HRSA Announces Updated 340B Rebate Model Pilot Program, Limited To Drugs Subject To A Maximum Fair Price (MFP) For 2026 And 2027

On August 3, 2026, the Health Resources and Services Administration (HRSA) published a notice in the Federal Register (2026 Notice) announcing a new 340B Rebate Model Pilot Program (Pilot Program). The 2026 Notice was announced approximately one year after HRSA issued its 2025 notice for the first 340B rebate model pilot program (2025 Notice), which was subsequently withdrawn following a legal challenge. The Pilot Program is available only for drugs subject to an MFP for initial price applicability years (IPAYs) 2026 and 2027 and requires HRSA approval in order to participate. The 2026 Notice is “effective immediately as published, unless revised by a future notice.”

Manufacturer applications for the Pilot Program must be submitted by August 24, 2026, with approvals by HRSA to be made by September 24, 2026, for a January 1, 2027, effective date. The 2026 Notice follows the request for information (RFI) process that HRSA initiated earlier this year, through which it received 2,475 comments. As a result, HRSA is not seeking additional comment on the 2026 Notice.

The 2026 Notice is available here and HRSA's press release is here. The 2025 Notice is available here and HRSA's press release here. Our alert on the 2025 Notice is available here.

Background

Manufacturers participating in the 340B Drug Pricing Program (340B Program) are required by statute to enter into an agreement with the Secretary of Health and Human Services under which “the amount required to be paid (taking into account any rebate or discount, as provided by the Secretary) to the manufacturer for covered outpatient drugs” does not exceed the 340B ceiling price. While the text of the statute expressly references effectuating 340B pricing through a “rebate or discount,” it does not mandate one option over the other, nor does the Pharmaceutical Pricing Agreement (PPA) that manufacturers execute with the Secretary. However, as a practical matter the program has been historically effectuated via an upfront discount model (other than in the context of certain AIDS Drug Assistance Programs).

In the past few years, several manufacturers engaged with HRSA regarding the implementation of a cash rebate model instead of the upfront discount model for effectuating their 340B pricing obligations. In response, HRSA informed the manufacturers that use of a rebate model requires prior agency approval and that such approval had not been provided. HRSA added that implementation of an unapproved rebate model would result in termination of the manufacturer's PPA and participation in the 340B Program, and, as a result, suspension of federal payments for their covered outpatient drugs under Medicaid and Medicare Part B. Manufacturers brought legal challenges to that HRSA position, and the courts in those cases held that a rebate model is permissible under the 340B statute, but that the statute requires the Secretary to affirmatively approve a rebate model before a manufacturer may implement one.

On July 31, 2025, HRSA published the 2025 Notice and subsequently approved applications from nine manufacturers of drugs subject to an MFP for IPAY 2026 to participate in the pilot program. Covered entity stakeholders sued to challenge the 2025 Notice, and on December 29, 2025, the U.S. District Court for the District of Maine granted a preliminary injunction, finding that HRSA had failed to consider and reasonably explain the rebate model's impact and therefore had not satisfied the requirements of the Administrative Procedure Act. The First Circuit declined to stay that ruling on January 7, 2026, and HRSA subsequently elected to withdraw the 2025 Notice and related pilot altogether. HRSA issued an RFI on February 17, 2026, to gather stakeholder input regarding implementation of a rebate model. HRSA's discussion of the comments received is included in the 2026 Notice.

The 340B rebate model would apply to the effectuation of the MFP under the Medicare Drug Price Negotiation Program (DPNP). By statute, a manufacturer is not required to offer both the MFP and the 340B price on a unit that would otherwise be eligible for both and instead need offer only the lower of the two prices. The Centers for Medicare & Medicaid Services (CMS) has permitted manufacturers to choose between providing the MFP through a discount or a rebate but has declined to assume responsibility for 340B deduplication. The 340B rebate model is intended to serve as a tool for manufacturers to determine the eligibility of a given MFP unit for the 340B price before paying a rebate based on the lower of those two prices, and thereby support effectuation of the MFP-340B nonduplication statutory guarantee.

Which Manufacturers and Drugs Are Eligible for the Pilot Program?

• 2025 Notice: HRSA limited the pilot to manufacturers with DPNP agreements with CMS in place for IPAY 2026 (i.e., the first year that a negotiated MFP was implemented), and further limited it to the 11-digit National Drug Codes (NDC-11s) that appeared on the published selected drug list subject to an MFP for that year. All utilization for the listed NDC-11s would have been eligible for the pilot regardless of payer.
• 2026 Notice: HRSA maintains the Pilot Program's limitation to selected drugs with DPNP agreements in place, but expands eligibility to manufacturers with active selected drugs for both IPAY 2026 and 2027. The Pilot Program remains limited to the specific NDC-11s of the selected drugs that appear on the CMS published selected drug list. All utilization of the listed NDC-11s is eligible regardless of payer or indication.

What Are the Application Requirements?

• 2025 Notice: Participation in the pilot was voluntary for manufacturers. Eligible manufacturers that wished to participate had to submit a rebate model plan to HRSA by September 15, 2025. Plan submissions were limited to 1,000 words and had to address the criteria outlined in the 2025 Notice. HRSA indicated it would notify manufacturers of approval to participate by October 15, 2025, with approved rebate model plans to have taken effect January 1, 2026, for a minimum one-year period.
• 2026 Notice: HRSA maintains that manufacturer participation in the Pilot Program is voluntary and requires HRSA/Office of Pharmacy Affairs (OPA) approval of a manufacturer's plan for a minimum one-year period. Eligible manufacturers must submit plans to 340BPricing@hrsa.gov by August 24, 2026, with approvals, if any, by September 24, 2026, for a January 1, 2027, effective date. While there is no word limit, submitted plans “should succinctly describe how they meet all the criteria,” and plans that “exceed or go beyond these criteria must include detailed justification and will be subject to additional levels of review by HRSA/OPA prior to approval.”

What Are the Data and Reporting Requirements?

• 2025 Notice: Manufacturers could request only the following pharmacy claim fields from covered entities under their rebate plans: date of service, date prescribed, Rx number, fill number, 11-digit NDCs, quantity dispensed, prescriber ID, service provider ID, 340B ID, Rx bank identification number (BIN), and Rx processor control number (PCN). These data elements largely aligned with the data fields used to effectuate the MFP under the DPNP for IPAY 2026, with certain exceptions (e.g., the BIN and PCN numbers are not required on the DPNP side and the DPNP requires a few additional data fields). Covered entities were allowed up to 45 calendar days from the date of dispense to submit their data, “with allowances for extenuating circumstances and other exceptions, including adjustments when a 340B status change occurs on a claim.”

Manufacturers had to agree to provide the HRSA OPA with periodic reports that “detail[ed] data on purchases provided through rebates, information related to claim delays and denials, and other information that may evaluate the effectiveness of the rebate model.”

• 2026 Notice: HRSA maintains the same pharmacy claim fields, the 45-day submission window, including allowances for extenuating circumstances, and the requirement that manufacturers provide periodic reports to OPA, but adds a set of medical claim fields, several new plan requirements, and a broad restriction on how manufacturers and vendors may use Pilot Program data. In addition to the pharmacy claim fields above, manufacturers may request the following medical claim fields from covered entities under their rebate model plans: date of service, claim line number, claim number, unit of measure, NDC-11s, quantity, rendering physician ID, service provider ID, 340B ID, health plan name, health plan ID, and health plan ID qualifier (if available).

HRSA also requires that manufacturers: submit data definitions for each claim field with their plan for HRSA's approval; not request purchasing or encounter data at this time; allow the BIN, PCN, and health plan fields to be marked “CASH” for uninsured or cash-paying patients; permit covered entities to resubmit data if a rebate request is “deemed incomplete or missing data”; and include in their plan “instructions for providing data regarding wasted or undispensed units.” HRSA further states that covered entity data received as part of the Pilot “should not be used for any purpose other than those explicitly identified in this Pilot,” and this limitation “extends to any collecting, aggregating, sharing, or licensing of Pilot data by manufacturers or technology platforms.”

How Will Rebates Be Paid?

• 2025 Notice: Manufacturers had to ensure that 340B rebates were paid, or denied with documentation in support of the denial, to covered entities within 10 calendar days following the data submission. In contrast, under CMS guidance regarding effectuation of the MFP for IPAY 2028, manufacturers have 14 calendar days following receipt of data validating eligibility of the MFP to deduplicate 340B and MFP units and effectuate payment. The 2025 Notice stated explicitly that a rebate claim could not be denied due to compliance concerns with diversion or Medicaid duplicate discounts. Diversion and Medicaid duplicate discount concerns had to instead be raised directly with HRSA/OPA or addressed through 340B statutory mechanisms, such as audits and the Administrative Dispute Resolution (ADR) process. Manufacturers had to specify in their plans whether rebates will be paid at the package or unit level.
• 2026 Notice: HRSA maintains the 10-day timeline for manufacturers to pay rebates and its requirement that diversion and Medicaid duplicate discounts be addressed through HRSA but provides several additional requirements and minor changes from the 2025 Notice. Manufacturers are required to specify in their plans that rebates are paid at the unit (not package) level and “include the rebate calculation equal to the wholesale acquisition cost (WAC) less the 340B ceiling price on the day of dispense.” Further, during the implementation phase, covered entities may submit rebate requests within a 15-calendar day grace period for up to 2 unreplenished accumulated packages prior to the Pilot Program's effective date. For example, “a covered entity may request a rebate for up to 2 packages of a product dispensed from its neutral inventory on December 16, even though the effective date for the product's participation in the pilot is January 1.” If a covered entity's claims submission is returned by the manufacturer for incomplete data, “the 10-day clock for rebate payment will restart when all necessary data is submitted.”

Disputes

• 2025 Notice: HRSA did not address a separate dispute resolution process under the Pilot Program for covered entities to challenge denied claims.
• 2026 Notice: HRSA establishes mechanisms for monitoring denied claims and creates a defined pathway for covered entities to dispute denied claims.
  • Manufacturers will be required “to document and report denied claims, including the basis for each denial and the status of any associated dispute,” so HRSA may monitor denial patterns and remove manufacturers from the Pilot Program for non-compliance (e.g., for denying rebate payment without acceptable justification).
    • HRSA notes that, “[i]f, for example, covered entities report that a manufacturer is consistently denying rebate payment without acceptable justification, then HRSA could review a sample of allegedly affected transactions over a sufficient period of time (e.g., 10 calendar days) and, if HRSA were to find that a significant portion of those transactions (e.g., 5 or more percent) were denied without acceptable justification, HRSA could initiate removal proceedings of that manufacturer from pilot participation for non-compliance.”
  • Additionally, covered entities may challenge denied claims through a defined pathway that HRSA will provide more information on, including specified timeframes for review and response of challenges, within 30 calendar days of the Pilot Program's effective date.
  • Covered entities may also pursue available remedies through the 340B ADR process if disputes cannot be resolved through the Pilot Program's dispute process.

Notice, Technology, and Other Requirements

• 2025 Notice: A manufacturer's rebate plan had to provide 60 calendar days' notice to covered entities and other impacted stakeholders before the rebate model is implemented and “allow covered entities to order the selected drugs under existing distribution mechanisms (e.g., 340B wholesaler accounts with pre-rebate prices loaded) to ensure purchases flow through existing infrastructure.”

Plans had to utilize an Information Technology (IT) platform with the capacity to receive and filter data to identify eligible units and provide real-time reconciliation reports to inform covered entities of the rebate status of submitted claims. The costs of maintaining the IT platform had to be borne entirely by the manufacturer, and no administrative or other costs could be passed on to covered entities.

The IT platform had to include mechanisms to ensure patient identifying information and rebate data are secure and protected. Further, the platform had to limit data collection to the necessary elements for providing 340B rebates (readily reported data listed above).

• 2026 Notice: HRSA increases the notice requirement from 60 to 90 calendar days, maintains the IT platform requirements, and creates the following additional requirements for a manufacturer's rebate plan:
  • “Changes to approved plans must be submitted to OPA for review and approval prior to implementation[.] . . . OPA will determine if the changes can take effect immediately or if they require a notification period to covered entities.”
  • A plan “must describe whether an exception that would not apply broadly to all covered entities, and if any, will be communicated to both HRSA and affected covered entities (e.g., covered entities without access to a third-party administrator or rural hospitals or health centers).”
  • A plan “must ensure that a quarterly 340B price file for each of the manufacturer's 11-digit NDCs is made available to covered entities, so that covered entities may use the price file in conjunction with pharmacy billing systems to appropriately account for actual acquisition cost (i.e., post rebate price) for Medicaid billing and also to assist with sliding fee scales or cost sharing with patients.”

Data Privacy Considerations and HIPAA Compliance

• 2025 Notice: HRSA did not specifically discuss data privacy beyond establishing a general requirement that plans ensure the IT platform maintain patient identifying information in a manner consistent with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and any other applicable privacy and data security laws.
• 2026 Notice: HRSA states that data transferred from a covered entity to a manufacturer's platform, to the extent not individually identifiable health information, is not protected health information (PHI) under HIPAA and therefore not subject to the restrictions on use and disclosure under HIPAA regulations.
  • HRSA explains that the data elements required under the Pilot Program do not include direct patient identifiers that would directly identify patients.
  • Responding to stakeholder concerns regarding de-identification, HRSA references the 340B ESP claims data platform, explaining that: “As described in publicly available documentation for existing 340B claims data platforms, de-identification occurs through automated processes prior to data ingestion by the platform, such that neither the manufacturer nor its vendor receives or retains PHI.[] Where such automated de-identification is validated through an expert determination under 45 CFR 164.514(b)(1), the resulting data does not constitute PHI regardless of whether the underlying source data, prior to automated processing, included identifiable elements.” HRSA adds that “[i]f a HIPAA covered health care provider is relying on the platform to de-identify PHI, the platform would be acting as a HIPAA business associate of the provider and would be required to have a valid business associate agreement in place.” Additionally, “HRSA does not anticipate that compliance with the Pilot's data submission requirements will require covered entities to violate HIPAA or any other applicable federal data privacy law.”
  • And, even where the data submitted by covered entities under the Pilot is PHI, HRSA explains that “the HIPAA Privacy Rule generally permits covered entities to disclose PHI without individual authorization for purposes of payment” and “a covered entity's submission of claims-level data to a manufacturer [for rebate purposes] relates to . . . the payment activity of the covered entity.”

Pilot Evaluation and Transparency

• 2025 Notice: Assessment of the pilot would “include OPA's evaluation of data and reports received from the participating manufacturers on the effectiveness of the model and covered entity and other stakeholder feedback.” This assessment was to inform OPA's consideration of whether to expand the rebate pilot to other 340B drugs.
• 2026 Notice: HRSA will evaluate the Pilot using a combination of quantitative and qualitative measures and will publish interim periodic summaries of implementation findings on its website. HRSA “may use data gleaned from the Pilot during reviews of routine 340B Program audits of both covered entities and manufacturers.”
  • “Quantitative measures will include data submitted by participating manufacturers and covered entities regarding rebate requests, rebate payments, payment timeliness, claim denials, dispute resolution outcomes, reporting burden, and other operational metrics. HRSA will also review information relating to administrative burden, duplicate discount prevention, data quality, and program integrity[.]”
  • “Qualitative information will be collected through stakeholder engagement activities, including written feedback, listening sessions, technical assistance interactions, and other implementation-related communications.”
  • Upon conclusion of the first year of Pilot operations, HRSA will publish an evaluation by April 30, 2028.
  • “To the extent practicable and consistent with applicable law, HRSA will ensure that any public and aggregated information regarding Pilot performance will not contain confidential, proprietary, or individually identifiable information.”

340B Program Integrity and Covered Entity Stakeholder Concerns

HRSA frames the Pilot Program as a response to program integrity concerns that have grown alongside the 340B Program itself, which now includes 15,249 covered entities, over 49,000 associated sites, and $100 billion in 2025 purchases. HRSA points to the difficulty of preventing duplicate discounts, citing a 2019 manufacturer estimate of up to $1.5 billion annually in Medicaid/340B duplicate discounts and industry estimates that duplicate discounts could affect up to approximately 25% of 340B transactions, along with continuing diversion risk, as reasons supporting the need for the Pilot Program. HRSA also notes that “[r]etrospective enforcement mechanisms are inherently reactive and identify potential duplicate discounts only after they occur,” while “a rebate-based model may improve prospective identification and validation of transactions by linking price concessions to standardized claims-level data submitted as part of the rebate process.” HRSA states that it considered and rejected several alternatives proposed by covered entities, including enhanced use of claims modifiers and a centralized clearinghouse. HRSA concluded that these alternatives would not achieve the program integrity and evaluation objectives that HRSA designed the Pilot Program to address.

In response to the RFI, covered entities and provider organizations raised concerns about the burden of shifting to a rebate model, including administrative costs, staffing needs, and cash-flow impacts. Responding to these comments, HRSA disputes the scope of the projected burden, finding that “many projections of administrative burden rest on assumptions that do not align with the design of the Pilot or [] do not accurately reflect what is needed administratively to implement a rebate approach.” HRSA's estimate of the total annual administrative costs is $523,345,680 across all reporting covered entities, or approximately $34,320 per entity. HRSA also emphasizes that the drugs eligible for the Pilot Program represent less than 5.5% of total 340B sales, with the remaining 94.5% continuing under the upfront discount model. HRSA explains that it included specific mitigating design features into the Pilot Program to minimize cash-flow disruption, including the 10-calendar day rebate payment requirement, unit-level processing, and a 15-calendar day transition grace period for unreplenished accumulations. HRSA also responds to covered entity concerns regarding a reliance interest in maintaining upfront discounts, noting that it “does not agree that exclusive reliance on an upfront discount model is reasonable or that such reliance foreclose[s] consideration of alternative statutory mechanisms.”

*           *           *

We recommend that you carefully review the 2026 Notice to identify all issues relevant to your organization.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.