HRSA’s warnings aren’t scaring manufacturers anymore
By early 2025, every covered entity has a story about a blocked claim. A hospital in Illinois sends 340B claims to an independent pharmacy near its rural clinic, and half its orders bounce with “duplicate discount suspect” messages from Eli Lilly. HRSA’s old warning letters don’t change a thing. After the Third Circuit sided with Sanofi and Novo Nordisk in late 2023, manufacturers know HRSA’s hands are largely tied. The courts said the 340B statute doesn’t explicitly require drugmakers to deliver to an unlimited number of contract pharmacies, and HRSA can’t enforce its 2010 contract pharmacy policy as if it were law.
That ruling didn’t dismantle the program, but it shifted the balance. Before those decisions, entities leaned on HRSA’s threat of “cease and desist” letters and the ADR process launched in 2022. Now the message is crystal clear: if a manufacturer enforces a contract pharmacy limit, HRSA will ask them to reconsider , not compel them. Covered entities must live within whatever submission limits each manufacturer enforces through 340B ESP or other claim upload platforms. The enforcement wall has cracks, and everyone knows where they are.
How manufacturer limits actually play out
As of January 2025, roughly twenty large manufacturers maintain restrictions. Lilly still allows only one contract pharmacy per covered entity site. AstraZeneca continues approving one pharmacy for grantees and one for hospitals within forty miles. Novartis and Gilead require claim-level data for every order and deny replenishment without it. Pfizer’s model gives slightly more room, but only if entities upload 340B ESP data for each claim and keep an administrative contact ready to answer audits within ten days. HRSA has stated publicly that while it “disagrees with these restrictions,” it no longer has authority to penalize manufacturers after the appellate rulings.
Covered entities once depended on sprawling pharmacy networks. Now they’re forced to decide which partners truly matter. A DSH hospital system that once worked with 35 pharmacies now operates with five. Less to manage, yes, but also less savings. One Midwest system lost $5.2 million annually when restrictions began. For grantees , FQHCs, Ryan White clinics, and the rest , those shortfalls aren’t abstract numbers. They’re staff positions, extended hours, outreach programs. Gone.
Compliance strategies that actually work in 2025
The biggest mistake I still see? Trying to trick the system , tweaking addresses, claiming pharmacy ownership changes, backdating ship-to/bill-to details. HRSA auditors find it instantly. If your 340B database lists multiple pharmacies outside a manufacturer’s limit, that’s a finding under 42 U.S.C. §256b(a)(1). HRSA won’t fault you for following a restriction, but they will for false filings. And if your compliance team jokes about “ghost contracts,” stop right there. That’s not creative. It’s grounds for losing eligibility.
The move now is straightforward: data-driven pharmacy selection. Rank pharmacies by 340B capture potential, total prescription volume, payer mix, and distance from eligible encounters. Drop sites where 340B claims account for less than two percent of total fills , pure risk with little upside. Then match what’s left against manufacturer distance rules and limits. Submit IDs for those one or two chosen pharmacies through 340B ESP each quarter when claim windows open. Keep confirmation receipts for five years. HRSA’s Office of Pharmacy Affairs can , and does , ask for them at recertification.
Hospitals with in-house outpatient pharmacies have some breathing room. They can shift contract volume back to those internal sites and still claim 340B pricing without triggering manufacturer dispute. HRSA’s 2013 patient definition guidance allows it. For health centers without in-house dispensing, shared service models are gaining ground , multiple grantees contracting the same pharmacy, with clean separation of records and inventory. HRSA hasn’t endorsed that model outright, but so far, it has tolerated it where the tracking is airtight.
Accountability has become its own metric. HRSA auditors now ask for proof that entities are aware of and following manufacturer restrictions, even though HRSA can’t enforce those limits itself. In one 2024 audit, a Texas FQHC got a corrective action plan just for listing seven contract pharmacies with a manufacturer that allowed one. The finding? “Failure to maintain current and accurate 340B database records.” That’s an avoidable hit. Quarterly verification of your pharmacy list fixes it , no drama required.
What HRSA still hasn’t clarified
There’s ongoing confusion about whether entities can use contract pharmacies beyond manufacturer-allowed numbers for drugs from unrestricted manufacturers. HRSA hasn’t said they can’t, and there’s no guidance requiring one uniform pharmacy list. So, in theory, you can keep all twelve pharmacies active for unrestricted drugs. In practice, inventory chaos follows. Claims routing grows complicated fast. Software vendors haven’t caught up, and ESP segmentation by manufacturer remains clumsy.
As for the ADR process HRSA launched in 2022, it hasn’t delivered much. Only a handful of accepted petitions exist, many sitting idle for eighteen months or more. None have resulted in binding orders or refunds. The 2024 GAO report confirmed what everyone suspected: the ADR panel can’t enforce compliance after the appellate rulings. Until Congress adjusts §256b to define access rights, standstill continues.
So where does this leave compliance teams?
Focus on clarity, not confrontation. Keep your SOPs aligned with manufacturer policies. Track every claim denial and reason code. When multiple pharmacies see the same NDC rejections, figure out whether the cause is a manufacturer-imposed limit or a TPA routing error. HRSA now expects that level of awareness in audits. Saying “we didn’t know” won’t cut it.
And honestly , the 340B statute is static, HRSA guidance is contested, enforcement is unpredictable. Don’t wait for Washington to settle it. Run the program you can defend under audit, not the program you wish still existed in 2019. Look, if you keep waiting for the perfect directive, you’ll miss your next compliance cycle. Better to move, document, and keep the receipts.