Countdown to Compliance Week: Compliance Officer FAQ on HRSA, 340B and HIPAA

Corporate Compliance & Ethics Week starts November 1. In Part 2 of our "Countdown to Compliance Week" series, we turn to the specific risk areas compliance officers ask us about most: HRSA’s scope of project, 340B, and HIPAA.

Yes.  HRSA released the Health Center Program Scope of Project Policy Manual on August 11, 2026. It took effect immediately, replacing the scope-related policies that were scattered across separate Policy Information Notices (PINs). The new Manual includes several substantive policy changes that health centers should evaluate and address. Among the most significant are:

• Contracts and cooperative arrangements: New requirements for documenting services provided through contracts (Form 5A, Column II) and cooperative arrangements (formerly “referral” arrangements) (Form 5A, Column III). Health centers should review existing agreements and assess whether revisions or additional documentation are necessary.
  
  
• Telehealth geographic limitations: New geographic parameters governing when telehealth services may be provided to new and established patients, based on where the patient resides or is physically located at the time of the visit. Health centers should review their telehealth policies and practices to ensure alignment with these requirements.
  
  

Because the new Scope Manual took effect immediately, health centers should assess how these changes affect their existing operations and identify any necessary updates to agreements, policies, and procedures.

On October 1, HRSA has approved proposals from ten manufacturers to offer 340B discounts on the drugs subject to Maximum Fair Price negotiations under the Inflation Reduction Act through a rebate-only model beginning January 1.  Manufacturers did not request approval to offer Ozempic/Wegovy/Rybelsus (Novo Nordisk) or Calquence (AstraZeneca) through a rebate model.

The American Hospital Association, Maine Hospital Association, and four hospitals filed suit on October 9 asking the U.S. District Court for the District of Maine to strike down the rebate model and issue a restraining order halting the pilot.  The same parties successfully sued HRSA in late 2025 to prevent the prior iteration of the rebate model from taking hold on January 1, 2026.  The new challenge focuses on HRSA’s dismissal of covered entity statements that the program will be highly burdensome to providers.

Also on October 9, four Representatives (two R, two D) introduced legislation that would impose a moratorium on the rebate model through 2028, effectively blocking it for two years.

If the litigation is unsuccessful and Congress does not intervene, the rebate model will begin on January 1 and 340B program covered entities will be required to purchase 17 drugs at full undiscounted pricing, including some frequently purchased by health centers, including Linzess (AbbVie), Enbrel and Otezla (Amgen), Farxiga (AstraZeneca), Jardiance (Boehringer Ingelheim), Eliquis (BristolMyersSquibb), Breo Ellipta and Trelegy Ellipta (GlaxoSmithKline), and Janumet (Merck).  Covered entities can then report on how the full-priced packages were used to the manufacturers’ contractor, Beacon, which should then dole out the 340B discounts as a rebate.

HIPAA headlines can make it hard to tell what’s required today versus what might be required in the future. Here’s what’s in effect, what’s coming and what’s proposed:

• In effect: The compliance cate for the 42 CFR Part 2 (“Part 2”) Final Rule was February 16, 2026. Health centers should have updated their Notice of Privacy Practices to address Part 2 records. Health centers with Part 2 programs should confirm their consent, disclosure and breach notification practices meet the updated requirements.  
  
  
• Coming: In August, OCR announced that it would release a HIPAA Privacy Final Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens, finalizing some of the Privacy Rule changes first proposed in 2021. This HIPAA Privacy Final Rule will focus on patients' access to their records and information sharing for care coordination. OCR expected the Final Rule to be released in August 2026; however, it has not yet been released. Under HIPAA, changes to the rules generally take effect with a compliance period of at least 180 days, so HIPAA regulated entities will have time to update policies, forms and training once the Final Rule is published.
  
  
• Proposed:
  • Privacy Rule: OCR expects to release a Notice of Proposed Rule Making on the HIPAA Privacy Rule to Promote Individuals' Timely Access to their Protected Health Information in November 2026. This topic was part of the Privacy Rule changes proposed in 2021.
  • Security Rule: OCR proposed major revisions to the Security Rule in January 2025. OCR is now targeting July 2027 for a Final Rule. Until then, the current Security Rule remains fully in effect and enforced.

In our final post before Compliance Week, we'll answer the questions compliance officers ask when something goes wrong – from receiving reports to conducting investigations and reporting issues.

This post builds on Part 1 of our Countdown to Compliance Week series, where we explored the foundational elements of an effective compliance program.

For guidance on your health center's specific situation, contact a member of the Powers team.