Response to Public Comments

ICR Comments and Responses
Data Elements
Comment: One commenter expressed support for the data elements proposed for the 340B
repository. They stated that the data elements directly correlate with data submitted by Part D
plan sponsors and can easily be matched to the same records used to identify rebatable units.
Another commenter suggested that CMS align these data elements with data elements proposed
for the 340B Rebate Model Pilot Program from the Health Resources and Services
Administration (HRSA) for efficiency of collecting data across programs.
Response: CMS thanks these commenters for their feedback. CMS appreciates the support for
CMS’ approach to align the data elements for the 340B repository with the data elements already
used by the Drug Data Processing System (DDPS) to match Prescription Drug Event (PDE)
transactions. CMS also appreciates the suggestion from the commenter who recommended CMS
align the data elements in the 340B repository for the Medicare Part D Inflation Rebate Program
with the data elements HRSA adopts for the 340B Rebate Model Pilot Program. This comment is
out of scope for this final rule because it addresses another program and a topic beyond the scope
of the Medicare Part D Drug Inflation Rebate Program.
Submission Format
Comment: One commenter emphasized the need for a data submission process that is straight
forward and readily accessible. The commenter recommended that the 340B repository accept
standard file formats, such as .xls or .csv through a secure web-based portal. The commenter
stated that if a covered entity needs to undertake extensive technology development to make
submissions to the 340B repository that meet the agency’s data requirements, then that covered
entity may elect not to make submissions, and thus technically complicated data submission
processes may result in the data of some covered entities being effectively excluded from the
340B repository.
Response: CMS thanks this commenter for sharing their insight. CMS will strive to limit the
burden on covered entities associated with their submission of data to the 340B repository. As the
340B repository is further developed, we will take into consideration this request to accept files
in standard formats such as .xls and .csv.
Certification
Comment: One commenter expressed concern over the potential burden associated with the
requirement of covered entities to certify the 340B status of claims submitted to the 340B
repository. They stated that this requirement shifts burden onto covered entities and suggested
that no certification be required during the initial 340B repository testing period.
Response: CMS thanks this commenter for their feedback. As described in the Supporting
Statement for the collection of information request, the 340B repository testing period will
provide CMS the opportunity to conduct usability testing for the 340B repository. An integral
part of the agency’s usability testing is assessing whether covered entities are able to submit data
to the 340B repository that is complete and accurate to the best of the covered entity’s
knowledge. The testing period also allows covered entities to develop and test processes for

meeting CMS’ standards for submitting data elements to the 340B repository. In order to achieve
these goals and ensure the quality of the data in the 340B repository, the certification requirement
is necessary.
Data Security
Comment: One commenter suggested CMS require that all submissions to the 340B repository
adhere to Office of Inspector General (OIG)-aligned audit standards, mandate end-to-end
encryption in transit and at rest, and implement role-based access controls with time-stamped
audit trails. The commenter also provided suggestions for a correction process that includes the
ability for providers to flag and amend erroneous entries, and publication of annual summaries of
corrections made.
Response: CMS thanks this commenter for their suggestions. CMS understands the importance
of maintaining the confidentiality of data submitted to the 340B repository. Therefore, this data
will be for official use only and shall not be disseminated, distributed, or copied to persons not
authorized to receive the information, including manufacturers and Part D plan sponsors. CMS
affirms its commitment to protect sensitive and confidential data submitted by covered entities
and continues to acknowledge the importance of data security. The 340B repository will be
designed to comply with all applicable federal security laws, regulations, and Department of
Health and Human Services (HHS) policies, including but not limited to those related to data
protection and information security. We will evaluate the suggestions made by this commenter,
such as the suggestion that submissions be required to adhere to OIG-aligned audit standards and
the potential to publish summaries of corrections made, to determine which, if any, may be
appropriate to adopt for the 340B repository. During the testing period beginning in 2026, CMS
intends to develop a process for providers to correct erroneous entries.