Vol. 1 · No. 12
The half of the shield law still on trial
Two federal courts backed state 340B laws this week, in New Mexico on Monday and in the Eighth Circuit on Wednesday. Johnson & Johnson’s claims-data condition took effect on the Tuesday in between. Only one of those two statutes reaches it, and whether any state law reaches it goes to the full Fourth Circuit on October 27.
- The Eighth Circuit denied rehearing en banc on September 16 in Novartis v. Hanaway, leaving Missouri’s contract pharmacy delivery law in force and the panel opinion intact.
- A New Mexico federal court denied AbbVie’s injunction on September 14 and found the record did not establish that claims data are necessary to initiate a 340B audit.
- Johnson & Johnson’s claims-data condition took effect September 15 for every covered entity type except AIDS Drug Assistance Programs, on a 45-day submission clock.
- Comments closed September 14 on the CMS proposal to require Part D 340B claims submission from January 1, 2027. The voluntary repository opens October 1.
- At least five hospital systems are suing CVS entities over 340B savings allocation, with the Mount Sinai dismissal motion fully briefed as of September 16.
Your shield law protects the shipment. The bill arrives as a data request.
New Mexico and Missouri both beat manufacturers in court this week. They did not win on the same statute, and the difference decides whether Johnson & Johnson’s September 15 condition reaches you.
On Monday, Chief Judge Kenneth J. Gonzales refused to block New Mexico’s 340B access law. On Wednesday, the Eighth Circuit refused to rehear Novartis’s challenge to Missouri’s. In between, on Tuesday, Johnson & Johnson’s claims-data condition took effect for every covered entity except AIDS Drug Assistance Programs. Three days, two courtroom wins, one new obligation. Most of the sector will read the first two and file the third under compliance.
Read them together instead. The two statutes that won are not the same statute, and the gap between them is where the money moves in 2027.
Missouri’s S.B. 751, codified at Mo. Rev. Stat. § 376.414.2, does one thing. It bars a manufacturer, a third-party logistics provider, or their agents from denying, restricting, or prohibiting the acquisition or delivery of a 340B drug by any pharmacy a covered entity has contracted with or otherwise authorized. That is the whole substantive reach. The Eighth Circuit affirmed the denial of Novartis’s injunction on July 1 on exactly that ground, writing that “Section 340B is silent on the delivery of 340B drugs” and that S.B. 751 “regulates the delivery of 340B drugs in a manner consistent with federal law.” On September 16 the court denied panel rehearing and rehearing en banc. Judge Traynor dissented, joined by Judge Justin D. Smith, and Judge Kobes would have granted. Missouri’s law stands.
New Mexico’s H.B. 78 is narrower than Missouri’s in who it covers and broader in what it bars. Section 26-1-27(A)(4) defines the protected class as federally qualified health centers and look-alikes, and nothing else, so a New Mexico DSH hospital gets nothing from it. For the health centers inside the statute it does three things. Subsection (B)(1) protects acquisition and delivery, the way Missouri’s does for every covered entity. Subsection (B)(2) protects dispensing. Subsection (B)(3) bars a manufacturer from requiring “any claims, utilization, purchasing or other data as a condition” of acquisition or delivery, unless federal law requires the sharing. AbbVie attacked the data bar directly, arguing it strips manufacturers of the data they need to run a 340B audit. Judge Gonzales rejected it. “The record does not establish, however, that claims data are necessary to initiate an audit,” he wrote. He added that the statute already carves out claims and utilization data that federal law requires, so a manufacturer cannot win on preemption “merely because claims data would make it easier to identify potential audit targets.”
That second ruling is the one worth your attention, because the audit argument AbbVie lost in Albuquerque is the argument that won in Richmond in March.
Missouri’s law survived on Wednesday. A Missouri hospital still owes J&J its claims data on a 45-day clock.
In March a Fourth Circuit panel affirmed a preliminary injunction against West Virginia’s S.B. 325, which pairs a delivery protection with a claims-data bar carrying a $50,000 penalty per violation. The panel accepted the reasoning Gonzales rejected: manufacturers “likely need to ‘require’ submission of claims or utilization data” to build an audit case, so the state bar “frustrates the operation of the audit mechanism.” That opinion is no longer law. The full Fourth Circuit granted rehearing en banc, which vacates a panel judgment under the circuit’s own rule, and hears argument on October 27. West Virginia’s law stays unenforceable in the meantime, under a district court injunction entered in December 2024, not under any appellate holding.
So the scoreboard a covered entity should keep looks nothing like the one the trade press keeps. Twenty-two states bar manufacturers from restricting delivery to contract pharmacies, a count the Eighth Circuit itself put in a footnote on July 1. Far fewer bar the data condition. I have confirmed the provision in statute text in eight: Colorado, Illinois, Maine, Nebraska, New Mexico, Vermont, Washington, and West Virginia. That count is a floor rather than a total, because no one has published a clean list. The absence of the list is itself the problem. Missouri is not on it. Neither is Arkansas, whose law produced the precedent the rest of the Eighth Circuit now rests on. And the data provisions that do exist differ in who they cover. New Mexico’s protects health centers alone.
Run that through one hospital. A Missouri DSH hospital spent two years watching Novartis try to strike down the law that protects its contract pharmacy network. On Wednesday that effort ran out. On Tuesday the same hospital came under a J&J policy that conditions the 340B price on submitting claims-level data within 45 days of dispense, 60 days for certain oncology and autoimmune products, enforced by two notices and then suspension. Missouri law does not touch it. The Eighth Circuit’s opinion does not touch it. The hospital is covered in the fight it was watching and exposed in the one it was not.
Give the manufacturers their strongest version of this. Duplicate discounts in Medicaid managed care are real, the Inflation Reduction Act created a genuine nonduplication problem between the maximum fair price and the 340B ceiling, and claims data is the obvious way to police both. Gonzales did not say manufacturers have no interest in the data. He said the record before him did not show they need it to start an audit, and that federal law, not a drug company’s notice, sets what a covered entity owes. That is a narrow ruling, and a defensible one. It also leaves the field open in every state with no data provision.
Three moves follow.
Map your states on three axes, not one. For every state where you hold a covered entity or a contract pharmacy, record three facts: does the law bar delivery restrictions, does it bar data conditions, and does it cover your entity type. Most compliance summaries track only the first. New Mexico shows why the third matters, since its data bar reaches health centers and leaves hospitals outside. If either of the last two columns comes up short for a site, that site has no state-law answer to a manufacturer data demand, whatever the shield-law map on your wall shows.
Price the data condition the way you price a payment cut. J&J is at least the tenth manufacturer this year to extend claims-data requirements to every covered entity type, and the second in five days. Eli Lilly opened the sequence effective February 1, the American Hospital Association counted seven more between March 2 and June 1, and Genentech moved on August 31. Treat the next one as scheduled rather than possible, and put a number on it: what your 340B spread is with each top manufacturer, and what it becomes at wholesale acquisition cost if pricing suspends. Your board should hold that figure before a five-day notice arrives, not after.
Push your state association toward severability and toward the data clause. Two drafting points decide whether the next statute survives. Write the data provision as a separate, severable section, so a ruling against the delivery half does not take the data half with it. And write the federal-law carve-out the way New Mexico did, because that carve-out is what let Gonzales dispose of the preemption argument in a paragraph. Statehouse sessions open in January. The drafting happens now.
October 27 is the date to hold. The full Fourth Circuit hears two 340B cases back to back that morning. Maryland’s H.B. 1056, in AbbVie, Inc. v. Brown, bars delivery restrictions and stops there. West Virginia’s S.B. 325, in PhRMA v. McCuskey, also bars the data condition, and that is the case that decides whether a state has any power to stop a manufacturer from conditioning the statutory price on a data submission. A ruling for West Virginia makes the eight-state list a template. A ruling against it leaves twenty-two states protecting a shipment that arrives at a price the manufacturer still controls.
Douglas McCormack, Founder of Acumen Partners and Chair of MedMatrix Rx, is a health policy attorney, startup CEO, and investor in early-stage health care ventures.
The Eighth Circuit closes the door on Novartis, and Missouri’s law stands
What happenedOn September 16 the U.S. Court of Appeals for the Eighth Circuit denied both panel rehearing and rehearing en banc in Novartis Pharmaceuticals Corp. v. Hanaway, No. 25-1619. The underlying panel opinion of July 1, written by Judge Erickson and joined by Judges Lavenski Smith and Benton, affirmed the Western District of Missouri’s denial of a preliminary injunction against Missouri S.B. 751, codified at Mo. Rev. Stat. § 376.414. The panel rejected field preemption as foreclosed by its own 2024 decision in PhRMA v. McClain, rejected conflict preemption because “Section 340B is silent on the delivery of 340B drugs,” and rejected a dormant Commerce Clause challenge on all three prongs. Judge Traynor dissented from the denial of rehearing, joined by Judge Justin D. Smith, and Judge Kobes also would have granted. Judges Gruender, Kelly, and Grasz did not participate.
Why it mattersMissouri’s statute reaches delivery and nothing else. It bars manufacturers from denying or restricting acquisition or delivery of a 340B drug to a contract pharmacy, enforced as an unlawful trade practice under the Missouri Merchandising Practices Act, with parallel Board of Pharmacy discipline under § 376.414.4. It contains no claims-data provision. A Missouri covered entity now has durable protection for its contract pharmacy network and no state-law defense against a manufacturer that conditions the 340B price on submitting claims data. The panel opinion also supplies the sector’s best public count of the state layer: footnote 5 lists 22 states with contract pharmacy delivery protections as of July 1, 2026.
- Treat delivery protection and data protection as separate columns in your state matrix. Missouri now demonstrates that a state provides one without the other.
- Novartis has roughly 90 days from September 16 to petition for certiorari. No petition appeared on the Eighth Circuit docket as of its last entry on September 16, 2026.
- Cite footnote 5 rather than an advocacy tally when your government relations team needs a defensible count of shield-law states.
New Mexico beats AbbVie’s injunction, and the ruling reaches the data clause
What happenedOn September 14, Chief Judge Kenneth J. Gonzales denied AbbVie’s motion for a preliminary injunction against New Mexico H.B. 78 in AbbVie Inc. v. Torrez, No. 1:25-cv-01230-KG-JHR (D.N.M.), finding no substantial likelihood of success on field or conflict preemption. The statute, N.M. Stat. Ann. § 26-1-27, protects acquisition and delivery to contract pharmacies, protects dispensing, and separately bars requiring “any claims, utilization, purchasing or other data as a condition” of acquisition or delivery unless federal law requires the sharing. All three protections run only to “applicable entities,” which § 26-1-27(A)(4) defines as federally qualified health centers and look-alikes. New Mexico hospitals sit outside the statute. On the data provision the court wrote: “The record does not establish, however, that claims data are necessary to initiate an audit.” Because the statute exempts claims and utilization data that federal law requires, the court held, AbbVie “cannot establish conflict preemption merely because claims data would make it easier to identify potential audit targets.” The court granted amicus participation by the American Hospital Association, 340B Health, and ASHP, and did not reach the remaining injunction factors.
Why it mattersThis is the second District of New Mexico ruling to reject the manufacturers’ audit-necessity argument on the record, and the most direct rejection yet. Judge Gonzales cites PhRMA v. Torrez, 2026 WL 1752214, at *10 (D.N.M.), as “concluding the same.” That argument is the centerpiece of the challenge to every state claims-data provision, and it is the argument a Fourth Circuit panel accepted in March against West Virginia’s S.B. 325 before the full court vacated that opinion. New Mexico is the counterweight going into the Fourth Circuit’s en banc argument on October 27, which reaches the whole of S.B. 325 rather than the data bar alone. The federal-law carve-out did decisive work here, which makes it a drafting lesson for the 2027 statehouse sessions rather than a curiosity.
- Send this opinion to your state hospital association before January. The carve-out language at § 26-1-27(B)(3) is what disposed of the preemption claim.
- A preliminary injunction denial is not a final judgment. AbbVie retains the merits case and an appeal to the Tenth Circuit.
- If you are a federally qualified health center or look-alike in New Mexico, a manufacturer data condition is unenforceable there today unless federal law independently requires the data. No other covered entity type is inside the statute.
Johnson & Johnson’s claims-data condition took effect September 15
What happenedJ&J’s policy, announced September 4 and reported by Becker’s Hospital Review on September 11, took effect September 15, 2026. It requires claims-level data for J&J outpatient drugs dispensed at entity-owned pharmacies, alongside the contract pharmacy data J&J already collects through 340B ESP. J&J has reached in-house pharmacies before. Its February 2023 policy cut hospitals to one contract pharmacy within 40 miles of the parent site and required them to submit 340B ESP claims data for their own entity-owned pharmacies as the price of keeping that one contract pharmacy, the first manufacturer policy to require claims data outside the contract pharmacy space. What is new on September 15 is that in-house claims data becomes a condition of 340B pricing outright, across every covered entity type except AIDS Drug Assistance Programs. The submission window is 45 days from the date of dispense, extended to 60 days for certain oncology and autoimmune products. Enforcement runs through two notices of noncompliance followed by suspension of 340B pricing, with restoration within 10 business days of compliance. AIDS Drug Assistance Programs are excluded. J&J cites duplicate discounts in Medicaid managed care, maximum fair price duplication under the Inflation Reduction Act, and diversion. A companion notice extends J&J’s limit of one contract pharmacy within 40 miles of the parent site, in place for hospitals since March 2023, to federal grantees, with a designation deadline of October 20 and an effective date of November 3, 2026 (Healthcare Dive, September 14).
Why it mattersThe effective date fell between two rulings that upheld state 340B laws. Neither ruling touches this policy in Missouri, and New Mexico’s statute reaches it only for federally qualified health centers and look-alikes. J&J is also at least the tenth manufacturer this year to extend claims-data requirements to every covered entity type. Eli Lilly opened the sequence effective February 1, the American Hospital Association counted seven more between March 2 and June 1, and Genentech moved on August 31, four days before J&J’s notice. The grantee extension matters separately: most manufacturer contract pharmacy policies since 2020 exempted federal grantees, so health centers and hospitals now share the same injury and the same drafting interest.
- Confirm which of your products fall in the 60-day tier rather than the 45-day default. The tiers differ by product, not by entity.
- Grantee partners have until October 20 to designate one contract pharmacy within 40 miles of the parent site under the November 3 policy. Brief the FQHCs your specialty pharmacy serves.
- Model the suspension scenario: 340B ceiling versus wholesale acquisition cost on your J&J volume, by dispensing site, as a board-level number.
CMS’s Part D 340B repository comment window closed, and the file opens October 1
What happenedComments on the CY2027 Physician Fee Schedule proposed rule closed September 14, 2026, the deadline set in the July 16 Federal Register notice. The rule proposes to require Medicare providers and suppliers that are covered entities to submit to the Medicare Part D Claims Data 340B Repository for claims with a date of service on or after January 1, 2027. Voluntary submission opens October 1, 2026 under a CMS fact sheet dated August 2026. Submitters provide seven fields per claim: 340B ID, claim record indicator, date of service, prescription or service reference number, fill number, NDC-11, and dispensing pharmacy NPI. The first deadline is December 31, 2026, covering claims dated January 1 through September 30, 2026.
Why it mattersThis is the first federal 340B dataset built from covered entities’ own claims submissions, and the first to reach Part D. Medicare has flagged 340B-acquired drugs at the claim line under the outpatient payment system since 2018, through the TB modifier and, until the payment cut ended, the JG modifier, but that data comes out of Part B billing rather than out of a covered entity’s own filing. The contrast with the week’s manufacturer news is the point. A covered entity that submits to CMS voluntarily in October and to J&J under a 45-day clock in November runs two claims feeds for the same prescriptions, on different schedules, to parties with different interests. Whether the federal file eventually displaces manufacturer demands or simply adds to them is now a rulemaking question rather than a litigation question, and the comment window on it has closed.
- Decide with your TPA whether to submit voluntarily. The December 31 deadline surfaces mapping problems while the data carries no consequence.
- Confirm your systems produce all seven fields for every dispensing pharmacy. The NPI field ties the repository to your contract pharmacy network.
- Comments are closed, so the remaining influence runs through the final rule’s comment responses and through Congress. Brief government relations accordingly.
Hospitals keep suing their own contract pharmacy vendors
What happenedAt least five hospital systems have now sued CVS entities over 340B savings allocation. Mount Sinai, the University of Kansas Hospital Authority, and University of Michigan Hospitals filed on May 18, 2026, together alleging roughly $250 million. Henry Ford Hospital followed July 16 at more than $29 million, and Froedtert Memorial Lutheran Hospital, Inc. v. CVS Health Corporation, No. 2:26-cv-01432 (E.D. Wis.) on August 20 at $18,008,051.32. Mount Sinai Hospital v. CVS Health Corporation, No. 1:26-cv-04143 (S.D.N.Y.), before Judge Gregory H. Woods, pleads RICO and breach of contract against CVS Health Corporation, CaremarkPCS Health, LLC, Caremark, LLC, and Wellpartner, LLC, and puts its figure above $121 million for 2020 to 2025. CVS moved to dismiss the Mount Sinai and Michigan cases on July 22 as ordinary contract disputes. The defendants filed their reply brief supporting dismissal in Mount Sinai on September 16. All five remain pending.
Why it mattersIn every one of these cases the plaintiff is a covered entity and the defendants are the contract pharmacy and PBM partners it hired. The dispute is over how the arrangement split 340B savings. That is a different fight from the preemption litigation, and it runs on contract terms a hospital negotiated rather than on a statute a legislature wrote. CVS’s answer is that these are contract disputes and nothing more, which is also the argument that keeps them out of RICO. The Mount Sinai motion is fully briefed, so the first ruling on whether a RICO theory survives here is close. A dismissal steers future plaintiffs toward straight contract claims. Survival gives every covered entity with a large contract pharmacy network a reason to audit its own vendor agreements.
- Pull your contract pharmacy and TPA agreements and locate the provisions governing savings allocation, reconciliation, and audit rights.
- Reconcile a sample period of dispensing data against expected 340B savings. Both complaints were built from that reconciliation.
- Watch the Mount Sinai dismissal ruling. It sets whether these cases proceed as fraud claims or as ordinary contract disputes.
- Two Fourth Circuit en banc arguments on October 27. Maryland’s H.B. 1056 and West Virginia’s S.B. 325, back to back. Only West Virginia’s bars data conditions (calendar).
- HRSA rebate pilot approvals, due September 24. The agency acts then on manufacturer plans for maximum fair price drugs, for a January 1, 2027 start (Federal Register).
- AbbVie v. Jackley in the Eighth Circuit. The court held briefing in abeyance on September 17 while it weighs initial hearing en banc, with responses due September 21 (docket).
- AbbVie’s challenge to the 340B patient definition. AbbVie’s surreply is due September 29 in the District of Columbia case over HRSA’s 1996 guidance (docket).
- EIGHTH CIRCUITNovartis Pharmaceuticals Corp. v. Hanaway, No. 25-1619, opinionJuly 1
- COURTLISTENERNovartis v. Hanaway docket, rehearing deniedSeptember 16
- GOVINFOAbbVie Inc. v. Torrez, memorandum opinion and orderSeptember 14
- FOURTH CIRCUITPhRMA v. McCuskey, panel opinion (vacated)March 31
- BECKER’SJ&J to hospitals: Submit claims data or lose 340B pricingSeptember 11
- FOURTH CIRCUITEn banc cases calendar: Brown (24-1939) and McCuskey (25-1054), October 27Accessed September 18
- CMSMedicare Part D Claims Data 340B Repository fact sheetAugust 2026
- FEDERAL REGISTERNotice regarding 340B Rebate Model Pilot ProgramAugust 3
- AHARecent 340B data policy changes: separating myths from factsAugust 11