The short version: Five Massachusetts hospitals sued Eli Lilly on October 27, 2026, over its requirement that they submit claims data to receive 340B prices. The hospitals say Lilly’s policy and the platform’s terms are unlawful and put sensitive data at risk. Lilly says it needs the data to identify duplicate discounts and other program abuse.
The dispute
The federal 340B program requires drug manufacturers that participate in Medicaid to offer covered outpatient drugs at or below a ceiling price to eligible hospitals, clinics and other covered entities. Covered entities must, among other things, prevent diversion and duplicate discounts and maintain records showing compliance. www.hrsa.gov
The five plaintiffs are Massachusetts General Hospital, Brigham and Women’s Hospital, Salem Hospital, UMass Memorial Medical Center and UMass Memorial Health–Harrington Hospital. Their complaint says Lilly made 340B pricing conditional on sending in-house pharmacy and medical claims data through 340B ESP, a third-party platform. The hospitals argue that the data and platform terms create privacy, data-use and liability concerns. They allege violations of Massachusetts’ consumer protection law and unjust enrichment, and seek an injunction, damages and other relief.
Lilly’s stated position is that it needs claims data to identify duplicate discounts and other abuse. The hospitals dispute whether Lilly can make this data submission a condition of receiving 340B prices and challenge the terms governing the data. The court has not resolved that dispute.
The complaint alleges that lost discounts would mean tens of millions of dollars in annual costs for MGH, Brigham and Salem, and at least $20 million in annualized overpayments for UMass Memorial.
What providers can do now
The lawsuit does not create new 340B requirements for covered entities or FQHCs. Existing HRSA requirements still apply, including accurate program records, annual recertification, controls against diversion and duplicate discounts, and records that can support an audit. www.hrsa.gov
Providers can use this moment to review how they handle a data request or proposed agreement:
Decide who should review the request, including pharmacy, compliance, privacy, finance and legal staff.
Identify what information would be shared, who could use it, how long it would be kept, and what the agreement says about security, liability and deletion.
Check that 340B policies and records are current and that staff know how to escalate questions before responding.
The practical question for an organization is whether it can explain what data it shares, under what terms, and who approves that decision.
What to watch
The next developments are court filings and rulings in the Massachusetts case and related cases, along with any HRSA or HHS guidance on manufacturer claims-data requests. The earlier federal rebate-model pilot was vacated in February; that action did not decide the separate question in this lawsuit about claims-data conditions. www.hrsa.gov
Lanton, Lanton & Sosa can help covered entities and FQHCs review 340B data requests and agreements, clarify internal review procedures, and prepare records for existing program oversight. The aim is to help providers understand their options and make a considered decision before a dispute escalates.
This article is for general information and is not legal advice. The case is General Hospital Corp. v. Eli Lilly and Co., No. 1:26-cv-14855 (D. Mass.).