Why orphan drug errors are showing up again
In February 2025, a Critical Access Hospital in Iowa disclosed that its HRSA audit cited “systemic non-compliance” tied to orphan drug exclusions. The issue wasn’t diversion or duplicate discounts, it was how the CAH’s split-billing software processed National Drug Codes tagged as orphan-designated for any FDA-approved indication. HRSA hasn’t revised the rules since 2014, yet hospitals keep tripping over the same definitions. That’s the part that stings: no new rule, just repeated mistakes.
Under the 340B statute’s section 340B(e), free-standing cancer hospitals, Rural Referral Centers (RRCs), Sole Community Hospitals (SCHs), and Critical Access Hospitals qualify for discounts on orphan drugs only when those drugs are used outside their orphan indication. The intent was to “protect” research incentives but left small rural facilities juggling two sets of obligations. HRSA’s 2014 orphan drug interpretive rule (79 Fed. Reg. 50042) tried to smooth edges by allowing use-based rather than product-based exclusions. Manufacturers sued, lost at the D.C. District Court, then won on appeal in 2015 when the D.C. Circuit struck the rule as beyond HRSA’s policymaking authority. HRSA reissued it as an interpretive rule. It still stands, and it’s the standard auditors apply today.
This history isn’t academic nitpicking. It defines what HRSA enforces in every audit. Covered entities that ignore the use-based distinction, either carving out all orphan drugs or ignoring indication-level tracking, end up non-compliant from both directions. Clear rule, messy implementation.
Inside the 2025 audit playbook
Through 2024, HRSA zeroed in on contract pharmacy documentation. Early 2025 audits shifted focus back to inpatient and mixed-use areas. Auditors from The Bizzell Group now request NDC-level dispense reports for every orphan-designated product given in outpatient and infusion settings. Each letter includes some version of: “Provide documentation demonstrating that prescription of [orphan drug X] was not for the orphan indication.” Simple on paper. Brutal in practice.
That one sentence has undone dozens of CAHs and RRCs. Many rely on EHR indication fields that default to placeholders or vague codes. When HRSA asks for diagnosis-level documentation, records often lack ICD-10 details that distinguish orphan from non-orphan use. If you can’t draw that line, HRSA calls it non-compliant and demands repayment. I’ve seen repayments from $75,000 to more than $400,000 for a single quarter’s oncology drugs. Rural hospitals can’t absorb that kind of loss.
Auditors commonly sample five or more orphan-designated drugs used off-label, infliximab, bevacizumab, everolimus, and romiplostim lead the list. They verify whether each diagnosis matched an FDA-recognized rare disease. HRSA doesn’t require physician attestations, but if your documentation is murky, the default judgment is disallowance. In other words, eligibility is presumed lost unless you can prove it right.
Where compliance really breaks down
The worst failures usually start with configuration, not intent. I worked with a DSH hospital that converted to CAH status midyear. Their wholesaler account carried over orphan-designated NDCs from a prior setup. The split-billing vendor never activated the orphan exclusion rule. Result: every orphan-designated drug flowed through 340B pricing. HRSA spotted it instantly. The hospital repaid $126,000, lesson learned the hard way.
Policy language is another trap. Many hospitals still quote HRSA’s 2013 proposed rule, which never took effect. Some policies still say, “Our facility excludes all orphan drugs from 340B participation.” Auditors flag that as non-compliant, since HRSA’s interpretive rule allows use-based eligibility. RRCs that carved out entirely to “stay safe” discovered HRSA instead reads that as inconsistent policy application, an audit trigger, not a shield.
Then there’s the vendor problem. Some split-billing systems block orphan NDCs automatically; others demand manual tagging. There’s no standard, and HRSA doesn’t bless any approach. Facilities are responsible for showing how their systems prevent orphan-indication use. If your EHR can’t link dispenses to diagnosis codes, track them manually in a spreadsheet keyed to ICD-10 summaries. HRSA accepts that, as long as you can prove it exists.
Adjustments and improvisations in 2025
Rural hospitals are building hybrid carve-out models for clarity. One CAH I advised routes all orphan drugs to WAC unless a specific non-orphan indication overrides it. Ambiguous transactions, gone. Revenue dipped about $38,000 quarterly, but compliance exposure nearly disappeared. HRSA labeled it an “effective control” in the final report. That phrasing doesn’t come often.
Some RRCs choose to exclude orphan drugs from contract pharmacy arrangements entirely. With manufacturer restrictions already limiting access, the administrative effort often outweighs any gain. Others rely on external validation services that match each claim against FDA’s Orphan Designations and Approvals database, updated nightly from the Orphan Drug Designations portal, the same source HRSA auditors reference for confirmation.
One gray area lingers: compounded products containing an orphan component. HRSA hasn’t clarified whether compounding negates the orphan exclusion. Auditors currently treat them as excluded if the base ingredient retains an orphan designation. That issue is likely headed for the Administrative Dispute Resolution Board next year. If someone finally tests it.
Bottom line for 2025, HRSA has circled back to fundamentals: patient definition, eligibility, and orphan-use documentation. The agency knows where hospitals cut corners. Look, if you’re a CAH or RRC, your best compliance tool isn’t software. It’s chart-level precision and up-to-date policy text. Keep the orphan drug list taped where your analyst can’t miss it. Audit yourself before HRSA does. Then get back to running your pharmacy.