When the Rules Change, Is Your Data Ready?

I recently read about the changes coming to 340B. What caught my attention wasn't the pharmacy rule. It was the data problem underneath it.

If you are a healthcare provider that relies on 340B, January 1, 2027 could turn claims data quality into a cash flow question. Your data may not be broken. The rules are changing, and the data may not be ready. When that happens, the question isn't just “Can we produce the report?” It's “Can we produce the right data, completely and accurately, in time to get paid?”

Let's look at what's changing and why this is a data problem as much as a pharmacy problem.

What's Changing

In August 2026, HRSA published a revised 340B Rebate Model Pilot, with implementation planned for January 1, 2027. It covers drugs selected for Medicare price negotiation, about 5.5 percent of total 340B sales based on 2025 data. The pilot is voluntary for manufacturers, but once HRSA approves a manufacturer's plan, participation is mandatory for every eligible “covered entity” (the hospitals and clinics that qualify for 340B) buying that manufacturer's pilot drugs.

Even though the 2025 version was blocked by a federal court and later vacated, and the revised pilot may face more litigation, providers should plan for the change. Waiting for the rules to settle completely could mean waiting until the cost of fixing your data is much higher.

For affected drugs, the discount no longer arrives at purchase. A provider pays the wholesale price up front, then submits claims data to receive the 340B discount back as a rebate. That changes the financial equation.

Each claim needs specific fields, including date of service, NDC-11, quantity dispensed, prescriber ID, service provider ID, 340B ID, BIN, PCN, and health plan ID. HRSA does not require purchasing data, encounter data, or patient-level clinical information.

And HRSA isn't the only organization asking for this information. Medicare is also building its own database for 340B claims on Part D prescriptions, so 340B units can be excluded from Medicare's drug inflation rebates and manufacturers aren't charged twice for the same drug. The repository opened for voluntary submissions on October 1, 2026, and CMS has proposed making submission required for 2027 claims.

Much of the same claims data may soon have to be complete for two programs, not one.

Why Claims Data Now Decides Cash Flow

Today, the discount arrives when you buy the drug. Under the rebate model, you pay the full price first and wait for the discount to come back. That's money you've already spent and haven't recovered yet.

The working capital gap can be significant. Commenters on the pilot reported 20 to 40 times higher upfront acquisition costs for affected drugs, and one large health system estimated about $10 million in additional annual working capital. HRSA also acknowledges that smaller entities, which may need higher-interest borrowing to cover the gap, could bear larger costs.

For a community health center, those 340B savings are not simply a margin. They can support sliding-fee care, pharmacy access, and services that grants alone do not cover.

When claims data is late or incomplete, that funding waits.

And here's where the data problem gets interesting. The information needed to submit a complete claim doesn't live in one system:

Five functions, multiple systems, one claim. Your data team may be able to send the file today. But unless someone owns the accuracy of every required field, rebates can still stall.

It Isn't Only 340B

The 340B pilot is one example of something healthcare organizations deal with every year. UDS measures get revised, CMS updates quality and reporting requirements, and HRSA changes what a grant report must show.

Sound familiar? The EMR and billing extracts that worked last year suddenly stop matching what the funder asks for this year. Someone rebuilds the report by hand, numbers get questioned, and the report gets delayed. Sometimes a grant drawdown or reimbursement waits until someone figures out what went wrong.

None of this necessarily means someone failed. The real problem is simpler:

The organization changed the question without changing the data process that answers it.

And it isn't only a safety-net provider issue. Banks face new regulatory reporting deadlines. Manufacturers face new traceability and emissions reporting rules. Any industry where a regulation comes with a deadline sees the same scramble: pulling data from systems that were never designed to answer the new question.

We often treat regulatory and reporting changes as one-time fire drills instead of a routine part of running the organization. The better approach is to treat every significant rule change as a controlled data update.

The Controlled Update: Identify, Own, Test

A manufacturer must give you at least 90 days' notice. On October 1, HRSA announced it had approved 10 manufacturers' plans for the January start, so for many providers that clock is already running. Start with the data you already have, and work through three steps.

And this is not a one-time project. Next year brings another rule change, and the year after that brings another reporting requirement. The same three steps still apply.

Three Questions for Your Leadership Team This Week

How quickly can your organization turn a new requirement into trusted data? If the answer takes a while, that's where to start.

The Key Takeaway

Rules will keep changing.

The organizations that treat data as something they own and maintain, rather than as a one-time IT project, are better positioned to adapt. A new regulation shouldn't trigger a scramble across pharmacy, billing, IT, finance, and compliance every time. It should trigger a repeatable process: identify, own, test.

Because the real question isn't whether your data worked last year. It's whether your data is ready for what changes next.

So if the notice arrived today, would your data be ready?