCs dispensing Lilly products face the same claims-data condition documented in the June 1 ultimatum item and should confirm their data-sharing posture now.

Acting U.S. Attorney General Todd Blanche announced (April 7, 2026) the National Fraud Enforcement Division (NFED) — a stand-alone DOJ litigating division consolidating the Tax Section, Health Care Fraud Unit, and Market/Government/Consumer Fraud Unit under one assistant attorney general. Each U.S. Attorney's office must designate a prosecutor to NFED within 21 days. A new National Fraud Detection Center generates investigative leads from federal financial data — meaning billing anomalies can trigger investigation independent of whistleblower complaints. Combined with FY2025 record $6.8B FCA recoveries (84% from healthcare = $5.7B), 2026 enforcement risk is structurally elevated for FQHCs. PPS billing, incident-to claims, telehealth FQHC distant-site billing, 340B claim integrity, and Anti-Kickback/Stark exposure are all in scope. Strategic action items for CFOs and compliance officers in May–June: (1) refresh PPS encounter documentation review, (2) audit incident-to billing for NP/PA visits, (3) reconfirm 340B contract pharmacy patient-definition compliance, (4) tighten BAA inventory and breach-response runbook (pairs with the OCR ransomware sweep enforcement posture).

On July 1, 2026, the 8th U.S. Circuit Court of Appeals (Novartis Pharmaceuticals Corp. v. Hanaway, No. 25-1619) affirmed the district court's denial of Novartis's preliminary-injunction bid against Missouri's S.B. 751, which requires manufacturers to deliver 340B drugs to all contract pharmacies serving Missouri covered entities. Per the Missouri Hospital Association, the court found Novartis unlikely to prevail on the merits — any extraterritorial effect of the statute was 'negligible and nondiscriminatory toward out-of-state entities' — and rejected Novartis's attempt to revisit its position on federal preemption; the case now returns to the district court for merits proceedings. The Missouri Primary Care Association (the state's FQHC association) intervened alongside MHA to defend the law. The ruling adds another upheld state 340B contract-pharmacy shield to the circuit-by-circuit map FQHC pharmacy directors are tracking, weeks after Washington's law survived a separate challenge in June.

American Hospital Association filed en banc review petition April 17 after 4th Circuit panel blocked West Virginia's S.B. 325 (which forced manufacturers to ship 340B drugs to contract pharmacies). Combined with the 4th Circuit's April 14 vacatur of Maryland's similar law, drugmakers won two consecutive 4th Circuit rulings. AHA argues panel decision conflicts with 5th and 8th Circuit rulings, citing critical importance of preserving state-level 340B protections. Decision window typically 30 days. Outcome shapes whether other 4th Circuit states (NC, SC, VA) can pass 340B contract pharmacy access laws — and indirectly affects circuit-split posture for likely Supreme Court review.

The July 2026 Texas Medicaid Provider Procedures Manual says an FQHC seeking reimbursement for an IUD or implantable contraceptive capsule must submit the family-planning service and device codes on the same claim. The device may be reimbursed in addition to the FQHC encounter payment and is not subject to FQHC limitations; providers must use modifier U8 when the device was purchased through the 340B Drug Pricing Program, while modifier FP is reserved for the annual family-planning examination. This statewide billing instruction does not prove any particular health center's 340B participation, acquisition price, savings, or treatment of other drugs.

Senate HELP Committee Chair Bill Cassidy (R-LA) released a legislative discussion draft of the '340B Drug Pricing Integrity and Affordability for Patients Act' on June 25, 2026 — the most comprehensive federal 340B rewrite vehicle to emerge this cycle. Key provisions per the committee release and STAT coverage: restrictions on hospital 'child sites' (which would need to provide services beyond drug dispensing and be located in shortage areas) and a requirement that hospital covered entities adopt sliding fee scales — a discipline FQHCs already live under by statute. For health centers, the draft lands in a crowded field: the health-center-side '340C' proposal (a voluntary, transparent subset with contract-pharmacy protection and WAC reimbursement for Medicaid drugs) and the already-tracked bipartisan H.R. 7391 340B FQHC Protection Act remain the CHC counter-positions. Strategic read: most of Cassidy's draft targets hospital behavior, not health centers — but any comprehensive 340B rewrite that moves opens the whole program, contract-pharmacy rules included, while the December 31 CHC Fund cliff still has no legislative vehicle of its own. Status: discussion draft (not yet introduced); comment and stakeholder engagement expected over summer 2026.

⚠️ UPDATE (July 30, 2026): OMB/OIRA completed its review of HRSA's rebate pilot proposal in late July after reclassifying it as 'economically significant' (the ≥$100M-impact tier under EO 12866) — the last procedural gate before Federal Register publication, which can now come any day. OMB held 17 stakeholder meetings on the pending notice; HRSA has not yet published the full policy. Original item: Four months after a federal court vacated the first 340B Rebate Model Pilot (AHA v. Kennedy, February 2026), HRSA has taken the first formal step toward Rebate Pilot 2.0: an Information Collection Request for a revised '340B Rebate Model Pilot Program Application, Implementation, and Evaluation' published in the Federal Register June 15, 2026, with public comments due July 15, 2026. A June 22 correction notice revised the estimated responses to include 11 manufacturer Pilot Program Plan submissions — signaling HRSA anticipates MORE manufacturers in the revived pilot than the ~8-9 approved in the vacated first round. Guardrails from the February joint vacatur motion still bind: any new rebate program requires fresh public notice-and-comment and an effective date no earlier than 90 days after manufacturer-application approvals, sliding the earliest realistic go-live toward late 2026 or 2027. Strategic implication for FQHCs: a rebate model converts upfront 340B discounts into after-the-fact rebates — a working-capital hit covered entities (including NACHC) fought in round one. The July 15 comment window is the 13-day action item.

On June 9, 2026 a federal judge denied AbbVie, AstraZeneca, Novartis, and PhRMA's bid to block Washington's SB 5981, letting the nation's 22nd state 340B contract-pharmacy protection law take effect June 10 with penalties up to $5,000/day. The ruling sharpens the cleanest circuit split in health law: the 5th Circuit upheld Louisiana's law (Feb 9) and Mississippi's in two separate cases (Apr 9), Minnesota's state appeals court upheld its law (Feb 17) — while the 4th Circuit blocked West Virginia's as likely federally preempted (Mar 31) and a North Dakota judge struck that state's law in April. Two more wrinkles tilt the field: the Trump DOJ filed amicus briefs in the Colorado and Rhode Island cases (Feb 2026) backing the manufacturers' preemption theory — a first — and Kansas becomes the only state moving backward, its protections expiring June 30 after the renewal bill died. Multiple law firms now expect Supreme Court review. For multi-state FQHC networks, 340B contract-pharmacy security now varies by federal judicial circuit; the NACHC state-law tracker is the canonical map.

Two federal compliance developments worth a calendar note. First, HRSA published its FY2026 340B Manufacturer Audit Results page (updated May 28, 2026) — the companion to the already-tracked FY2025 cycle (49% adverse findings); results are partially finalized, with corrective-action plans and any sanctions to be posted as HRSA approves them, and the agency advises covered entities not to contact audited manufacturers until CAPs post. FQHCs are the largest class of 340B covered entities, so this is a standing reference to monitor in OPAIS. Second, OCR's Risk Analysis Initiative has now completed 19 ransomware investigations with six 2026 settlements, and a June 1 Sidley analysis frames the recent settlements as a direct preview of the forthcoming HIPAA Security Rule amendments (which would make annual risk analyses, documented asset inventories, and demonstrated remediation mandatory rather than 'addressable'). No FQHC has been named, but FTCA-covered health centers are full HIPAA covered entities — meaning a center that hasn't completed a documented Security Risk Analysis is accumulating enforcement exposure ahead of a rule change, not just theoretical risk. (Affordable FQHC SRA tooling like Medcurity, added to our tech stack this cycle, exists precisely for this gap.)

On June 1, Eli Lilly escalated its 340B claims-data fight, warning roughly 50 covered entities that they have five days to submit comprehensive claims data or stop receiving 340B price breaks — the first time the manufacturer has issued outright termination threats rather than reminder letters. The demand follows Lilly's policy announced in January and effective Feb. 1, 2026, which requires claims-level data for all 340B dispenses (including in-house pharmacies, not just contract pharmacies); STAT reports more than 2,300 entities have complied while up to 1,000 larger systems have refused. The first round targets hospital systems, but the policy applies to all covered entities — FQHCs that dispense Lilly products (insulin, oncology, psychiatric drugs) and have not enrolled in the data platform face the same termination risk. With North Dakota's contract-pharmacy law struck down and other state shields in litigation, this is the manufacturer-side pressure on 340B savings that FQHC pharmacy directors must act on now.

Mount Sinai, Michigan Medicine, and the University of Kansas Health System filed federal racketeering (RICO) suits on May 21, 2026 alleging CVS Health/Caremark secretly diverted roughly $250M in 340B program savings between 2020 and 2025 by paying covered entities artificially reduced reimbursement while concealing higher-rate claims. The cases target the contract-pharmacy and PBM machinery FQHCs depend on to convert 340B discounts into patient-care revenue. A win — or even discovery — could set precedent for FQHC 340B clawback claims and reshape contract-pharmacy economics just as manufacturer restrictions and the rebate-model fight already squeeze the program.

HRSA released full FY2025 340B program integrity audit results: 115 covered entities audited, 49% received adverse findings (improving from 64% in FY24 — still nearly 1 in 2). 75% of adverse-finding audits involved incorrect OPAIS records (master-data governance gap); 50% of adverse-finding entities required to repay manufacturers; 21% had site terminations. The 68% re-audit failure rate signals that remediation is sticking poorly. ~90% of FY2025 audits are now risk-targeted (vs. random), elevating exposure for entities with tips, OPAIS anomalies, contract-pharmacy complexity, or prior findings. Strategic implication: CA FQHCs running 340B contract pharmacy programs (often 30-50% of total revenue) face material exposure when OPAIS hygiene lapses. The 'risk-targeted' shift means CFOs can no longer treat HRSA audits as random — prior findings, tips (incl. disgruntled-employee complaints common in the current layoff climate), and contract pharmacy complexity are the trigger profile. 50% repayment rate × typical CA FQHC 340B program ($5-20M/yr) = 7-figure exposure for poorly governed programs. Pairs with already-tracked Lilly/Novo claims-data mandates and 4th Circuit contract pharmacy ruling.

The federal government has appealed the March 3, 2026 district court ruling that struck down HRSA's 340B child site registration requirement. The original ruling let 340B child sites access discounts immediately upon opening — without waiting for Medicare cost report filing and HRSA database registration. That was a significant operational win for FQHCs expanding sites (especially during the H.R. 1 site-multiplication strategy CFOs have been pursuing). An appeal could reverse that win, force FQHCs back to delayed eligibility (potentially 6-18 months of delayed 340B savings on new sites), and disrupt FQHC site-expansion strategies. The government may also seek a stay during appeal — which would effectively pause the favorable ruling while the appellate court considers it. Strategic implication: any FQHC that announced or is mid-flight on new site openings should immediately: (1) document existing 340B savings projections, (2) prepare contingency revenue forecasts assuming delayed eligibility, (3) coordinate with NACHC for amicus support if the appellate timeline accelerates. Pairs with the 4th Circuit contract pharmacy ruling already tracked — 340B litigation is a constant moving target through 2026.