The Consolidated Appropriations Act of 2026 (CAA 26), which was signed by the President on February 3, 2026, reshapes how pharmacy benefit managers (PBMs) will operate in the employer group health plan market. The statute creates new federal transparency, reporting, rebate remittance, and fiduciary compliance requirements across the Public Health Service Act (PHSA), ERISA, and Internal Revenue Code, thereby broadly affecting all group health plans.
The legislation aims to:
- Increase transparency into drug pricing, spreads, and rebate flows;
- Ensure that 100% of drug rebates and remuneration are passed back to plans; and
- Expand fiduciary oversight and enforcement mechanisms.
Most provisions take effect for plan years beginning 30 months after enactment (e.g., January 2029 for calendar year plans) and will apply to contracts entered into or renewed after that time. For employers and brokers, these changes may affect PBM contracting, fiduciary oversight, and compliance responsibilities well before the effective date as contracts are reviewed and renegotiated.
Overview of PBM Reporting Requirements
Contract restrictions – Applicable to all group health plans
A group health plan or carrier (or PBM acting on its behalf) may not enter into or renew a contract with an “applicable entity” (e.g., drug manufacturer, wholesaler, rebate aggregator, affiliated entity) unless that entity agrees to provide necessary information for required PBM reporting without limits or delay.
PBM Reporting – Requirements vary by group size and funding
The statute establishes PBM reporting obligations applicable to all group health plans, with additional, more detailed requirements for larger plans. PBMs must provide reports to plans semi-annually, or as often as quarterly upon plan request. The reports must be in plain language and machine-readable. All reports must comply with HIPAA privacy requirements and include only summary health information (aggregate and non-identifiable).
Failure to comply with the reporting and disclosure requirements risks potential penalties up to $10,000 per day. Knowingly providing false information risks penalties up to $100,000.
Large employers/plans
Large self-funded plans must receive detailed, drug-level (or claims-level) reporting. Large fully insured plans do not automatically receive detailed reporting, but can opt-in annually to receive the same reporting required to be provided to large self-funded plans. For this purpose, a large plan is one that is offered by an employer with 100 or more employees or a plan that has 100 or more participants.
The detailed reporting includes, among other items:
- Drug-by-drug compensation paid by the plan to the PBM, PBM compensation paid to pharmacies, and the spread between those amounts;
- Net drug prices after rebates;
- Total rebates received (by the plan and PBM);
- Participant cost-sharing;
- Formulary determinations;
- High-spend drug disclosures; and
- Affiliated pharmacy pricing comparisons.
All plans
In contrast to the detailed reporting required for large plans, all group health plans must receive:
- A plan-level summary designed to assist fiduciaries in evaluating PBM compensation and pricing structures, and
- A separate participant-facing summary containing only aggregate information that must be made available to plan participants upon request.
In addition to the participant-facing summary, plan participants may request their own claim-specific information. Employers will likely rely on their PBM or TPA to supply the necessary data for such requests and should ensure service agreements clearly address responsibility and response timelines.
Group health plans must provide an annual notice to participants regarding PBM reporting obligations and plan participants’ right to request the summary reports and claim-specific information.
Rebate Pass-Through Requirements – ERISA Plans
A contract is not reasonable for purposes of compliance with the fee disclosure requirements outlined in ERISA §408(b)(2) unless 100% of rebates, fees, alternative discounts, and other remuneration tied to drug utilization are remitted to the group health plan (or carrier on behalf of the plan) on a quarterly basis, no later than 90 days after the end of each quarter. Whether the plan may retain the rebate or must share the rebates with plan participants may depend upon plan documentation, level of participant contributions, etc.
The statute also provides the plan with audit rights regarding rebates at least once per plan year, with the auditor selected by the plan fiduciary and not paid, directly or indirectly, by the PBM.
Expanded Compensation Disclosures – ERISA Plans
The Consolidated Appropriations Act of 2021 (CAA) included a requirement that brokers and consultants supplying services to ERISA-covered group health plans provide disclosures to plan fiduciaries where the broker or consultant reasonably expects to receive at least $1,000 in direct or indirect compensation. The disclosure is required to be made “reasonably in advance” of entering into a contract for services and must describe the services to be provided, indicate whether the service provider expects to be a plan fiduciary, and describe all forms of direct and indirect compensation the service provider expects to receive in connection with the arrangement, including the manner in which compensation will be received.
These disclosure requirements have now been clarified/expanded to include PBMs, TPAs, stop-loss insurers, and most other group health plan service providers. The statute does not provide a separate delayed effective date for this provision, so it could be interpreted to apply upon enactment to new or renewed service arrangements entered on a go-forward basis.
Plan fiduciaries must obtain these disclosures, evaluate whether compensation is reasonable, document their assessment, and monitor compliance on an ongoing basis. Failure to request or review required disclosures may create fiduciary risk.
Summary
CAA 26 does not simply increase transparency, it meaningfully shifts leverage to plan sponsors while simultaneously increasing fiduciary accountability. Though the actual reporting obligations noted here fall on PBMs, employers and brokers will need to balance new access to data with heightened expectations around oversight, documentation, and vendor management.
The statute directs the Secretary to issue regulations specifying a standard reporting format and other implementing guidance within 18 months of enactment. We expect to be able to provide further clarification on reporting templates, coordination with existing transparency rules, operational mechanics, and the employer notice requirement once that guidance becomes available.
Note on Recent Proposed Regulations
On January 30, the Department of Labor (DOL) issued proposed PBM compensation disclosure rules. The rules are modeled on the ERISA broker compensation disclosure requirements but are much more detailed and would require extensive compensation reporting and new audit rights for covered plans. These rules would apply only to self-funded ERISA plans and were slated to take effect for plan years beginning after July 2026.
There are some significant differences in the proposed rules and the CAA 26 legislation, and it's unclear what the DOL will do with its proposed rules following the passage of CAA 26. The DOL could withdraw or pause its proposed rules, proceed with the ERISA-based requirements on a faster timeline, or re-issue revised regulations that align more closely with the statute. Until the DOL clarifies its approach, employers, brokers, and PBMs face uncertainty regarding the scope and timing of future compliance obligations.
© 2026 Lumelight. All rights reserved.
Content provided to Q4intelligence members by Lumelight
Photo by ArcursPI/peopleimages.com