Consolidated Appropriations Act of 2026: The New Landscape of PBM Fiduciary Oversight

The Consolidated Appropriations Act of 2026 (CAA 2026), signed into law on February 3, 2026, includes provisions that reform how group health plans contract with pharmacy benefit managers (PBMs). The legislation is designed to enhance transparency, strengthen fiduciary oversight, and ensure plan fiduciaries have the information needed to assess PBM compensation and practices.

Key developments include:

• PBMs treated as “covered service providers” for purposes of the Employee Retirement Income Securities Act of 1974, as amended (ERISA) Section 408(b)(2) subject to compensation disclosure requirements
• Required 100% rebate and remuneration pass through to ERISA plans, with limited exceptions for bona fide service fees
• Mandatory semiannual reporting of detailed drug pricing, spread pricing, rebate, and compensation data to group health plans
• Civil penalties for noncompliance
• A limited “innocent fiduciary” exception for plan fiduciaries under specified conditions

The rebate, reporting, and innocent fiduciary exception provisions apply to contracts entered into or renewed for plan years beginning on or after August 3, 2028 or January 1, 2029 for calendar year plans. However, the changes to the definition of a “covered service provider” under ERISA Section 408(b)(2) do not contain an effective date and, absent further guidance from the US Department of Labor (DOL), are presumably effective for contracts entered into or renewed on or after February 3, 2026.

A STRUCTURAL SHIFT IN PBM OVERSIGHT

For years, employer plan sponsors have faced challenges evaluating PBM compensation models, including spread pricing and rebate retention practices. Under the CAA 2026, PBM compensation and transparency are no longer governed solely by contract negotiation but are now subject to federal statutory standards.

The reforms apply to PBMs providing services to ERISA-covered group health plans and are designed to increase fiduciary visibility into drug pricing and PBM compensation structures.

PBMS DEEMED ERISA COVERED SERVICE PROVIDERS

The CAA 2026 clarifies that PBMs providing services to ERISA-covered group health plans are considered “covered service providers” under ERISA Section 408(b)(2). As a result:

• PBMs must disclose all direct and indirect compensation.
• Compensation must be “reasonable” for the arrangement to qualify for the statutory prohibited transaction exemption.
• Failure to comply may result in prohibited transaction exposure.

This means PBMs are now required to adhere to ERISA’s service provider compensation disclosure standards.

NEW PBM REPORTING REQUIREMENTS

PBMs will be required to provide semiannually (or quarterly upon request) detailed reporting to “specified large plans” (100 or more participants) or “specified large employer” (100 or more employees during the previous calendar or plan year). The required reporting will include the following:

• Gross and net prescription drug spending
• Spread pricing data (e.g., the difference between what a plan pays and what a PBM reimburses a pharmacy)
• Rebates, fees, discounts, and remuneration associated with drugs
• Formularies and the rationale for the placement of high-cost drugs
• Information about PBM affiliates and rebate aggregators
• Summary documents suitable for participant and beneficiary disclosure upon request

The reporting must comply with applicable Health Insurance Portability and Accountability Act (HIPAA) privacy requirements. Group health plans must provide annual written notice to participants about the availability of PBM reporting information. This notice may be incorporated into plan documents provided to participants or beneficiaries or by providing individual notification.

ENFORCEMENT

The statute authorizes penalties for noncompliance, including civil penalties of up to $10,000 per day for late reporting and additional penalties of up to $100,000 for knowingly providing false information.

These enforcement provisions elevate compliance risk and increase fiduciary oversight obligations for plan sponsors.

MANDATORY 100% REBATE PASS THROUGH TO PLAN AND EXCEPTION FOR INNOCENT PLAN FIDUCIARIES

CAA 2026 requires 100% pass through of rebates and other remuneration received by PBMs (and related parties such as rebate aggregators and group purchasing organizations) to the plan on whose behalf the drugs were dispensed.

Key Points

• 100% rebate/discount pass through: All drug rebates, fees, alternative discounts, and price concessions must be forwarded to the plan, except bona fide service fees that are transparent, fixed, and consistent with fair market value.
• Quarterly remittance and reconciliation: Payments must generally be remitted quarterly, and underpayments from prior periods must be made up within specified timeframes.
• Expanded disclosures and audit: PBMs must make records of rebate arrangements available for audit by plans, and health plan sponsors may need to amend agreements to include these audit rights.
• “Innocent fiduciary” protection: The statute includes an exception that may shield a responsible plan fiduciary from fiduciary breach if (1) the fiduciary did not know the PBM failed to remit rebates, (2) reasonably believed PBM compliance would occur, (3) took steps to compel remittance in writing after discovering a failure, and (4) notifies the DOL if the PBM fails to comply with the written request within 90 days. Importantly, this exception does not eliminate general ERISA prudence and monitoring obligations. Fiduciaries must continue to exercise active oversight of PBM arrangements.

While employers historically needed to negotiate rebate pass throughs, with varying degrees of success, the CAA 2026 establishes full rebate pass through as the statutory default for ERISA plans and provides fiduciaries with a federal law basis to demand and enforce remittance.

KEY TAKEAWAYS FOR PLAN SPONSORS

• Plan sponsors currently negotiating PBM agreements, which generally are effective for a term of three years, should consider incorporating required reporting language, full rebate pass-through provisions, audit rights, and reconciliation mechanisms in agreements.
• Fiduciary committees should consider integrating new PBM reporting into compliance calendars and fiduciary oversight functions.
• Plan fiduciaries should retain all PBM disclosures and audit work papers. This will be essential for defending fiduciary decisions and, if necessary, relying on the “innocent fiduciary” relief.
• Group health plans should be prepared to provide summary PBM spend and compensation data to participants upon request.

Note that the DOL has proposed a PBM transparency rule that overlaps with the CAA 2026 but may have an earlier effective date depending on the final rulemaking. Fiduciaries will need to monitor how the DOL harmonizes its final rule with the CAA 2026.