Legal Alert: PBM Transparency Coming Soon

Two recent movements on the federal level have paved the way for greater pharmacy benefit manager (“PBM”) transparency for group health plans. 

The first is a proposed rule, “Improving Transparency Into Pharmacy  Benefit Manager Fee Disclosure” issued by the Department of Labor which, if finalized, will require detailed disclosures of PBM pricing and compensation to self-funded ERISA plans and will give self-funded ERISA plans broader audit rights in their PBM contracts than most PBMs are currently willing to offer.

The second is a recent change in the law included in the Consolidated Appropriation Act of 2026 (“CAA, 2026”), which was enacted on February 3, 2026. These changes impact both large plans (i.e., plans sponsored by employers with at least 100 participants or by employers with at least 100 employees) and small self-funded and fully insured ERISA plans, as well as carriers or issuers of group health plans subject to ERISA, the Internal Revenue Code (the “Code”), or the Public Health Service Act (“PHSA”).

The Proposed Rule and CAA, 2026, including their respective effective dates, are described in more detail below.

Proposed DOL Rules

On January 30, 2026, the DOL released proposed regulations governing PBMs which would require PBMs and certain PBM-affiliated brokers and consultants who enter into contracts with self-funded, ERISA-covered group health plans to provide PBM services either directly or through affiliates, agents, or subcontractors (collectively     “covered service providers”) where they expect to receive $1,000 or more in direct or indirect compensation, to provide initial and semi-annual disclosures to the responsible plan fiduciaries of those plans. Similar to the broker compensation disclosure requirements under the CAA, 2021, these proposed rules are aimed at ensuring compensation for PBMs is reasonable for purposes of ERISA’s prohibited transaction rules. If finalized, self-funded ERISA plans, PBMs, and covered service providers will be required to comply with these requirements to avoid violating ERISAs prohibited transaction requirements. Fully insured plans are exempt from these requirements.

“PBM services” provided by a covered service provider under the proposed rule include certain services that are provided either through a carved out PBM relationship or those that are provided directly through a self-funded medical plan and include providers of advice, recommendations, or referrals regarding PBM services who are themselves providers of PBM services or their affiliates, agents, or subcontractors. The proposed rule includes examples of types of PBM services that would qualify under the proposed rule, including, but not limited to, acting as a negotiator or aggregator of rebates, fees, discounts, and other price concessions for prescription drugs, establishing or maintaining prescription drug formularies, establishing or maintaining pharmacy networks through a variety of pharmacy types to provide prescription drugs (retail, mail, specialty, nursing home, long term care, and infusion), processing and paying prescription drug claims, performing utilization review and management and related activities, adjudicating prescription drug appeals or grievances, recordkeeping for prescription drug plan benefits.

Initial disclosures would be required in advance of entering into, renewing, or extending a contract and must include total quarterly compensation and quarterly compensation on a per-prescription drug basis, as well as:

• A description of the PBM services that will be provided;
• Any direct compensation reasonably expected to be received from the self-funded group health plan;
• Any compensation reasonably expected to be received by the PBM from other arrangements, including the following received by any covered service provider:
  • Payments from drug manufacturers, including the amounts retained by the covered service provider and any that the covered service provider will pass on to the plan;
  • Spread compensation (i.e., the compensation received by the covered service provider when the difference between the price the covered service provider pays to the pharmacy is less than the amount the covered service provider charged to the plan for a prescription drug), for each pharmacy channel (retail, mail, and specialty pharmacy);
  • Copay claw-backs (i.e., compensation the covered service provider receives when recouping the difference between what a plan participant pays (such as copay or coinsurance) to a pharmacy and the pharmacy reimbursement recouped by the covered service provider), including the total number of transactions;
  • Price protection arrangements (i.e., agreements between a drug manufacturer and covered service provider that protects the covered service provider from increased drug manufacturer costs), including the amount retained and the amount passed on to the plan;
  • Termination compensation (i.e., the amount a covered service provider reasonably expects to receive in connection with terminating the service contract or arrangement with the plan, and how any prepaid amounts will be calculated and refunded post-termination);
  • Other compensation (i.e., any other compensation that the covered service provider reasonably expects to receive in connection with the service contract/arrangement), including the identity of the payer of the compensation, the services that will be received for such compensation, and a description of the arrangement between the payer of the compensation and the covered service provider for which the compensation will be paid; and
  • Formulary placement incentives (i.e., the amount reasonably expected to be received by the covered service provider from a drug manufacturer in connection with the service contract or arrangement), including (a) an explanation of how the incentives affect services to, and are aligned with the interests of, the plan/plan participants or beneficiaries (e.g., incentive or arrangements are to control prescription drug costs, provide clinically superior drugs, or both), (b) an identification of any reasonably available therapeutically equivalent alternatives, and the reason for omitting the alternatives from the formulary, for any prescription drug that the covered service provider will receive payment that is not passed through to the plan; and (c) where the service contract/arrangement allows the covered service provider to add, delete, change tiers, etc. for any prescription drugs during the term of the contract/arrangement, the disclosure must explain the reasons for retaining such authority, the expected frequency of any changes, and that the plan fiduciary will be notified reasonably in advance of such changes that are reasonably expected to have a material impact (i.e., an amount that is 5% or more unless a lower amount is agreed to in writing) on the reasonableness of compensation under the service contract/arrangement. The plan must have the right to terminate the service contract or arrangement on reasonably short notice under the circumstances.
• A description of the drug pricing methodology (i.e., net costs to the covered plan of each drug on the formulary, for each pharmacy channel, expressed in a dollar amount). If a monetary amount is not ascertainable, then a methodology for ascertaining the amount must be disclosed, as well as an objective means to determine the accuracy;
• A statement of fiduciary status (if applicable, a statement that the covered service provider, an affiliate, an agent, or a subcontractor will provide, or reasonably expects to provide, services pursuant to the service contract or arrangement directly to the covered plan as a fiduciary), including a disclosure of any activity or policy that may create a conflict of interest, including, for example, if such entity will benefit financially from drug substitution, from incentivizing use of affiliated pharmacies when other network pharmacies offer lower costs, or from step therapy or “fail first” protocols that require participants and beneficiaries to use drugs that generate greater manufacturer rebates than other therapeutically equivalent drugs on the formulary;
• A statement of audit right (i.e., a statement that the plan fiduciary has a right to an audit), as well as a description of the procedures the plan fiduciary must follow to request an audit.

The proposed rule requires the disclosures below to be made semiannually, no later than 30 calendar days after the end of each six (6) month period beginning on the date the service contract or arrangement is entered/renewed/extended, to help facilitate monitoring of the PBM services and relationship to meet a plan fiduciary’s obligations under ERISA:

• Direct compensation;
• Manufacturer payments;
• Spread compensation;
• Copay claw-backs;
• Price protection agreements;
• Other compensation

The semiannual disclosure must also include, (1) a description and amount of any overage it received (i.e., if any category of compensation described above in the aggregate, materially exceeds (i.e., exceeds by 5% or more unless a lower amount is agreed to in the service contract/arrangement) the corresponding quarterly estimate in the initial disclosure), and (2) a statement of audit right.

Plan fiduciaries must have the right to: (1) make a written request to the covered service provider for additional information to help it meet its fiduciary obligations, and (2)     audit these covered service provider disclosures at least once per year upon written request by the plan using an auditor of the plan’s choice (without limitations imposed by the covered service provider on the period, location, or number of records to be permitted by the audit, though the scope of the audit may be limited to the period covered by the disclosures).

Auditor costs are at the plan’s expense, but the covered service provider is responsible for any expenses related to providing the requested information to the auditor.  The covered service provider must confirm receipt of the audit request no longer than ten (10) business days after the request is made and provide the requested information within a commercially reasonable period of time.

All disclosures made must be clear, concise, free of misrepresentations, and contact sufficient specificity. Moreover, the descriptions of compensation must be in actual dollar amounts and can be estimated to the extent that the actual amount is not reasonably ascertainable but shall contain sufficient information and specificity to permit evaluation of the reasonableness of the compensation received by the covered service provider. If a plan fiduciary of the covered plan requests the information in a machine-readable format, the covered service provider must provide the information in such format within a reasonable period of time.

Covered service providers cannot impose restrictions on the covered plan’s use of these required disclosures, or the contract or arrangement, except that the covered contract or arrangement may require the responsible plan fiduciary to require third parties to whom it rediscloses such information to execute reasonable confidentiality agreements preventing redisclosure by such parties.

The proposed regulations provide that any service contract or arrangement will be determined to be reasonable even if an error or omission is made as long as the covered service provider acts in good faith and with reasonable diligence when making the disclosure and the covered service provider discloses the correct information to the responsible plan fiduciary as soon as practicable, but not later than 30 calendar days from the date on which the covered service provider knows of such error or omission.

Plan fiduciaries are responsible for ensuring these requirements are met; however, there is an exemption for any plan fiduciary that did not know the covered service provider failed/would fail to meet the applicable disclosure requirements and reasonably believe they had been met, upon discovering that one or more of the requirements were not met requests in writing that the covered service provider correct the applicable failure, and if the covered service provider fails to comply within 90 calendar days of the request, the plan fiduciary notifies the DOL of the failure by providing:

• The name of the covered plan;
• The plan number used for the annual report on the covered plan;
• The plan sponsor’s name, address, and employer identification number;
• The name, address, and telephone number of the responsible plan fiduciary;
• The name, address, phone number, and, if known, employer identification number of the covered service provider;
• A description of the services provided to the covered plan;
• A description of the covered service provider’s failure;
• The date on which the corrective action described in paragraph (n)(1)(ii) of this section was requested in writing from the covered service provider; and
• A statement as to whether the covered service provider continues to provide services to the plan.

Notice must be submitted to the DOL within 30 calendar days following the earlier of:

• The covered service provider’s refusal to correct the failure identified in the written request; or
• 90 calendar days after the written request is made.

If the covered service provider fails to comply with the written request within 90 calendar days of the request, the responsible plan fiduciary also must determine whether to terminate or continue the service contract or arrangement consistent with its ERISA duty of prudence.

If finalized, the proposed rules were intended to be effective for plan years beginning on or after July 1, 2026. We anticipate the DOL will revise the proposed regulations to be consistent with the new PBM reforms contained in the CAA, 2026 described below.     Final regulations have not been released at the time of this client alert.  Therefore, final regulations will not be effective by July 1, 2026.

CAA, 2026

The CAA, 2026 includes a change to the CAA, 2021 broker compensation disclosure requirements that is already effective (effective as of February 3, 2026) and several changes in the law that will impact PBM contracts for plan years beginning on or after 30 months from the date of the CAA, 2026’s enactment (which is August 3, 2028, or January 1, 2029 for calendar year plans).

Specifically, the law creates the following new requirements:

Broker Compensation Disclosure (CAA, 2021) Changes

Effective February 3, 2026, the CAA, 2026 modified the definition of “covered service provider” under the CAA, 2021, which, in turn, expands the scope of entities/vendors who are now required to comply with compensation disclosures to group health plans subject to ERISA. Specifically, any vendor or entity (including their affiliates or subcontractors) that performs certain activities on behalf of a group health plan that receives or reasonably expects to receive direct or indirect compensation in connection with those services to the plan that is $1,000 or more, (i.e., not just brokers or consultants) 
are required to complete and provide compensation disclosures to ERISA-covered group health plans.  The activities include:

• Recordkeeping services
• Medical management vendor
• Benefits administration
• Stop-loss insurance
• Pharmacy benefit management services
• Wellness services
• Transparency tools and vendors
• Group purchasing organization
• Preferred vendor panels
• Disease management vendors and products
• Compliance services,
• Employee assistance programs, or
• Third party administration services.

Thus, almost all vendors or service providers (including their affiliates and subcontractors) that perform services on behalf of an ERISA-covered group health plan, including medical, dental, and vision plans, health reimbursement arrangements, individual coverage health reimbursement arrangements (“ICHRAs”), health flexible spending accounts, and certain wellness programs, will be required to make disclosures to the plans they serve if they expect to receive $1,000 or more in direct or indirect compensation on behalf of that plan.

PBM Changes

1. PBM service contracts entered into, renewed, or extended with group health plans subject to ERISA must include a full pass-through of any drug manufacturer rebates. Bona fide service fees that are a flat dollar amount, consistent with fair market value, related to services actually performed by the PBM service provider, and transparent and quantifiable to plans and issuers are permitted; and
2. PBM service provider must provide at least semiannual (quarterly if requested by the group health plan) reporting of drug-level information for large ERISA plans (those with 100 or more participants) or large employers (those with 100 or more employees) (collectively, “Large Plans”). This requirement is similar to the DOL proposed rule discussed above though this requirement is broader as it includes both self-funded and fully insured large plans/large employers. We are awaiting guidance from the DOL regarding how the requirements will interact.
3. PBM service providers must provide plan level reporting for plans of all sizes – large group health plans and smaller group health plans subject to ERISA – as well as to issuers or carriers of plans subject to ERISA, the Code, and the PHSA (“issuers or carriers”).
4. The same plans and issuers/carriers in number three (3) above must also provide aggregated reporting to participants and beneficiaries upon request, as well as written notice of the availability of this data to them.

PBM service contracts entered into, renewed, or extended on or after August 3, 2028 (January 1, 2029 for calendar year plans) must not limit or delay the disclosure of any of the information required to be reported.

There are significant penalties for noncompliance which may be imposed against a plan administrator, carrier, PBM or any other applicable entity for failure to comply with the above new requirements, including a $10,000 per day penalty for late reporting and up to $100,000 for knowingly providing false information.

The law includes an “Innocent Plan Fiduciary” exception for responsible plan fiduciaries who (1) did not know the PBM service provider failed or would fail to make the required pass through amounts, (2) upon discovering the failure, requests in writing that the PBM service provider remits the required amount, and (3) notifies the DOL if the PBM service provider fails to remit the payment within 90 days of the written request from the plan.

PBM Reporting for Large Plans

PBM reporting to Large Plans must include detailed drug-level reporting (i.e., for each drug for which a claim was filed), including, but not limited to:

1. The amount of compensation received by the PBM from the Large Plan for the drug;
2. The amount the PBM paid the pharmacy on behalf of the Large Plan for the drug;
3. Spread pricing (i.e., the difference between the compensation received by the PBM from the Large Plan and the amount it paid to pharmacies on behalf of the Large Plan);
4. Total amount received, or expected to be received for rebates, fees, alternative discounts, and other remuneration; 
5. To the extent feasible, information on the total amount of remuneration for drugs, including copayment assistance dollars paid, copayment cards applied, or other discounts provided by each drug manufacturer (or entity administering copayment assistance on behalf of such drug manufacturer), to the participants and beneficiaries enrolled in such plan or coverage;
6. The gross and net spend (per therapeutic class), before rebates, price concessions, alternative discounts, or other remuneration, as well as the total amount of total amount received, or expected to be received, by the PBM covered service provider from applicable entities, in rebates, fees, alternative discounts, or other remuneration from such; 
7. PBM benefit structures for PBM affiliated entities; and
8. Referral fees for brokers and consultants. 

Note the drug-specific reporting requirements are very detailed and will be discussed in greater detail in a future alert as guidance from the DOL is released and/or the compliance date approaches.

PBM Reporting Plans of All Sizes

PBMs must also provide plan-level reporting to Large Plans, smaller plans, and to issuers or carriers, which includes certain, specified information on drug pricing, plan and PBM spending on drugs, and participant and beneficiary claims. PBMs cannot limit the ability of the plans to provide the PBM reports to their Business Associates, though the PBM may place reasonable limits on the plans’ ability to publicly disclose the information. Limited exceptions apply.

Large Plans, smaller plans, and issuers or carriers must also receive reports from the PBM that they can make available to participants and beneficiaries upon request. These reports are comprised of aggregate information regarding plan claims, spending on drugs, and rebates or remuneration. It must also include a statement that participants and beneficiaries may request their own claims-level information. 

In addition, each plan year, group health plans and issuers or carriers, must provide each participant or beneficiary written notice informing the participant or beneficiary of the PBM reporting requirements, including their right to request certain reports. Notice can be included in any plan documents provided to participants and beneficiaries, such as a summary plan description.

Rebate Pass Through Requirements

The CAA, 2026 requires all contracts entered into, renewed, or extended for plan years on or after August 3, 2028 (or January 1, 2029 for calendar year plans) to mandate 100% pass through of any rebates, alternative discounts, fees, and other remuneration (“Rebates”) received from any applicable entity that are related to utilization of drugs or drug spending under the plan or coverage, to the group health plan issuer. This includes contracts directly between a group health plan and a PBM service provider or those entered by an issuer or carrier on behalf of a group health plan. Failure to comply with this may result in prohibited transactions under ERISA.

Rebates must be remitted to the plan or issuer no later than 90 days after the end of each quarter. Rebate aggregators or group purchasing organizations must provide this data to PBM no later than 45 days after the end of each quarter so that it can timely be reported by the PBM to the plans and issuers within the 90-day period.

“Applicable Entity” is defined to include a group purchasing organization, drug manufacturer, distributor, wholesaler, rebate aggregator (or other purchasing entity designed to aggregate rebates), or associated third party, a PBM, a group health plan, a health insurance issuer, or a PBM who provides pharmacy benefit management services on behalf of the plan or issuer. 

Further, PBM service providers are required to allow group health plans and issuers or carriers, at their own expense, to annually audit the PBM service provider’s Rebate contracts using an auditor of the plans or issuers choice.

Next Steps for Employers

For purposes of PBM-specific disclosures, there is no immediate action that needs to be taken by employers until we have finalized DOL rules (if the plan is a self-funded ERISA plan) or more guidance on the CAA, 2026 from the DOL, IRS, and HHS for all other plans. 

Employers entering into multi-year contracts with PBMs that extend into the 2028 plan year (for plans renewing after August 3, 2028) or the 2029 plan year (for calendar year plans) should ensure the contract includes a provision that mandates the contract be amended to comply with applicable changes in the law prior to the effective date of any new requirements, where possible. They may choose to specifically reference the CAA, 2026 in the contract. We would also recommend employers set a deadline for the PBM to share a draft of the updates to them for review that is well in advance of the effective date of the law. Not updating the contract prior to the effective date of the change could put the plan out of compliance.

Many administrative services only (ASO) contracts include express limits on auditing by employers. Thus, sponsors of self-funded ERISA plans should be in communication with their PBMs to update auditing rights in the ASO contract once final DOL rules are implemented. They should also ensure the contract includes an obligation that the PBM comply with any and all applicable reporting obligations in a timely fashion.

For any sponsor of an ERISA-covered group health plan with a contract or services agreement that is executed, extended, or renewed after February 3, 2026, the plan sponsor should expect to receive compensation disclosures from the contracted service provider reasonably in advance of the contract being executed, extended, or renewed (if the service provider reasonably expects to receive $1,000 or more for its services to the group health plan). If the sponsor does not receive the disclosure, they should request a copy from their service providers in writing. If one is not provided within 90 days, then they must report the failure to the DOL within 30 days. 

About the Author. This alert was prepared for Alera Group by Barrow Lent LLP, a national law firm with recognized experts on ERISA and the Affordable Care Act.  Contact Stacy Barrow or Nicole Quinn-Gato at sbarrow@marbarlaw.com or nquinngato@marbarlaw.com.

The information provided in this alert is not, is not intended to be, and shall not be construed to be, either the provision of legal advice or an offer to provide legal services, nor does it necessarily reflect the opinions of the agency, our lawyers, or our clients. This is not legal advice. No client-lawyer relationship between you and our lawyers is or may be created by your use of this information. Rather, the content is intended as a general overview of the subject matter covered. This agency and Barrow Lent LLP are not obligated to provide updates on the information presented herein. Those reading this alert are encouraged to seek direct counsel on legal questions. 

© 2026 Barrow Lent LLP. All Rights Reserved.