Federal Funding Bill Adds New PBM Transparency Requirements

On February 3, 2026, the Consolidated Appropriations Act of 2026 (“CAA-26”) was signed into law. While this legislation is primarily a funding bill for various departments of the United States government, it includes significant reforms impacting group health plans, both insured and self-insured, that provide pharmacy benefits.

Specific to group health plans, the legislation:

• Creates new pharmacy benefit manager (“PBM”) transparency, reporting, and disclosure requirements.
• Requires full pass-through of rebates and other renumeration.
• Expands entities required to furnish ERISA Sec. 408(b)(2) compensation disclosures to include PBMs and third-party administrators (“TPAs”).

The legislation is significant and will require rulemaking and other guidance for implementation. The Departments of the Treasury, Labor, and Health and Human Services will be responsible for enforcement and are directed to issue guidance within 18 months of enactment (by August 3, 2027).

Generally, unless otherwise noted, compliance with these requirements is effective for plan years beginning on or after August 3, 2028.

Note: Before this legislation was enacted, the Department of Labor (“DOL”) issued a proposed rule requiring additional transparency of PBMs. This rule is currently in a comment period. It is unclear how the two will interact or whether the DOL will revisit this proposed rule in light of changes under CAA-26. Further guidance will be needed.

PBM transparency and reporting

Reporting

PBMs must provide specific reporting to self-insured large employer plans (employers who employed an average of at least 100 employees on business days during the preceding calendar year or plan year) every 6 months (or quarterly, if requested). Reports must be made available in plain language and in a machine-readable format. The reports must include very specific information on prescription drug benefits, including such things as:

• Drug-level claims data
• Pricing information (e.g., amount paid by the plan to PBM, amount PBM paid to pharmacies, spread pricing amounts, dispensing channel)
• Rebates, fees, and other renumeration, such as manufacturer rebates, administrative fees, prices concessions/discounts
• High-cost drug information
• Information on PBM affiliated pharmacies (percentage of prescriptions fulfilled by affiliates, steering practices and financial impact)

Fully insured large employer plans may opt-in to receive this detailed reporting on an annual basis.

In addition, all group health plans (regardless of size) will receive aggregated, high level summary information from the PBM. Briefly, it includes:

• Total prescription drug spending
• Rebates and prices concessions
• Overview of high-cost drugs
• Participant cost-sharing information
• PBM affiliate and network information

PBMs will also furnish plans and carriers a summary document for distribution to participants and beneficiaries upon their request.

Lastly, the statute requires a group health plan to furnish participants and beneficiaries with a written notice each plan year concerning the PBMs’ requirement to submit these reports to group health plans.

Information that is provided by the PBM shall be done in a manner consistent with HIPAA Privacy and Security rules, including providing only summary health information.

Access to data

Under the legislation, a group health plan or an entity providing PBM services on behalf of such a plan cannot enter into a contract (including an extension or renewal) with an applicable entity unless the applicable entity agrees to:

• Not limit or delay the disclosure of information to the group health plan in a manner that would prevent the PBM from providing the required reporting (as described above); and
• Provide the PBM that is providing services on behalf of the group health plan the relevant information necessary to make the required reporting.

Generally, an “applicable entity” includes group purchasing organization, drug manufacturer, distributor, wholesaler, rebate aggregator (or other purchasing entity designed to aggregate rebates), or associated third party; a subsidiary, affiliate or subcontractor of the group health plan, carrier or PBM; or any other entity as designated by future regulations.

Enforcement

The statute includes significant penalties for non-compliance:

• $10,000/day for each day a plan administrator, carrier or entity providing PBM services on behalf of a group health plan does not comply with these requirements.
• Up to $100,000 may be imposed against a plan administrator or entity providing PBM services on behalf of a group health when they knowingly provide false information.

Penalties may be waived, or the period of time for compliance may be extended, for a particular requirement if the entity in violation has made a good-faith effort to comply.

Full rebate pass through and audit rights

For plans subject to ERISA, contracts or arrangements (or extensions or renewals) with PBMs and other entities must pass through 100% of rebates, fees, alternative discounts and other renumeration. These amounts must be remitted on a quarterly basis to the group health plan (or to the carrier in an insured arrangement) and no later than 90 days after the end of each quarter. Amounts should be fully disclosed and outlined to the health plan or insurance carrier.

The records of rebates, fees, alternative discounts, and other renumeration shall be made available for audit by the plan at least annually.

If the PBM fails to remit required payments to the plan, there is relief to protect responsible plan fiduciaries who are acting in good faith from penalties when:

• The plan fiduciary did not know that the covered service provider failed or would fail to make required remittances and reasonably believed that the covered service provider remitted such required amounts.
• Upon discovering the failure, the fiduciary requests in writing that the covered service provider remit such amounts.
• If the covered service provider fails to comply with this written request, the plan fiduciary notifies the DOL within 90 days of the service provider’s failure.

ERISA Sec. 408(b)(2) Compensation disclosures

The CAA-26 amends ERISA’s compensation disclosure rules to make PBMs and TPAs directly subject to these disclosure requirements. Specifically, TPAs and PBMs are considered “covered service providers” under ERISA 408(b)(2) and will be required to disclose direct and indirect compensation to the ERISA group health plan fiduciary.

Note. The statute did not include an effective date for this provision; therefore, it may be viewed as being effective immediately. This means PBMs and TPAs should furnish the ERISA Sec. 408(b)(2) disclosure in connection with upcoming renewals or extension (or when entering into new contracts).

Employer Action

These changes pose a significant shift in access to information from PBMs and will be helpful to employers in managing their health plans and fiduciary compliance. However, implementation will be a lengthy process as many of these changes will happen for plan years beginning on or after August 3, 2028. We will most likely receive guidance from the regulators well before the effective date to assist in the implementation process.

For now, plan sponsors of ERISA covered group health plans should begin obtaining ERISA 408(b)(2) compensation disclosures for PBMs and TPAs in connection with their next renewal. Otherwise, plan sponsors should await further guidance as these new changes begin to take effect. We anticipate that PBMs, TPAs, and carriers will also communicate their intended efforts to comply with this new law.