The regulatory landscape for Pharmacy Benefit Managers (PBMs) has shifted from a period of minimal federal oversight to one with greater federal involvement amid a patchwork of state laws. Historically, PBMs have served as thirdparty administrators responsible for managing prescription drug benefits through claims processing, network design and rebate negotiations. However, the longstanding lack of transparency inherent in these operations has culminated in significant regulatory scrutiny and escalating litigation risks for plan sponsors.
The enactment of the Consolidated Appropriations Act of 2026 (CAA 2026), together with the Department of Labor’s (DOL) proposed fee-disclosure regulations, marks a pivotal transition toward greater federal oversight of PBM business practices. Although both the CAA 2026 and the DOL proposal introduce comprehensive PBM reforms, they differ in scope and timing.
Covered Plans
CAA 2026: Applies broadly to both fully insured and self-insured group health plans, as well as health insurance issuers, under the Employee Retirement Income Security Act (ERISA), the Internal Revenue Code and the Public Health Service Act.
DOL Proposal: Applies to ERISA-covered self-insured group health plans and expressly excludes fully insured plans, although the DOL has requested public comments on this issue
Effective Dates
CAA 2026: The provisions discussed below are effective for plan years beginning on or after Aug. 3, 2028 (or Jan. 1, 2029, for calendar year plans).
DOL Proposal: If finalized, the proposed rule would apply to plan years beginning on or after July 1, 2026 (or Jan. 1, 2027, for calendar year plans).
Key Provisions: Comparative Overview
The extent to which the CAA’s broader mandates may influence the final DOL rule remains uncertain as rulemaking progresses.
| Provision | CAA 2026 | DOL Proposal |
|---|---|---|
|
Reporting Requirements |
PBMs must provide detailed drug spending data semiannually (or quarterly if requested). Plans must also provide participants with an annual written notice regarding these reports. |
PBMs for self-insured plans must provide initial compensation disclosures to plan fiduciaries reasonably in advance of entering into, renewing or extending a contract, and must also furnish ongoing semiannual disclosures. |
|
Rebate Treatment |
Mandatory 100% pass-through of all rebates, fees and alternative discounts to the plan, generally paid quarterly. |
Requires detailed disclosure of rebates and other payments received from drug manufacturers. |
|
Spread Pricing |
Large plans must provide information (upon request) showing the difference between what the plan paid the PBM and what the PBM paid the pharmacy. |
PBMs must disclose compensation received when the price paid by the plan for a drug exceeds the amount reimbursed to the pharmacy. |
|
“Covered Service Provider” Status (entities required under ERISA to disclose specified information about their services and all expected direct and indirect compensation) |
ERISA’s covered service provider definition is expanded to explicitly include PBM services, along with other health plan-related services. |
Expands ERISA’s covered service provider requirements for self-insured plans by treating providers of PBM services and certain PBM-affiliated brokers and consultants as covered service providers. |
|
Fiduciary Relief |
Plan fiduciaries will not violate ERISA if a PBM fails to remit required rebates, provided certain conditions are met. |
Provides relief for plan fiduciaries who take certain steps if their PBM fails to comply. |
|
Audits and Overpayments |
PBMs must return funds if an audit indicates an overpayment to the plan. |
Allows plan fiduciaries to audit the accuracy of PBM disclosures. |
Penalties
Group health plan sponsors and health insurance issuers should be aware that noncompliance with these new federal requirements may result in substantial financial consequences:
CAA 2026: Failure by a PBM or group health plan to provide required information may result in civil monetary penalties of $10,000 per day until the information is reported. Additional penalties—of up to $100,000 per item—may apply for knowingly providing false information, although penalties may be waived for good-faith efforts to comply.
DOL Proposal: Plan fiduciaries of self-insured group health plans may be subject to enforcement action by the DOL and the imposition of civil penalties.
Next Steps
As implementation timelines advance and the DOL moves toward finalizing its rule, plan sponsors and issuers should evaluate their existing PBM contracts and ensure that compliance processes are in place to meet their upcoming reporting, disclosure and fiduciary obligations. Proactive monitoring and early preparation will help ensure that plans remain aligned with evolving regulatory expectations.
This article is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice. ©2026 Zywave, Inc. All rights reserved.
