340B Contract Pharmacy Restrictions: What Manufacturers and Vendors Need to Know in 2026

TL;DR

Thesis

340B is no longer a narrow safety-net pricing program that can be handled downstream by trade or chargeback teams. It is now a strategic channel-design problem because specialty-heavy covered-entity volume, contract-pharmacy expansion, manufacturer restriction policies, state nondiscrimination laws, and MFP/non-duplication mechanics all intersect at the same patient, claim, and dispensing node. The launch-team question is therefore not simply “restrict or do not restrict contract pharmacy.” It is how to design a policy that preserves access, withstands state-law variation, captures claims-level data, and does not break hub, specialty-pharmacy, or affordability workflows already needed for the brand (HRSA Office of Pharmacy Affairs update; Drug Channels 340B contract-pharmacy market analysis; ASHP Third Circuit coverage).

The practical buyer thesis is that 340B capability should be diligence-scored across the entire access stack. Specialty pharmacy partners need to distinguish in-house health-system dispensing from contract pharmacy volume. Hub vendors need state-aware routing, BV flags, and patient messaging that do not contradict the manufacturer’s 340B policy. Data vendors need duplicate-discount and channel-reconciliation logic that can support 340B ESP-style claims submission and any future HRSA/CMS rebate architecture. Manufacturers that treat those decisions as separate vendor workstreams will under-spec the handoffs where the economic leakage actually occurs.

Implications

• Manufacturer policy needs to be product-specific. Hospital-heavy oncology, rare disease, buy-and-bill, and oral specialty products have materially different 340B exposure; a broad corporate restriction posture should still be translated into product-level rules, state carve-outs, and claims-data requirements.
• Hub RFPs should test 340B operations explicitly. Require vendors to show how enrollment, BV, PA, copay, pharmacy routing, and FRM escalation handle in-house covered-entity pharmacies, contract pharmacies, state protection laws, and claims-data submission.
• Specialty pharmacy network design should include a 340B lane. PBM-owned, independent, and health-system pharmacies create different 340B visibility and conflict profiles; limited distribution design should not assume one set of data rights works across all pharmacy types.
• Data infrastructure is becoming the control point. 340B ESP, Kalderos, IntegriChain, chargeback systems, and hub/SP status feeds should be evaluated as a single reconciliation architecture, not as isolated vendor modules.
• The 2026-2027 watchlist is operational, not just legal. A revived rebate model, circuit split resolution, state-law expansion, or CMS claims repository change can force mid-year workflow changes; contracts should include change-order language, reporting SLAs, and state-policy update obligations.

340B program in brief

Section 340B of the Public Health Service Act, enacted in 1992, requires manufacturers participating in Medicaid to sell outpatient drugs to designated “covered entities” at ceiling prices. It is a statutory discount, not a rebate; the discount is baked into the acquisition price and the entity collects full commercial or Medicare reimbursement when it dispenses.

Eligible entities

Category	Examples	Share of 2023 purchases
Hospital types (six)	Disproportionate share hospitals (DSH), critical access hospitals (CAH), sole community hospitals, rural referral centers, children’s hospitals, freestanding cancer hospitals	~87%
Federal grantees	Federally qualified health centers (FQHCs), Ryan White HIV/AIDS clinics, STD/TB clinics, hemophilia treatment centers	~13%

DSH hospitals alone account for approximately 80% of total 340B purchases. The skew toward large hospital systems is the backdrop against which manufacturer restrictions should be read: the restrictions disproportionately affect hospital-channel volume, not community health center access.

Ceiling price mechanics

The 340B ceiling price is set quarterly as Average Manufacturer Price (AMP) minus the Medicaid Unit Rebate Amount (URA). URA equals the greater of 23.1% of AMP (for most brand drugs) or AMP minus “best price,” plus an inflation penalty if AMP has risen faster than CPI-U. For drugs with heavy Medicaid rebate obligations, the 340B price can approach zero; for most specialty brands, it runs 25%-50% below WAC.

Contract pharmacy guidance: the 2010 inflection

• 1996 HRSA guidance: covered entities without an on-site pharmacy could use a single off-site contract pharmacy; those with an on-site pharmacy could use none.
• March 2010 HRSA guidance: removed the one-pharmacy cap; covered entities could use unlimited off-site contract pharmacies.
• Post-2020 manufacturer pushback: unilateral restrictions begin with Eli Lilly’s July 2020 notice limiting 340B pricing at contract pharmacies for certain products.

The 2010 decision was the forcing function. Contract pharmacy locations grew from fewer than 1,300 in 2010 to more than 32,000 by 2025; relationships grew from ~2,000 to 229,531. Nearly 60% of U.S. pharmacy locations now function as 340B contract pharmacies, and five for-profit chains (CVS, Walgreens, Walmart, Express Scripts, Optum Rx) hold 76.1% of those relationships.

Program size

Metric	2023	2024
340B discounted purchases	$66.3B	$81.4B (+22.8%)
WAC list value equivalent	~$124B	~$147.8B
Gross-to-net spread (list minus 340B)	~$57B	$66.4B
Share of total U.S. gross-to-net bubble	~17%	~19%
Specialty share of 340B purchases (units)	n/a	~40%
Specialty share of 340B purchases (dollars)	n/a	~61.5% ($50.1B)

Sources: HRSA Office of Pharmacy Affairs; Drug Channels Institute (December 2025). The 340B CAGR from 2015 to 2024 was approximately 23.5%, roughly five times the 5.1% CAGR for overall manufacturer net drug sales over the same period.

Manufacturer contract pharmacy restrictions

Timeline: the 2020 break

• July 2020: Eli Lilly announces the first restriction, starting with Cialis and extending to more drugs.
• August-November 2020: AstraZeneca, Sanofi, Novartis, Merck, and Novo Nordisk follow.
• 2021-2023: AbbVie, BMS, Boehringer Ingelheim, Amgen (select), and Pfizer join. Pfizer recognizes up to two contract pharmacy locations per hospital without an in-house pharmacy for specific products, conditioned on 340B ESP data.
• 2024-2025: GSK, Johnson & Johnson, Bayer, Sandoz, and United Therapeutics expand restrictions.
• February 2026: Eli Lilly extends its claims-level data (CLD) requirement to in-house pharmacy dispenses, effective February 1, 2026.
• March 2026: Pfizer issues new attestation and claims-data requirements effective March 31, 2026, including validation that the entity has no wholly owned pharmacy.

By NACHC and Drug Channels Institute tallies, more than 40 manufacturers now have active 340B policies, including Lilly, J&J, Novartis, Sanofi, AstraZeneca, Pfizer, Merck, AbbVie, BMS, GSK, Novo Nordisk, Boehringer Ingelheim, Bayer, Amgen, United Therapeutics, Sandoz, and numerous specialty biotechs. IQVIA’s 2025 white paper found the policies did not meaningfully reduce patient access at contract pharmacies, though growth slowed in 2025 versus 2024.

Common restriction patterns

Pattern	Representative manufacturers
One contract pharmacy per CE without in-house pharmacy	Novartis, Merck, AstraZeneca (historical)
Claims data for unlimited access (via 340B ESP)	Sanofi, Boehringer Ingelheim, Novo Nordisk, Pfizer, Lilly
Two contract pharmacies with product carve-outs	Pfizer (oral oncology)
In-house pharmacy claims requirement	Lilly (effective Feb 2026)
State carve-outs for protection states	Lilly (AR, LA, MD, MN, MS, MO, KS); GSK (NM, OK, RI)

340B ESP (Second Sight Solutions) is the de facto industry standard for claims data collection. Covered entities that refuse to submit lose 340B pricing at affected pharmacies.

Litigation: two circuits uphold restrictions

Third Circuit, January 30, 2023, Sanofi-Aventis U.S. LLC v. HHS: the court held that Section 340B does not require manufacturers to ship to unlimited contract pharmacies, and HRSA’s May 2021 violation letters against Sanofi, Novo Nordisk, and AstraZeneca were unlawful. HRSA subsequently withdrew the letters.

D.C. Circuit, May 2024, Novartis Pharmaceuticals Corp. v. Johnson and United Therapeutics Corp. v. Johnson: the D.C. Circuit affirmed that Section 340B does not prohibit manufacturers from limiting distribution through contract. Novartis caps hospital covered entities at one contract pharmacy; United Therapeutics refuses to deliver to contract pharmacies registered after November 2020 and requires 340B ESP claims data.

The Seventh Circuit has a pending case involving Eli Lilly. A split could tee up Supreme Court review, but with two appellate courts already siding with manufacturers, the industry treats restrictions as the default legal baseline. The remaining fights are over state laws, the rebate model, and claims-data governance.

State responses

Eight states have enacted contract pharmacy nondiscrimination laws, typically prohibiting manufacturers from limiting or imposing conditions on contract pharmacy access for entities located in-state.

State	Law	Status (April 2026)
Arkansas	Act 1103 (May 2021)	Upheld by Eighth Circuit March 12, 2024; Supreme Court denied cert December 9, 2024; AstraZeneca enforcement action pending since October 2024
Louisiana	Act 358 (2023)	Enacted; manufacturer challenges in federal court
Mississippi	HB 728 (2024)	Enacted; most manufacturers exempted the state
Kansas	HB 2180 (2024)	Enacted; AbbVie and AstraZeneca dropped lawsuits December 2024 after state AG interpretation
Maryland	SB 119 (2024)	Enacted; litigation pending
Minnesota	SF 2860 (2024)	Federal court dismissed manufacturer challenge in 2025
Missouri	SB 751 (2024)	Enacted; litigation pending
West Virginia	SB 325 (2024)	Blocked by Fourth Circuit (2025) - only state law struck down so far

The Eighth Circuit’s March 2024 PhRMA v. McClain decision held that the FDCA does not preempt Act 1103 because the state law “does not create an obstacle for pharmaceutical manufacturers to comply with 340B, rather it does the opposite.” The Supreme Court declined to review. This is the most consequential state-law ruling; it preserves a clear pathway to force contract pharmacy access. The Fourth Circuit’s block of West Virginia’s law on preemption grounds creates the first real state-law circuit split, with appellate posture likely decisive over the next 12-24 months.

ADR and HRSA enforcement

HRSA’s Administrative Dispute Resolution (ADR) process, finalized in April 2024, lets covered entities challenge manufacturer overcharges or refuse-to-sell actions. In practice, the Third and D.C. Circuit rulings have blunted HRSA’s leverage: violation letters have been withdrawn, and CMP referrals are effectively on hold. The 340B claims-data repository CMS is standing up under the 2026 PFS (and voluntary in the 2026 OPPS proposal) is likely to become the real enforcement infrastructure going forward.

HRSA rebate model pilot and modernization

In August 2025, HRSA published a Federal Register notice creating a voluntary 340B Rebate Model Pilot Program. Design: covered entities pay full WAC upfront and submit claims data to receive a rebate equal to WAC minus the 340B ceiling price. The pilot was scoped to Medicare Part D drugs selected for IRA MFP negotiation (nine of the ten 2026 MFP drugs). HRSA approved applications from J&J, Lilly, BMS, Novartis, and four others; Novartis’s plan was approved for an April 1, 2026 effective date.

Hospital groups sued. On February 10, 2026, the U.S. District Court for the District of Maine in AHA v. Kennedy vacated the HRSA notice and remanded. HHS announced on February 5, 2026 that it would scrap the existing program and, if it proceeds, issue a new notice with public comment and a 90-day minimum effective-date cushion.

Why manufacturers wanted it: post-dispense rebates force claims-level data submission (ending the contract pharmacy “black box”), make duplicate-discount and Medicaid/MFP overlap scrubs feasible before payment, and simplify IRA non-duplication reconciliation.

Why hospitals fought it: paying WAC upfront then awaiting rebate shifts working capital to covered entities and their contract pharmacies; hospitals also argue the statute requires upfront discounted pricing, not post-hoc rebates; and rebate disputes or data errors could strand margin.

Outlook: the pilot is dead, but the direction of travel is not. Expect HRSA (or more likely CMS via adjacent rulemaking) to revisit claims-data requirements and some rebate mechanism in 2026-2027, especially for MFP drugs where non-duplication is already required.

Congressional activity

Senator Bill Cassidy’s Senate HELP Committee report (May 2025) exposed previously confidential 340B economics: BayCare Health System generated $276.5 million in 340B revenue (Sept 2018-Sept 2023); Cleveland Clinic generated $933.7 million (Apr 2020-Jun 2023). Multiple reform bills across the 118th and 119th Congresses addressing transparency, patient definitions, and contract pharmacy scope have been introduced but none have passed. The CBO’s September 2025 analysis attributed most 340B growth to strategic choices by covered entities rather than list-price inflation, a finding favorable to manufacturer reform arguments.

Impact on vendor selection

For launch teams, 340B policy translates into concrete vendor-selection decisions across four categories.

1. Specialty pharmacy

Specialty drugs account for approximately 61.5% of 340B purchase dollars. For any hospital-channel-heavy product - oncology, rare disease, autoimmune biologics dispensed via J-code - 340B dynamics drive site-of-care economics.

Health systems have two strategic choices:

• Build: Launch an in-house specialty pharmacy to capture the full 340B spread (Drug Channels Institute illustrates ~$3,550 gross profit per specialty prescription in this model).
• Buy: Partner with a specialist operator. Shields Health Solutions (Sycamore Partners; Evernorth $3.5B preferred equity) works with more than 1,100 hospitals. CarePathRx was fully acquired by Evernorth/Cigna in February 2026. CPS Solutions is owned by UnitedHealth Group.

Most new products now face a three-channel reality at hospital dispensing:

• Hospital’s wholly owned in-house specialty pharmacy (clean 340B eligibility if entity rules met)
• Designated contract pharmacy for manufacturers allowing one (or two with data)
• Restricted entities that forgo 340B at contract pharmacies entirely

Launch teams should assume their channel strategy is scored against this structure.

2. Contract pharmacy / retail chains

The “340BIG Five” (CVS, Walgreens, Walmart, Express Scripts, Optum Rx) account for 76.1% of contract pharmacy/covered entity relationships. Mail and specialty relationships from the big three PBM-affiliated specialty pharmacies grew from about 14,000 in 2020 to 57,000 in 2025 - a quadrupling. Key incumbents:

• CVS Health (parent of CVS Specialty Pharmacy) - retail + Caremark PBM + owns Wellpartner TPA; >90% of retail locations are 340B contract pharmacies.
• Walgreens Specialty Pharmacy - retail + owns 340B Complete TPA.
• Accredo (Evernorth) - Cigna-owned specialty / mail operator aligned with the Express Scripts PBM stack.
• OptumRx Specialty Pharmacy - UnitedHealth-aligned specialty operator within the OptumRx PBM stack.

See The Big 3 PBM Specialty Pharmacies: Strategic Landscape and Top Specialty Pharmacies Used by Pharma Manufacturers for deeper competitive dynamics.

3. Hub services and eligibility verification

Hubs now need to encode 340B vs. non-340B channel logic in benefit verification, pharmacy routing, and patient communication: BV must flag hospital-affiliated dispensing and distinguish in-house from contract pharmacy arrangements; prior-auth workflows must respect state-specific carve-outs; affordability logic must reconcile 340B dispensing against copay accumulator/maximizer rules (PBMs now capture more than $6.5B of manufacturer copay dollars annually); and SP routing must distinguish LDD partners from contract pharmacies. Leading hub platforms with relevant capability: Eversana, Cencora / Lash Group, McKesson / CoverMyMeds, Cardinal Health / Sonexus, ConnectiveRx, CareMetx, and AssistRx. For hub-selection mechanics generally, see Hub Services Explained: Hub, Specialty Pharmacy, FRM.

4. 340B administration, data, and monitoring tooling

Manufacturer-side platforms: 340B ESP (Second Sight Solutions), the de facto industry claims-data platform required by dozens of manufacturers; Kalderos for duplicate-discount identification; and IntegriChain for channel data, chargeback, and gross-to-net reconciliation. Covered-entity-side: Apexus (HRSA Prime Vendor, Vizient-owned), and TPA/split-billing tools including Macro Helix (McKesson), Sentry Data Systems, Verity Solutions, 340B Complete (Walgreens), and Wellpartner (CVS). TailorMed supports point-of-dispense affordability; Fairview Pharmacy Solutions is a reference integrated health-system SP with deep 340B operating history.

Claims-data operating requirements

The practical difference between a defensible 340B policy and an unenforceable one is the operating quality of the claims-data loop. A manufacturer cannot rely on a restriction notice alone; the hub, SP network, 340B ESP / duplicate-discount tool, chargeback platform, and channel-data warehouse all have to agree on identifiers and exception logic.

Data element	Why launch teams need it
Covered entity and child-site identifier	Distinguishes hospital, FQHC, rural, and grant-funded entities with different risk profiles.
In-house vs. contract-pharmacy status	Determines whether the manufacturer’s policy restriction is triggered.
Payer / plan / line of business	Separates commercial, Medicaid, managed Medicaid, Medicare Part D, and MFP-sensitive claims.
NDC, dispense date, reversal status, and quantity	Supports duplicate-discount scrubs, replenishment disputes, and chargeback reconciliation.
State of covered entity and pharmacy	Drives state-law carve-outs and enforcement risk.
Prescription source and prescriber affiliation	Helps separate true covered-entity patients from leakage or diversion allegations.

This is why 340B should be part of hub and specialty-pharmacy RFPs even when the manufacturer does not plan a restrictive policy at launch. A product that starts unrestricted may need claims-level visibility later if state litigation, IRA MFP overlap, or hospital-channel concentration changes the economics.

What launch teams should do

1. Pick a 340B policy posture before launch

Four realistic postures:

Posture	Implications
No restriction	Full hospital-channel friendly; no spread visibility
One contract pharmacy, no data	Low admin burden; moderate hospital friction
One contract pharmacy + CLD via 340B ESP	Most common; requires ESP enrollment and data governance
Unlimited contract pharmacies + CLD	Pfizer/Sanofi/BMS-style; most defensible in court; state-law friendly

For a 2026 launch, Option 3 or 4 is generally defensible, with explicit carve-outs for the eight protection states.

2. Size the hospital channel

The highest-ROI targets for restriction policy are hospital-channel-heavy products: buy-and-bill specialty biologics, J-code infused oncology (see Oncology Launch Vendor Playbook), rare disease biologics dispensed through hospital specialty pharmacies (see Rare Disease Launch Vendor Playbook), and oral oncology routed through hospital-affiliated retail/mail. For these assets, 340B spread loss at non-restricted manufacturers can run 20%-40% of gross revenue.

3. Vendor shortlist implications

Concern	Shortlist anchors
Hospital SP access	Shields Health Solutions, Fairview Pharmacy Solutions
Contract pharmacy policy enforcement	340B ESP (Second Sight), Kalderos
340B routing in the hub	Eversana, Lash Group, CoverMyMeds, Sonexus, ConnectiveRx, CareMetx, AssistRx
Channel data / chargeback reconciliation	IntegriChain
Patient affordability in hospital channel	TailorMed

4. Instrument monitoring and watch 2026-2027 decision points

Wire 340B volume, diversion signals, and duplicate-discount flags into commercial dashboards from launch: contract pharmacy claims volume by manufacturer policy status, state-level exposure mapping, MFP/340B non-duplication reconciliation for any IRA-selected drug, and covered entity concentration. Watchpoints: Supreme Court posture on contract pharmacy restrictions (Fourth Circuit West Virginia + pending Seventh Circuit); a revived HRSA rebate rulemaking; CMS’s claims data repository moving from voluntary to effectively mandatory for Part D; state-law expansion to California, New York, Massachusetts; continued Senate HELP Committee reform work.

Comparison: 340B exposure by entity type and vendor category

Entity or vendor role	Typical 340B exposure	2026 manufacturer-policy response	Launch-team action
DSH hospital with in-house SP	High; 80% of program volume	Restrictions largely don’t apply to in-house pharmacy	Partner for hospital SP access; confirm in-house operation
DSH hospital using contract pharmacies	High	One CP per CE is typical; CLD required	Confirm policy compliance; monitor state carve-outs
FQHC	Moderate; 13% of program	More protected under IRA rebate framework	Hub must differentiate FQHC from hospital channels
Cancer hospital	High; specialty-heavy	Common target of oral oncology carve-outs	Close coordination with channel strategy
Rural referral / critical access	Moderate	Often single-pharmacy model fits well	Lower policy priority unless rural-heavy brand
Specialty pharmacy (PBM-owned)	High; 25% of contract pharmacy market	Quadrupled post-2020; claims-data platforms required	Evaluate LDD vs. open network given 340B overlap
Hub vendor	Indirect; channel-routing logic	Must encode state carve-outs and CLD requirements	Validate in RFP; check state-law handling
340B TPA (Apexus, Sentry, Macro Helix)	Infrastructure	Must interface with 340B ESP	Rarely directly contracted by manufacturer

Bottom line

The 340B program is too large and too politically entrenched to be rolled back, but it no longer runs under the simple post-2010 “unlimited contract pharmacies” regime. Two appellate courts have blessed manufacturer restrictions; eight states have pushed back, with mixed appellate outcomes; HRSA’s rebate pilot is dead but the underlying claims-data architecture is not. For a biotech launch team in 2026, “what’s our 340B policy” is a first-order question that shapes SP selection, hub configuration, state-level legal exposure, and MFP non-duplication reconciliation. Treat it that way.