Federal oversight of the pharmacy benefit management industry has intensified in recent years, culminating in the most sweeping federal legislative effort to regulate the industry to date with the enactment of the Consolidated Appropriations Act of 2026 (CAA 2026) on February 3, 2026, The CAA 2026, passed by Congress and signed into law by President Trump on the same day, funds various departments within the federal government.
Tucked into the more than 500 pages of the CAA 2026 are provisions impacting group health plan sponsors, specifically requiring the disclosure to ERISA[1] group health plan fiduciaries of compensation received by any entity providing pharmacy benefit management services on behalf of the plan. These provisions became effective on the date they were enacted (February 3, 2026) and prohibit an ERISA plan fiduciary from contracting with a covered service provider that fails to satisfy this compensation disclosure requirement.
The CAA 2026 also includes provisions requiring entities providing pharmacy benefit management services to disclose detailed reports of pharmacy-related spending and to pass through to the plan any rebates received for services performed on behalf of an ERISA group health plan. These spending and rebate-related provisions will become effective for plan years beginning on or after August 3, 2028 (30 months after the law was signed), or January 1, 2029 for calendar year plans.
Just prior to the enactment of the CAA 2026 on February 3, 2026, the Employee Benefits Security Administration (EBSA) arm of the Department of Labor (DOL) separately published a proposed rule (EBSA proposed rule) on January 30, 2026, titled “Improving Transparency into Pharmacy Benefit Manager Fee Disclosure,” This EBSA proposed rule is designed to increase transparency within pharmacy benefit manager arrangements[2].
Due to the almost simultaneous release of this EBSA proposed rule with the enactment of the CAA 2026, the CAA 2026 statutory provisions related to pharmacy benefit manager transparency will likely take precedence over the EBSA proposed rule. As a result, this article will focus on the key provisions included within the CAA 2026, as those will generally govern any future evolving rules and guidance surrounding pharmacy benefit management compensation transparency.
Group health plans that offer prescription drug coverage typically contract with third parties to administer on their behalf the plan’s prescription drug benefits by designing pharmacy networks, negotiating rebates from drug manufacturers, and processing prescription drug claims. These services may be provided by a plan’s third-party administrator (TPA), a health insurance company, or a dedicated pharmacy benefit manager – all of which are covered by the CAA 2026 when performing pharmacy benefit management services and will be referred to collectively throughout this article as “PBMs.” PBMs are compensated by administrative fees and network fees paid by the health plan, drug manufacturer rebates, spread pricing, and copay claw-backs in a murky system that is often difficult for plan sponsors to understand. Under the CAA 2026 (and the EBSA proposed rule), PBMs would be required to disclose the compensation they receive, along with any fees they charge group health plans on behalf of PBM-associated service providers.
ERISA applies to all private employer-sponsored group health plans. Governmental plans and church plans are typically exempt under ERISA. Plan sponsors of ERISA plans typically act as ERISA plan fiduciaries, and with that responsibility comes certain fiduciary duties to their plan participants, including selecting, monitoring, and paying reasonable compensation to the plan’s service providers. ERISA self-funded group health plans often lack insight and transparency into how — or how much — their PBMs are compensated, including how much compensation they receive through drug manufacturer rebates and other components of their pharmacy spending. This lack of transparency can make it difficult for an ERISA plan sponsor to fulfill their fiduciary duties of determining reasonable PBM compensation.
The PBM oversight reforms in the CAA 2026 and the EBSA proposed rule are intended to provide ERISA self-funded group health plans access to the information they need to evaluate the reasonableness of PBM compensation and better satisfy their fiduciary duties under ERISA.
However, non-ERISA plans are also subject to many of the CAA 2026’s provisions through amendments to the Public Health Service Act and Internal Revenue Code. Under the CAA 2026, PBMs would be required to provide robust disclosures to plan fiduciaries and insurers of group health plans regarding their compensation and spending related to prescription drug services provided to those plans. The EBSA proposed rule also includes provisions requiring advanced and semi-annual disclosures of PBM compensation, which could also be adopted in any future final rules and/or guidance related to the CAA 2026.
This information would allow fiduciaries of ERISA group health plans to audit the PBMs’ compensation and correct any inaccuracies. Plan fiduciaries would also be able to 1) use these disclosures in their process of selecting a PBM provider, 2) monitor service providers’ operations and compliance with their contractual obligations; and 3) analyze the drivers of prescription drug costs.
Under the CAA 2026, PBMs and other covered service providers receiving $1,000 or more in direct or indirect compensation are required to make an initial compensation disclosure to an ERISA group health plan, disclosing the amount of compensation the covered service provider reasonably expects to receive on behalf of the plan. Previously, there was ambiguity as to whether these compensation disclosures only applied to brokers and consultants of group health plans under the Consolidated Appropriations Act of 2021, but the CAA 2026 is very clear that these compensation disclosures apply to a broad range of entities who provide services on behalf of a group health plan under ERISA. This rule is effective immediately for ERISA group health plans. For non-ERISA group health plans, a similar initial compensation disclosure requirement will be effective in 30 months under the CAA 2026 (unless any final rules modify that effective date).
The expanded ERISA definition of a "covered service provider" in the CAA 2026 applies to those providing services (including brokerage services) that include "any of the following:
The EBSA proposed rule further provides that compensation must be disclosed regardless of whether such services will be performed, or such compensation received, by the covered service provider directly, or its affiliate, agent, or subcontractor.
For any plan year beginning on or after 30 months following February 3, 2026 (or January 1, 2029 for calendar year plans), the CAA 2026 requires PBMs to report significant information to large employer plans, which are defined as employers with an average of 100 employees in the preceding calendar year or plan year, as long as they had at least one employee on the first day of the calendar year or plan year. These semi-annual[3] disclosures of compensation and drug spending data apply to both ERISA and non-ERISA group health plans.
Categories of required information to be disclosed include:
PBMs will also be required to disclose semi-annually to all group health plans information that could influence a plan's PBM selection decision, including:
This information will also need to be included in a plan participant disclosure that contains summary information related to the plan’s prescription drug spending. Group health plan sponsors will be required to annually notify plan participants (in their plan documents or separately, if applicable) that this summary information from the PBM is available upon request.
ERISA plans should be aware that in addition to initial compensation disclosures, the EBSA proposed rule also includes a requirement for semi-annual PBM compensation disclosures, which may (or may not) be adopted prior to the delayed effective date of the semi-annual disclosures required by the CAA 2026.
PBMs typically earn a portion of their compensation by retaining discounts framed as “rebates” that they negotiate with pharmacies, drug manufacturers, and other service providers. Manufacturer rebates, for example, often reflect negotiated discounts that PBMs receive for including in a formulary the prescription drug(s) provided by a specific drug manufacturer rather than those offered by its competitor. PBMs are also frequently compensated through a related rebate practice known as “spread pricing,” where the PBM retains the difference between what the PBM receives as payment for the prescription drug from the health plan and the cost of that same drug after the PBM negotiates discounts with the drug manufacturer.
Under the CAA 2026, effective for ERISA group health plans with plan years beginning on or after 30 months following February 3, 2026 (or January 1, 2029 for calendar year plans), PBMs will be required to “pass through” to the health plan/insurer 100% of all rebates, alternative discounts, and other remuneration on a quarterly basis (which must be included in the contract with the PBM), disclose these amounts to the health plan/insurer, and be subject to an annual audit by the health plan/insurer. Once effective, ERISA group health plans and their insurers will be prohibited from contracting with (including extending or renewing a contract with) a PBM that does not pass through all rebates to the group health plan or insurer in accordance with these provisions. Potential penalties to ERISA group health plans could apply under ERISA for failure to adhere to these requirements.
The CAA 2026 also requires that PBMs provide further information through sharing of data, reporting, and the inclusion of contract provisions for potential federal governmental oversight purposes. For plan years beginning on or after 30 months following February 3, 2026 (or January 1, 2029 for calendar year plans), all group health plans (both ERISA and non-ERISA) and insurers are prohibited from entering into a contract with a PBM unless the entity contractually agrees to not limit or delay the disclosure of information (and for ERISA group health plans, the pass-through of rebates) to the group health plan/insurer.
The CAA 2026 includes steep penalties for non-compliance with any of its disclosure and notice provisions. A PBM or group health plan that fails to provide information required under the CAA 2026 could face a civil monetary penalty of $10,000 per day or up to $100,000 per violation for knowingly providing false information. Note that penalties may be waived for good-faith efforts to comply.
At this time, the CAA 2026 mainly impacts PBM initial compensation disclosures to ERISA group health plans. The provisions related to providing disclosures of drug spending to all group health plans and the 100% rebate pass-through provisions do not take effect for another 30 months (or January 1, 2029 for calendar year plans). This significant delay in the effective date provides ample time for group health plans to prepare for PBM renegotiations and ensure that their contracts comply with these rebate, advanced disclosure, and audit requirements.
However, the CAA 2026’s clarification of the ERISA definition of “covered service provider” to explicitly include PBMs appears to be effective immediately. This means PBMs not currently providing advanced reporting of compensation to an ERISA group health plan will need to adjust their practices to provide initial compensation disclosures. Moreover, ERISA group health plans will need to ensure that these disclosures are provided before entering into, extending, or renewing a contract to provide pharmacy benefit management services to avoid potential liability under ERISA.
Additionally, if/when the EBSA proposed rule is finalized, an ERISA plan fiduciary may be required to file a notice with the DOL if a covered service provider fails to comply with a written request for a compensation disclosure within 90 calendar days of the request. If no action is taken, the contract could be considered a prohibited transaction, exposing the plan fiduciary to potential liability and penalties.
Given this increased focus on ERISA fiduciary duties (as well as the broader industry and governmental push for increased PBM oversight), employer group health plan sponsors are encouraged to take the following steps now:
Lastly, it's worth noting that the CAA 2026 and EBSA proposed rule arrive against a broader backdrop of federal efforts focused on prescription drug pricing and health plan transparency, including:
Risk Strategies will continue to closely track all regulations and guidance released in connection with the CAA 2026, and provide updates when available. In the meantime, contact your Risk Strategies account team with any questions or contact us directly here.
[1] ERISA is the acronym for the Employee Retirement Income Security Act of 1974.
[2] Intended to implement Executive Order 14273, Lowering Drug Prices by Once Again Putting Americans First
[3] Or quarterly if requested by the group health plan.
[4] Aligning with Executive Order 14221, Making America Healthy Again by Empowering Patients With Clear, Accurate, and Actionable Healthcare Pricing Information