For the first time in decades, Congress is considering comprehensive bipartisan legislation that would place many disputed 340B Program rules directly into statute. The proposals could provide long-awaited clarity: but they would also create significantly different compliance paths for Covered Entities.
The SECURE 340B Act, H.R. 9599, was introduced in the House on July 6, 2026. The SUSTAIN 340B Act was introduced in the Senate on August 5, 2026. Neither bill is law. Both may change substantially during the legislative process.
At a high level, both proposals would:
- Establish a statutory 340B patient definition.
- Authorize contract pharmacies without numerical or geographic caps.
- Create an independent claims-data clearinghouse.
- Expand reporting, audit, and enforcement requirements.
- Require patient financial-assistance policies.
- Prohibit discriminatory reimbursement and contracting practices by payers and pharmacy benefit managers.
The similarities end there. SECURE is generally more prescriptive regarding referral prescriptions, hospital child sites, public reporting, financial assistance, and medical debt. SUSTAIN offers stronger long-term protection for point-of-purchase discounts and broader referral eligibility, but adds recurring audits, annual independent contract-pharmacy audits, strict ownership requirements, and Covered Entity user fees.
The Short Version
| Issue | SECURE 340B Act | SUSTAIN 340B Act | Likely Covered Entity Impact |
|---|---|---|---|
| Patient relationship | 24-month lookback; narrower prescribing-provider rules; five-year records | Two-year lookback; somewhat broader practitioner relationships; three-year records | Both require claim-level eligibility documentation. SECURE may disqualify more prescriptions tied to existing provider arrangements. |
| Referral prescriptions | Primarily available to qualifying FQHCs, critical access hospitals, and sole community hospitals | Available to broader grantee Covered Entities, critical access hospitals, and sole community hospitals | SUSTAIN preserves broader referral eligibility but adds aggressive monitoring and audit triggers. |
| Contract pharmacies | No numerical or geographic cap; federal review and extensive public location data | No numerical or geographic cap; inactive-pharmacy cleanup and annual independent audits | Both protect contract-pharmacy access but substantially increase governance and data obligations. |
| Rebate models | Requires upfront discounts for at least four years; continuation may depend on clearinghouse performance | Directs HHS to end the rebate pilot within one year and transition to a clearinghouse | SUSTAIN provides the clearer long-term commitment to point-of-purchase pricing. |
| Child sites | Detailed integration standards and a community-need test; limited nonprofit or government joint ventures allowed | Detailed integration standards; 100% ownership requirement; generally delays newly acquired sites for three years | SECURE creates geographic risk. SUSTAIN creates ownership and acquisition-timing risk. |
| Patient assistance | Hospitals generally must reach at least 400% of the federal poverty level; medical-debt restrictions apply | Assistance generally required for patients at or below 200% of the federal poverty level | SECURE would create the larger financial and operational change for hospital Covered Entities. |
| Transparency | Extensive reporting published by individual Covered Entity | Reporting published in aggregate and by Covered Entity type, with executive attestation | SECURE creates greater public-comparison exposure. SUSTAIN creates greater executive-certification risk. |
| Audits and funding | Expanded audit authority; no comparable Covered Entity user fee | Patient-status audits at least every three years, annual contract-pharmacy audits, and user fees beginning in fiscal year 2031 | SUSTAIN creates a more predictable: and potentially costly: recurring oversight cycle. |
| Nonhospital entities and subgrantees | Detailed nonprofit, grant-scope, subgrantee, funding, registration, and oversight rules | No comparable stand-alone subgrantee framework | SECURE could materially affect FQHCs and other grantee networks. |
1. Patient Definition and Referral Prescriptions
Both bills would replace the current guidance-based patient standard with a statutory definition built around three requirements:
- A prior outpatient service.
- An auditable relationship with the Covered Entity.
- A prescription connected to that care.
Both proposals use a two-year lookback. The difference is how each bill defines the provider relationship and how long records must be retained.
Under SECURE, the prescribing provider generally must be an employee or independent contractor for whose services the Covered Entity bills. The bill also recognizes certain physician-organization affiliates. The provider must be enrolled in Medicare or Medicaid and retain clinical responsibility for the care connected to the prescription. Covered Entities would generally need to retain supporting records for five years.
SUSTAIN uses a more flexible practitioner standard. It may include practitioners working under an ongoing contractual obligation, qualifying FQHC cooperative arrangements, or appropriate medical-staff relationships where the Covered Entity is legally prohibited from contracting. SUSTAIN generally requires at least three years of auditable records.
For your entity, this means the patient relationship can no longer live only in a policy manual. You will need alignment among the encounter, provider relationship, medical record, prescription, registered site, and applicable grant or designation.
Referral Prescriptions: A Major Difference
SECURE would principally permit referral prescriptions for:
- FQHCs certified as comprehensive Patient-Centered Medical Homes.
- Critical access hospitals.
- Sole community hospitals.
It would also impose detailed requirements for direct care, referrals, consultation, follow-up, documentation, and prescription timing. Referral utilization above specified thresholds could trigger audits. A referral share above 35% could lead to a corrective action plan and temporary loss of referral authority.
SUSTAIN would make referral prescriptions available to a broader group of grantee Covered Entities, critical access hospitals, and sole community hospitals. It would generally allow an outside provider to prescribe within 12 months of the referral, provided the Covered Entity documents the patient relationship, referral, outside care, consultation, and prescription.
SUSTAIN is broader, but it is not lenient. An audit could be required when referral volume exceeds the lesser of 20% of 340B volume or the entity’s recent three-year historical percentage, subject to a hardship process.
Operational takeaway: Referral capture could no longer rely on a referral order alone. Your program would need a documented chain connecting the original encounter, referral, outside provider, consultation, and prescription.
For additional legislative context, see GapRx’s Cassidy’s 340B Reform Draft: 5 Things Every FQHC CEO Should Know Right Now.
2. Contract Pharmacies
Both proposals would expressly authorize contract pharmacies without a numerical or geographic cap. Manufacturers would generally be required to offer 340B pricing whether a drug is dispensed through an in-house or contract pharmacy.
Both bills would also:
- Require contract-pharmacy registration before implementation.
- Require written agreements to be submitted for federal review.
- Establish mandatory contract terms.
- Require pharmacies to provide claims, dispensing, and audit data.
- Restrict Medicaid claims from being processed as 340B without duplicate-discount safeguards.
- Make contract-pharmacy information and dispensing volume publicly available.
SECURE would publish detailed geographic information, including the distance between the Covered Entity and pharmacy and whether the pharmacy serves a rural, frontier, medically underserved, or shortage area.
SUSTAIN would require Covered Entities to terminate arrangements with no 340B dispensing activity during the prior 12 months, subject to limited exceptions. It would also require each contract pharmacy to undergo an annual independent audit commissioned by the Covered Entity.
For FQHCs with large retail networks, SUSTAIN could create a recurring expense and management burden. Your contracts must provide timely access to complete claims, dispensing, Medicaid, inventory, financial-assistance, and audit data.
GapRx’s 340B Contract Pharmacy Solutions can help Covered Entities strengthen pharmacy oversight, claims auditing, reconciliation, and vendor accountability.
3. Upfront Discounts, Rebate Models, and the Clearinghouse
The bills take different approaches to the future of rebate models.
SECURE would require manufacturers to provide the 340B ceiling price as an upfront purchase-price reduction for at least four years. Continued protection after that period could depend on HHS and Office of Inspector General validation that the clearinghouse meets statutory performance benchmarks.
That creates a guaranteed four-year pause: but not necessarily a permanent prohibition on alternate pricing mechanisms.
SUSTAIN would direct HHS to end the 340B rebate pilot, or a substantially similar program, within one year of enactment and transition to its independent clearinghouse. This gives SUSTAIN the clearer long-term position in favor of point-of-purchase discounts.
Both clearinghouses would receive claims-level information to identify duplicate discounts and overlapping price concessions. SECURE is more prescriptive about the required data, including:
- Pharmacy and medical claims.
- Wholesaler and invoice data.
- NDCs and quantities.
- Prescriber and provider information.
- Payer and Covered Entity data.
SECURE would also limit routine reclassification of claims from non-340B to 340B more than six months after the drug was furnished. For Medicare-negotiated selected drugs, it would require direct claims-level submissions to manufacturers, with potential civil monetary penalties of $5,000 per day after notice and an opportunity to cure.
The cash-flow nightmare is straightforward: disconnected pharmacy, medical, wholesaler, Medicaid, commercial payer, and TPA data could make compliance and reconciliation extremely difficult.
Read GapRx’s 340B Rebate Model Readiness for Leadership for practical considerations involving claims tracking, reconciliation, and working capital.
4. Hospital Child Sites
Both bills would establish detailed eligibility standards for hospital child sites, including registration, common policies, clinical and financial integration, shared oversight, provider-based characteristics, and cost-report support.
SECURE would add a significant community-need test. A child site generally would need to be located in a ZIP Code Tabulation Area ranking at or above the 50th percentile nationally: or the 40th percentile within the state: on a specified vulnerability measure.
A site outside those areas could potentially qualify through an alternative payer-mix test if at least 40% of patients are enrolled in Medicaid, uninsured, or at or below 200% of the federal poverty level. Existing sites could face review at recertification.
SUSTAIN does not impose the same geographic test. However, it generally requires 100% Covered Entity ownership and could delay 340B eligibility for newly acquired sites for three years unless HHS grants a hardship exception.
Operational takeaway: Hospital systems should analyze both geography and ownership. A site can be fully integrated operationally and still face eligibility risk under one proposal.
5. Patient Financial Assistance
Both bills would require transparent financial-assistance policies made available at the point of care. The policies would extend to child-site and contract-pharmacy patients and require auditable implementation records.
SUSTAIN generally requires assistance for patients at or below 200% of the federal poverty level, along with a sliding fee scale for 340B drugs where applicable.
SECURE would go further for hospitals. Many hospital Covered Entities would generally need to offer assistance through at least 400% of the federal poverty level and provide nominal copayments for 340B drugs.
SECURE also includes medical-debt restrictions. Hospital Covered Entities generally could not sell patient debt, report adverse information to credit bureaus, deny medically necessary care because of unpaid bills, or pursue legal collection actions except under specified ability-to-pay standards.
For your organization, financial assistance would become a day-to-day 340B operational requirement. You would need to screen patients, communicate eligibility, apply assistance consistently, reconcile transactions, and demonstrate implementation across every dispensing channel.
6. Transparency and Reporting
Both proposals would require annual reporting on topics such as:
- Patients and prescriptions receiving 340B drugs.
- Payer mix and charity care.
- Use of 340B savings.
- Patient financial demographics.
- Medication-access policies.
- TPAs and vendor relationships.
- Medicare and Medicaid funding shortfalls.
- Outpatient utilization and program costs.
The major difference is public exposure.
SECURE would direct HHS to publish reported information in a searchable format identified by individual Covered Entity. That could increase scrutiny from manufacturers, payers, media, policymakers, and community stakeholders.
SUSTAIN would publish information in aggregate and by Covered Entity type, rather than naming each organization in the same way. However, it would require the CEO, CFO, or COO to attest that 340B savings were used to benefit patients and communities.
Both bills require more than accurate spreadsheets. Your entity will need consistent definitions, a defensible savings methodology, documented allocation practices, and governance over the story your data tells.
7. Audits, Enforcement, and Program Costs
Both proposals would expand HHS authority to audit Covered Entities, manufacturers, child sites, contract pharmacies, and vendors. Both would formalize corrective action plans and permit sanctions or removal for unresolved noncompliance.
SUSTAIN is more explicit about recurring oversight. It would require:
- Patient-status audits at least every three years.
- More frequent reviews for high-risk or high-volume entities.
- Annual independent contract-pharmacy audits.
- A quarterly user-fee program beginning in fiscal year 2031.
The annual assessment would begin at $50 million and be allocated among Covered Entities largely according to 340B prescription volume.
SECURE would expand federal audit staffing and require longer record retention but does not establish a comparable Covered Entity-funded user fee.
The practical message is clear: 340B compliance would require ongoing participation from executive leadership, legal, finance, pharmacy, IT, revenue cycle, clinical operations, and compliance teams.
GapRx’s HRSA Audit & 340B Compliance support helps Covered Entities organize documentation, test internal controls, conduct mock audits, and maintain audit readiness before an audit notification arrives.
8. SECURE’s Special Subgrantee Framework
SECURE contains a separate framework for nonhospital Covered Entities and subgrantees that has no direct counterpart in SUSTAIN.
The proposal would require nonhospital Covered Entities to meet nonprofit or public-entity standards and limit 340B purchasing to patients receiving services at registered sites when the services and drugs fall within the scope and time period of the qualifying grant or authorizing statute.
A grantee would also be directly responsible for a subgrantee’s 340B compliance. Written agreements would need to cover registered subgrantee sites, qualifying federal funding, in-kind contributions, oversight, and termination requirements.
For FQHCs and other grantees, subgrantee oversight could become a direct compliance risk. Review your:
- Subaward agreements.
- Scope-of-project controls.
- Funding flows and in-kind support.
- Site registrations.
- Patient eligibility documentation.
- Audit rights and termination provisions.
What Covered Entities Should Do Now
Neither bill should be implemented as final law. You should, however, begin preparing for the operational issues both proposals identify.
Use this READINESS checklist:
- R : Relationships: Map employed, contracted, affiliated, credentialed, and referral providers.
- E : Eligibility: Inventory patient, site, grant, and child-site qualification records.
- A : Agreements: Review contract-pharmacy and subgrantee agreements for data and audit rights.
- D : Data: Test whether pharmacy, medical, wholesaler, payer, Medicaid, and TPA systems can produce claims-level information.
- I : Integrity: Strengthen duplicate-discount, diversion, documentation, and exception controls.
- N : Need: Evaluate child-site geography, payer mix, patient assistance, and community-need exposure.
- E : Executive governance: Establish leadership review for reporting, attestations, savings methodology, and corrective action plans.
- S : Savings: Build a consistent, defensible methodology for calculating and explaining how 340B savings benefit patients.
The Bottom Line
Both bills would provide statutory recognition of contract pharmacies, limits on manufacturer-imposed conditions, payer nondiscrimination protections, and clearer federal rules.
Neither proposal preserves the current operating environment.
SECURE would create the more restrictive framework for referral prescriptions, child-site geography, public reporting, and hospital affordability obligations. SUSTAIN would generally provide stronger protection for point-of-purchase discounts and broader referral eligibility, but it would impose recurring audits, annual contract-pharmacy reviews, strict ownership rules, and a substantial user-fee program.
The question is not simply which bill is “better.” The real question is which combination of protections, restrictions, costs, and compliance duties Congress ultimately carries into a negotiated final package.
GapRx helps Covered Entities translate regulatory change into practical workflows, stronger controls, better data visibility, and audit-ready operations. Schedule a 340B strategy call to discuss how your organization can prepare.
Sources and Disclaimer
This article reflects legislative text and public information available as of August 18, 2026. Neither the SECURE 340B Act nor the SUSTAIN 340B Act is law, and either proposal could change during the legislative process. This article is provided for general informational purposes and does not constitute legal advice.