Federal Funding Bill Introduces Major PBM Transparency Requirements for Group Health Plans

The Consolidated Appropriations Act of 2026 (CAA-26), signed into law on February 3, 2026, goes beyond federal funding—it delivers sweeping changes to how pharmacy benefit managers (PBMs) operate within group health plans. These new provisions are designed to increase transparency, strengthen fiduciary oversight, and improve cost accountability for employers and plan sponsors.

Key Takeaways from the New PBM Rules

Under CAA-26, group health plans—both fully insured and self-funded—will face updated compliance standards related to pharmacy benefit oversight. The law introduces:

  • Enhanced PBM transparency and reporting obligations

  • Mandatory full pass-through of rebates and compensation

  • Expanded ERISA compensation disclosure requirements for PBMs and TPAs

Federal agencies, including the Departments of Treasury, Labor, and Health and Human Services, are tasked with issuing implementation guidance by August 3, 2027, with most provisions taking effect for plan years beginning on or after August 3, 2028.

PBM Reporting and Transparency Requirements

Detailed Reporting for Large Employer Plans

PBMs must now deliver comprehensive reports to self-funded large employer plans (100+ employees) at least twice per year, or quarterly upon request. These reports must be:

  • Written in clear, understandable language

  • Delivered in a machine-readable format

Required data includes:

  • Drug-specific claims and utilization

  • Pricing breakdowns (plan payments vs. pharmacy reimbursements)

  • Spread pricing details

  • Manufacturer rebates and administrative fees

  • High-cost medication insights

  • Data on affiliated pharmacies and steering practices

Fully insured large plans may opt in to receive similar reports annually.

Summary Data for All Plans

Regardless of size, all group health plans will receive high-level summaries covering:

  • Total prescription drug spending

  • Rebates and discounts

  • High-cost drug trends

  • Member cost-sharing

  • PBM network and affiliate relationships

Participants and beneficiaries can also request simplified summaries explaining these reports.

Additionally, plans must notify members annually about the availability of PBM reporting.

Data Access and Contracting Requirements

The law places strict conditions on contracts between group health plans and third-party entities. Plans cannot enter agreements unless those entities agree to:

  • Provide necessary data for PBM reporting

  • Avoid restricting or delaying access to required information

This applies to a wide range of stakeholders, including manufacturers, wholesalers, rebate aggregators, and affiliated service providers.

Penalties for Non-Compliance

CAA-26 introduces significant financial consequences for failing to meet requirements:

  • $10,000 per day for non-compliance

  • Up to $100,000 in penalties for knowingly submitting false information

However, regulators may allow flexibility for entities demonstrating a good-faith effort to comply.

Mandatory Rebate Pass-Through and Audit Rights

For ERISA-covered plans, PBMs and related vendors must:

  • Transfer 100% of rebates, fees, and discounts to the plan

  • Issue payments quarterly, within 90 days after each quarter ends

  • Provide full transparency into all compensation

Plans also gain the right to audit these financial records annually, ensuring accountability and reducing hidden revenue streams.

Fiduciary Protection Measures

Plan fiduciaries are protected from penalties if they:

  1. Were unaware of missing payments

  2. Acted reasonably in assuming compliance

  3. Requested correction in writing

  4. Reported continued non-compliance to regulators within 90 days

Expanded ERISA Disclosure Rules for PBMs and TPAs

The legislation updates ERISA Section 408(b)(2) to classify PBMs and third-party administrators (TPAs) as covered service providers. This means they must disclose:

  • Direct compensation

  • Indirect compensation

  • Potential conflicts of interest

Since no delayed effective date was specified, this requirement may already apply to new contracts, renewals, and extensions.

What Employers Should Do Now

While many provisions won’t take effect until 2028, employers should begin preparing now:

  • Request ERISA 408(b)(2) disclosures from PBMs and TPAs during upcoming renewals

  • Review current PBM contracts for transparency gaps

  • Monitor upcoming regulatory guidance for implementation details

These changes represent a major shift in how pharmacy benefits are managed, giving employers greater visibility into costs and improving their ability to meet fiduciary responsibilities.

Final Thoughts

The PBM reforms under CAA-26 mark a significant step toward pricing transparency and accountability in prescription drug benefits. Although full implementation will take time, employers that act early will be better positioned to control costs, ensure compliance, and optimize their health plan strategies.

Mark C