It has been a busy week in Washington and in a move that will surprise no one who has been paying attention the federal government has officially decided that pharmacy benefit managers should operate with transparency, accountability and actual oversight.
On Tuesday the President signed the Consolidated Appropriations Act 2026 into law. Buried in the headlines is a sweeping set of PBM reforms that finally codify reporting disclosure and fiduciary expectations that ethical PBMs and fiduciary advisors have already been operating under for years. These provisions apply to plan years beginning on or after thirty months from February 3 2026 or January 1 2029 for calendar year plans.
This legislation arrives shortly after the Department of Labor released proposed regulations that would significantly expand ERISA disclosure obligations for PBMs and affiliated consultants and brokers. In other words the government is now catching up to what responsible plan fiduciaries have long known. If you manage hundreds of millions in prescription drug spend you should probably be able to explain where the money goes.
Together these changes signal a clear shift. PBM opacity is no longer treated as an industry quirk. It is now treated as a fiduciary problem.
What this actually means for employers
With prescription drug costs continuing to rise these reforms were inevitable. While no immediate action is required employers should expect meaningful changes to PBM contracting reporting cadence and governance expectations. Many of these reforms are written directly into ERISA the Public Health Service Act and the Internal Revenue Code meaning they apply broadly and not just to ERISA plans.
Once effective PBMs plans and carriers will be subject to strict disclosure standards and significant penalties for noncompliance. For fiduciary plan sponsors this reinforces something we say often at Ethos. Transparency is not optional. Oversight is not a nice to have. And fiduciary governance is not a future state. It is the job.
Executive summary through a fiduciary lens
The reforms focus on three things: transparency, access to data, and participant rights. While the law does not require immediate changes today employers should begin preparing for PBM contract restructuring enhanced reporting and formalized oversight.
Once these rules take effect PBMs will be required to provide detailed standardized reporting with real consequences for failure. For ERISA plans this elevates fiduciary responsibility and increases litigation risk for those who are unprepared or unwilling to ask hard questions.
For fiduciaries and our clients at Ethos who have already demanded full transparency pass through economics and audit rights this will feel less like disruption and more like validation.
PBM contract restrictions
PBM contracts may no longer restrict or delay disclosure of compensation fees or manufacturer and pharmacy related payments. Plans and carriers will be prohibited from entering, renewing or extending PBM contracts unless the PBM agrees to provide all data required for federal reporting.
This is essentially a stronger, louder reiteration of the existing gag clause prohibition with teeth.
From a fiduciary perspective this will require careful contract review and in many cases renegotiation. PBM compliance costs may increase and history suggests those costs will attempt to travel downhill to plan sponsors unless contracts are reviewed thoughtfully.
PBM agreements should explicitly require compliance with all applicable laws, timely responses to participant requests and cooperation with audits. This is not boilerplate. This is fiduciary risk management.
PBM reporting requirements
The law introduces two levels of reporting.
First detailed drug level reporting for large employers including large self funded plans and fully insured plans that opt in.
Second plan level summary reporting for all group health plans regardless of size.
Reports must be provided in plain language and machine readable formats and are subject to HIPAA privacy standards. Standardization is also required to limit anticompetitive behavior among vertically integrated PBMs.
In plain terms PBMs must now show their work.
Drug level reporting
For large employers PBMs must provide comprehensive drug level reports at least every six months and quarterly upon request. These reports include net plan spend, participant out of pocket costs, all compensation, rebates, spread pricing, dispensing channels, formulary design manufacturer assistance, and affiliate pharmacy relationships.
This is the level of data fiduciary advisors have been requesting and in some cases already receiving for years. The difference now is that it is mandatory and standardized.
Plan level summary reporting and participant access
PBMs must also provide plan level summaries suitable for fiduciary decision making and separate aggregate summaries that plans can share with participants upon request.
Participants will also have the right to request claim specific prescription data. This is a meaningful expansion of participant transparency and one that will require clear documented processes to avoid HIPAA issues and administrative confusion.
From a fiduciary standpoint this again reinforces the need for clear governance documentation response protocols and vendor accountability.
Enforcement and penalties
The penalties are substantial. Up to ten thousand dollars per day for failure to provide required information and one hundred thousand dollars per item for knowingly providing false information.
Good faith efforts can mitigate penalties which means documentation matters. Contracts matter. Process matters.
It is also reasonable to expect PBMs to attempt to shift penalty exposure to plan sponsors through indemnification clauses. Those provisions should be reviewed carefully and negotiated aggressively. Fiduciary responsibility cannot be outsourced but liability often tries to be.
ERISA specific PBM reforms
For ERISA plans the law goes further.
All PBM contracts must include one hundred percent pass through of rebates fees and other remuneration. Compensation disclosures are expanded to clearly define PBMs as covered service providers. Annual audit rights are required and auditors must be selected by plan fiduciaries not PBMs.
None of this is radical in nature. It is simply the application of ERISA principles to an industry that has long operated adjacent to them.
Plan fiduciaries must ensure compensation is reasonable, contracts are prudent and plan assets are used solely for participant benefit. These reforms finally align statutory requirements with that obligation.
Final thoughts
The CAA 2026 PBM reforms and the Department of Labor proposed regulations represent the most comprehensive federal oversight of PBMs to date.
For employers who have deferred oversight or relied on opaque vendor assurances this will require real change. For fiduciaries who have already demanded transparency audit rights and aligned economics this will feel familiar.
At Ethos we view this moment less as a disruption and more as a course correction for the majority of the market. The rules of fiduciary conduct did not change. They are simply being enforced where they always should have applied.
It took Washington a while to get here but better late than never. At the end of the day this is not about politics or even policy. It is about stewardship. Employers and employees put real dollars into these plans with the expectation that someone is watching the store. Transparency and accountability do not break the system. They make it worthy of the people who rely on it.
If this moment leads to fewer closed pharmacies, fewer families walking away from the counter and more employers confident they are doing right by their people then it is a moment worth paying attention to. That is why we do this work and why we keep pushing even when the system would rather stay comfortable and quiet.
