ALERT: Ask Your Representative to Vote YES on 340B Legislation
With less than two days left in the legislative session, now is the moment to make your voice heard.

Following strong approval in the Senate, IHA’s Illinois Patient Access to 340B Pharmacy Protection Act (HB 2371 SA 2) has moved to the House. The House Executive Committee approved the legislation this evening, and the bill now moves to the full House for consideration—where the outcome is far from certain. If you haven’t yet contacted your Representative, please do so IMMEDIATELY. Your action can help secure the future of the 340B program for hospitals and patients across Illinois.

This bill does not change the 340B program—it simply restores it to the way it successfully operated for years, before drug manufacturers began imposing arbitrary restrictions that threaten access to affordable medications and care for underserved patients.

Your Representative needs to hear directly from hospital leaders about what’s at stake. Drug companies are spending millions to spread misinformation to protect their profits. We need your voice to cut through the noise.

ACTION REQUESTED: Contact your House Representative TODAY and urge them to support and say they will vote “yes” on IHA’s 340B protection legislation. Click here to access IHA’s digital messaging platform to send a pre-populated message directly to your House legislator to ask for their support of this legislation. 

DOJ’s Limited Enforcement of its Data Security Program to End July 8
On Feb. 28, 2024, the Biden Administration issued Executive Order (EO) 14117, titled “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.” The type of data covered under the Data Security Program (DSP) is broad and includes six categories of personal data, including personal health data and biometric identifiers (though the data must meet certain volume thresholds to be included). Unlike most other national and international privacy laws and regulations, anonymization, pseudonymization, de-identification or encryption does not alone exempt the data from the DSP.

On April 8, 2025, the Dept. of Justice’s National Security Division (NSD) issued a final rule to implement the EO, which created the DSP. Among other things, the DSP prohibits or restricts certain transactions involving access by foreign adversaries in China, Russia, Iran, North Korea, Cuba, and Venezuela to “bulk” U.S. sensitive personal data and U.S. government-related data. The DSP also requires U.S. entities engaged in certain transactions with foreign adversaries, known as restricted transactions, to comply with additional security, due diligence, auditing, and reporting requirements. Even if a U.S. entity is not directly transacting business with a foreign adversary, the entity may still have obligations under the DSP, such as requiring it to include certain contractual language in its contracts which prohibit data from being resold to a foreign adversary. 

The NSD has issued various guidance documents relating to the DSP, including a Compliance Guide, as well as an FAQ document. Importantly, although the DSP became effective on April 8, 2025, recognizing that U.S. businesses need time to determine whether the DSP’s prohibitions and restrictions apply to them, and to implement any necessary compliance programs, the NSD has issued an Implementation and Enforcement Policy, stating that, so long as businesses are engaging in good faith efforts to comply, it will not prioritize civil enforcement actions until July 8, 2025.

The DSP does provide several exemptions for transactions that are necessary for public health, safety, or welfare. IHA recommends that members consult with their legal counsel and utilize the guidance documents issued by the NSD to determine what, if any, obligations they may have under the DSP, and to develop any appropriate compliance program. 

IHA, ICAHN Urge HHS to Reject Pharma’s Harmful 340B Rebate Policies 
A.J. Wilhelmi, IHA President and CEO, and Tracy Warner, Executive Director of the Illinois Critical Access Hospital Network (ICAHN), recently partnered on a letter to U.S. Dept. of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr, urging the Secretary to reject the pharmaceutical industry’s latest effort to undermine the 340B Drug Pricing Program. Pharmaceutical manufacturers have begun imposing a “rebate model,” rather than the longstanding “upfront discount” model that HHS has permitted since the beginning of the program. The 340B Program is a vital lifeline for our 340B-participating hospitals, nearly 70% of which are Critical Access Hospitals and Safety Net Hospitals. As the letter points out, 340B hospitals will be required to spend substantial sums to comply with each drug company’s unique “rebate policy” if these policies are approved by HHS. In a recent court filing, HHS indicated that they would be issuing guidance on rebate policies by June 2, 2025. 

Medicaid IMPACT Revalidations Due TOMORROW – IMMEDIATE ACTION REQUIRED
The Illinois Dept. of Healthcare and Family Services (HFS) is conducting IMPACT Medicaid provider revalidations. Providers in the May cohort must complete IMPACT revalidations by TOMORROW, May 31. IHA is strongly urging all providers to check the revalidation cycle due date for their hospital and all affiliated servicing providers. Failure to act by the deadline will result in disenrollment from the IMPACT system, and as a result:

• You will not be able to bill for services provided to Illinois Medicaid enrollees, including those in managed care.
• You will not receive Medicaid reimbursement until enrollment is established. NOTE: There is no option for retroactive reinstatement or reimbursement.

HFS has provided IHA with step-by-step instructions to check the status and due date of servicing providers that you can access here. Additional resources—including FAQs, instructions and an informational webinar recording can be found here.

 
Staff contact: Elizabeth Nelson

Cyber Alert: Russian State-Sponsored Hackers
The FBI, National Security Agency and international partners recently issued a joint advisory warning of ongoing cyber operations by a Russian state-sponsored cyber actor Russian General Staff Main Intelligence Directorate (GRU), also known in the cyber community as APT28, Fancy Bear, Forest Blizzard, and BlueDelta. For more than two years, these groups have targeted technology and logistics companies using tactics like password spraying, spearphishing and unauthorized mailbox access.

While the healthcare sector is not the direct target, the alert highlights potential indirect risks—especially through third-party vendors that also contract with the U.S. military or allied governments. Hospitals are encouraged to strengthen third-party risk management practices and ensure awareness of all business lines that could expose healthcare systems to collateral cyber threats. The advisory includes additional information and mitigations.