Employers that sponsor health plans will face a new layer of compliance risk under the Consolidated Appropriations Act of 2026, which imposes sweeping transparency and reporting rules on pharmacy benefit managers (PBMs).

The law aims to open up the “black box” of prescription drug pricing, but it also puts both self-insured and fully insured employers closer to the compliance line, with potential civil monetary penalties that can reach $10,000 per day for reporting failures and $100,000 per violation for knowingly providing false information.

At the core of the law are three major requirements that directly affect how employer health plans interact with PBMs:

• Full rebate pass-through: PBMs must pass 100% of rebates, discounts and other compensation back to the health plan.
• Detailed reporting: PBMs must provide semiannual reports outlining drug spending, utilization and compensation structures.
• Audit rights: Plan sponsors have the statutory right to audit PBM records at least annually.

These provisions are designed to give employers clearer insight into prescription drug costs, but they also create new fiduciary responsibilities.

How this affects employers

Self-insured employers, which contract directly with PBMs, will feel the most immediate impact. They must ensure they receive required reports, review them and make summary information available to plan participants. They must also document compliance efforts.

Employers that purchase fully insured plans are not off the hook. While carriers and PBMs handle much of the administration, the law still applies to the plan sponsor in certain cases, particularly around participant disclosures and ensuring compliance upstream.

The law does not clearly assign liability for penalties in all situations. As a result, PBMs and insurers may attempt to shift risk to employers through contract language.

Specifically, some PBM agreements may include indemnification provisions that require the employer to cover penalties — even if the PBM failed to meet its reporting obligations.

New risks

Employers should pay close attention to several emerging risks:

• Contractual liability: PBMs may try to transfer penalty exposure to plan sponsors.
• Reporting gaps: Failure to obtain or share required data could trigger fines.
• Notice requirements: Employers must inform plan members about available prescription drug data.
• Fiduciary exposure: Plan sponsors must act prudently in overseeing PBM arrangements.

Employers may avoid penalties if they can demonstrate a “good faith effort” to comply. That makes documentation critical.

What employers should do now

With most provisions taking effect in 2029 for calendar-year plans, employers have time to prepare:

• Review PBM contracts and renegotiate any indemnification clauses that shift compliance risk.
• Establish a compliance process to retain PBM reports and allow employees to request copies.
• Keep records of communications and efforts to obtain required data.
• Ensure summary benefit information and required notices include information on the new law.
• Work with us to better understand compliance issues.
• Notify participants about their right to access PBM plan-level summary data. We can help you integrate this into your next open enrollment or summary plan documents update.

Why this matters

The new PBM mandates are intended to reduce drug costs and improve transparency, but they also introduce a compliance burden that many employers are not equipped to handle alone.

Employers should not assume their PBM or insurance carrier is managing all aspects of compliance. Ultimately, plan sponsors bear fiduciary responsibility for their health plans.

That makes it critical to work closely with a knowledgeable benefits advisor like us who can help review contracts, interpret reporting requirements and ensure that your plan remains compliant as these rules take effect.

While drugmakers have been assailed for years for increasing their prices and driving the cost of medications higher and higher, there is another player in the health care space that is receiving increased scrutiny: pharmacy benefit managers.

PBMs are intermediaries, acting as go-betweens for insurance companies, self-insured employers, drug manufacturers and pharmacies.

They can handle prescription claims administration for insurers and employers, facilitate mail-order drug delivery, market drugs to pharmacies, and manage formularies (lists of drugs for which health plans will reimburse patients.) 

Express Scripts, which provides network-pharmacy claims processing, drug utilization review, and formulary management, among other services, is the best-known PBM. CVS Caremark and UnitedHealth Group’s OptumRx are other major players. 

PBMs typically contract with both insurers (or self-insured employers) and pharmacies. They charge health plans fees for administering their prescription drug claims and create formularies that spell out the prices pharmacies receive for each drug on the list.

Commonly, the price the plan pays for a drug is more than the pharmacy receives for it. The PBM collects the difference between the two prices. 

It can do this because the health plan does not know what the PBM’s arrangement is with the pharmacy, and vice versa. Also, the plan doesn’t know the details of the PBM’s arrangements with its competitors. 

A PBM could charge one plan $200 for a month’s supply of an antidepressant, charge another plan $190 for the same drug, and sell it to a pharmacy for $170. None of the three parties knows what the other parties are paying or receiving.

Additionally, PBMs have been accused of pocketing the rebates that drug manufacturers offer, instead of passing them on to the end users: the patients who are prescribed the medications. Those rebates can be significant.

In the crosshairs

In theory, the PBMs should pass these rebates back to the individuals who are prescribed the medication so that they can reduce their out-of-pocket costs. However, if most of those costs are born by the insurer, those rebates would conceivably be transferred to the insurer that is paying for the drugs and the insurer could pass some of those savings on to enrollees.

But, because these arrangements are also confidential, the extent to which these savings are passed back to health plans is unknown.

As pressure on PBMs has grown, federal and state lawmakers, attorneys general in various states and state regulators have been taking action.

In 2022, 12 states enacted 19 measures that included a variety of restrictions and requirements for PBMs, according to the National Academy for State Health Policy.

A number of state attorneys general have filed lawsuits against some of the country’s largest PBMs. Ohio Attorney General David Yost has managed to wring more than $100 million in settlements with PBMs in the last three years, after filing lawsuits accusing them of violating state antitrust laws and overcharging state agencies like the Ohio Bureau of Workers’ Compensation and the Ohio Department of Medicaid.

And in Washington D.C., a bipartisan bill introduced in the U.S. Senate would require PBMs to file an annual report with the Federal Trade Commission about fees charged to pharmacies and reimbursements sought from drug companies.

The bill also authorizes state attorneys general “to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.”