Your PBM Has Some Explaining To Do: What The 2026 CAA Forces PBMs To Reveal

Pharmacy benefit managers (PBMs) play a significant role in managing prescription drug benefits by establishing pharmacy networks, negotiating rebates with drug manufacturers, developing drug formularies, and processing prescription drug claims.¹ Recent federal developments have expanded transparency and reporting obligations for PBMs and created new compliance responsibilities for plan sponsors.

This client alert is the first in a two-part series covering these developments. Part 1 addresses the Consolidated Appropriations Act of 2026 (2026 CAA), which imposes new statutory disclosure and rebate pass-through requirements on PBMs. Part 2 addresses a proposed Department of Labor (DOL) rule on PBM fee disclosures that would impose additional disclosure obligations for self-insured group health plans.

Overview

The 2026 CAA formally treats PBMs as “covered service providers” under ERISA,² subjecting them to the same prohibited transaction rules that apply to brokers, recordkeepers, and other third-party administrators—and providing a limited exemption from those rules when the same robust disclosure requirements under ERISA Section 408(b)(2) are met. 

The 2026 CAA amended ERISA and the Internal Revenue Code³ to add new disclosure and transparency provisions regarding PBM compensation, drug pricing, plan and participant spending and claims, and rebates and fees, including:

• Reporting requirements.
  • Reports from PBMs to group health plans and health insurance issuers.
  • Reports and disclosures from group health plans to participants and beneficiaries.
• A mandatory rebate pass-through requirement.

Reporting Requirements

The 2026 CAA reporting requirements are effective for plan years beginning after August 3, 2028 (i.e., January 1, 2029, for calendar-year plans).⁴

Reports from PBMs

PBMs must provide (i) a detailed drug-level report to large employers and large plans (i.e., 100 or more participants) and (ii) a summary document to all group health plans, regardless of size.⁵ Both reports must be written in plain language, consistent with HIPAA privacy rules, and must be provided at least every six months (or quarterly, if requested by the plan).

The detailed report must include the following information: contracted compensation; indirect compensation (e.g., rebates, fees, and discounts); drug pricing; spread pricing;⁶ plan and participant spending; pharmacy and prescription data; drug information by therapeutic class; and benefit design. See the Appendix for a complete list of required content.

Reports from Group Health Plans

Group health plans must provide the following information to participants and beneficiaries:

• Annual notice of the PBM reporting requirements under the 2026 CAA.
• Upon participant request:
  • The PBM summary document, and
  • Detailed information with respect to a participant or beneficiary drug claim.

Mandatory Rebate Pass-Through

PBMs must pass through to the plan or health insurer 100% of rebates, fees, alternative discounts, and other remuneration from any entity related to drug utilization or spending. This requirement is effective for contracts entered into or renewed on or after August 3, 2028, but does not impact existing contracts. Contracts with PBMs will be subject to the following:

• Rebate pass-through must be included in the PBM contract.
• Rebates must be remitted to the plan/health insurer on a quarterly basis and no later than 90 days after the close of each quarter.
• PBMs must allow plans/health insurers to perform an audit of rebate records at least once a year.
• PBMs retain the ability to charge bona fide service fees.⁷

• A plan/health insurer may seek recovery of remuneration paid to the PBM in violation of 2026 CAA requirements or other equity relief.

Next Steps for Plan Sponsors

Plan sponsors should take the following steps in advance of the 2026 CAA's effective dates:

• Fiduciary review. Plan fiduciaries should (i) determine whether existing PBM arrangements are necessary for plan operation and whether compensation for services is reasonable, and (ii) develop procedures to comply with the upcoming changes, including the PBM disclosures and participant notice obligations.
• Contract review and amendment. Plan sponsors should expect to revise contracts with PBMs during renewals and extensions over the next few years and should consider developing new PBM and third-party administrator contract language to incorporate the new disclosure and rebate pass-through requirements.
• Procurement. Plan sponsors should incorporate the new disclosure rules into requests for proposals with new service providers.

Footnotes

1. The DOL defines PBM services broadly to include services necessary to manage or administer prescription drug benefits, including but not limited to: negotiating or aggregating rebates; establishing or administering pharmacy networks; developing or maintaining a formulary; processing or paying prescription drug claims; performing utilization review and management; adjudicating appeals or grievances related to prescription drug benefits; maintaining records related to prescription drug benefits; and performing regulatory compliance functions related to prescription drug benefits.

2. ERISA Section 408(b)(2) provides a limited exemption from ERISA's Section 406 prohibited transaction rules for contracts with service providers for "necessary services" at "reasonable compensation."

3. The 2026 CAA: (1) amended ERISA Section 408(b)(2)(B) to require upfront fee disclosure by most health plan service providers, including PBMs; (2) added a new ERISA Section 408(b)(2)(C) to provide an exemption to the prohibited transaction rules if the PBM passes through all rebates; (3) created a new ERISA Section 726, which imposes monetary penalties of up to $10,000/day for violations of the PBM drug pricing and fee disclosure rules and up to $100,000 for each piece of knowingly false information provided; and (4) made conforming amendments to the Internal Revenue Code.

4. The 2026 CAA requires compliance starting with the plan year beginning 30 months after enactment. The 2026 CAA was enacted on February 3, 2026, and August 3, 2028, is 30 months after such date.

5 Regulations regarding the format of reports, the content of summary documents, and implementation are to be issued within 18 months after enactment of the 2026 CAA.

6. Spread compensation is when the price that the plan paid exceeds the amount that is reimbursed to the pharmacy.

7. A bona fide service fee is defined as a flat fee that is: (1) consistent with fair market value; (2) for a service actually performed; (3) not passed on to a client or customer; and (4) does not vary based on drug price.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.