What is RxDC reporting?
RxDC reporting is the annual Prescription Drug Data Collection that employer health plans and health insurers send to the federal government. It is required by section 204 of Title II of Division BB of the Consolidated Appropriations Act, 2021 (CAA), which added parallel rules to ERISA, the Internal Revenue Code and the Public Health Service Act. The “Rx” stands for prescription drug and the “DC” for data collection.
The Centers for Medicare & Medicaid Services (CMS) collects the reports on behalf of HHS, the Department of Labor and the Treasury. Submissions go through the RxDC module of the Health Insurance Oversight System (HIOS).
Despite the name, the report covers more than drugs. It collects:
- Premiums and premium equivalents, split between what members paid and what the employer paid
- Total health care spending by category: hospital, primary care, specialty care, other medical costs (including wellness) and prescription drugs
- The 50 brand drugs dispensed most often, the 50 most costly drugs, and the 50 drugs with the largest increase in spending
- Prescription drug rebates, fees and other payments from drug manufacturers, and how they affected premiums and out-of-pocket costs
The Departments use the data to publish a public report on prescription drug pricing trends and the effect of rebates on premiums and member costs.
Who is responsible for RxDC reporting?
Group health plans and health insurers both carry the obligation. That includes fully insured and self-funded plans, ERISA plans, non-federal governmental plans, and church plans subject to the Internal Revenue Code. Grandfathered status does not matter.
| Required to report | Not required to report |
|---|---|
| Fully insured group health plans | Account-based plans, such as HRAs |
| Self-funded group health plans | Excepted benefits, such as limited-scope standalone dental and vision |
| Non-federal governmental plans | Short-term, limited-duration and fixed indemnity insurance |
| Church plans subject to the Code | Retiree-only plans (fewer than two active employees) |
| Health insurers in the group and individual markets | Medicare Advantage, Part D and Medicaid plans |
A plan with medical coverage but no pharmacy benefit still reports. It files the plan list, D1, D2 and a narrative response, and skips the drug files.
Fully insured versus self-funded.
Who holds the legal risk depends on how the plan is funded and what is in writing.
- Fully insured plans. The plan can require its insurer, by written agreement, to report for it. If the insurer then fails to report, the insurer violates the rule and the plan does not. Without that agreement, the plan keeps the duty.
- Self-funded plans. The plan can contract with a TPA, PBM or other vendor to file, but the duty does not move. If the vendor fails to report, the plan violates the rule.
What files are in the RxDC report?
Each submission has a plan list, data files and a narrative response. Employer plans use plan list P2. The data files are D1 to D8.
| File | What it contains | Who usually files it |
|---|---|---|
| P2 Group health plan list | Plan name and number, plan sponsor name and EIN, plan year dates, member count, states where offered | Every reporting entity that files anything for the plan |
| D1 Premium and life-years | Average monthly premium paid by members and by the employer, life-years, premium equivalents, admin fees and stop-loss premium for self-funded plans | The carrier or TPA, using data the employer supplies, or the employer itself |
| D2 Spending by category | Hospital, primary care, specialty care, other medical and Rx spending | The carrier or TPA |
| D3 Top 50 most frequent brand drugs | Brand drugs dispensed most often | The PBM or carrier |
| D4 Top 50 most costly drugs | Drugs with the highest total spending | The PBM or carrier |
| D5 Top 50 drugs by spending increase | Drugs with the largest year-over-year spending growth | The PBM or carrier |
| D6 Rx totals | Rx enrollment, total drug spending, bona fide service fees, PBM spread amounts and total rebates | The PBM or carrier |
| D7 Rx rebates by therapeutic class | Manufacturer rebates and other payments by drug class | The PBM or carrier |
| D8 Rx rebates for the top 25 drugs | The 25 drugs with the highest rebate amounts | The PBM or carrier |
A plan with pharmacy benefits only files D1 and D3 to D8. Every reporting entity also must submit a P2 so CMS can match its files to your plan.
Multiple reporting entities.
Any organization that files some or all of the data for a plan is a “reporting entity.” A plan can use several. In a typical self-funded plan with a carved-out PBM, the TPA files P2, D1 and D2, and the PBM files P2 and D3 to D8, each in its own HIOS submission. CMS treats the plan’s report as complete when it has received every required file, no matter who sent it.
Two rules make coordination matter:
- Aggregation. Vendors usually report data combined across many clients. The data in D1 and D3 to D8 cannot be aggregated at a less detailed level than the D2 file for your plan. If D2 is reported at your plan sponsor level, the rest must be too.
- Vendor changes. If you changed TPAs or PBMs during the year, the old vendor can report the months before the change and the new vendor the months after, or the new vendor can report the full year using data from the old one. Agree on which, in writing, before spring.
When is the RxDC report due?
The RxDC report is due June 1 every year and covers the reference year, which is the calendar year before. The report for the 2025 reference year was due June 1, 2026. The report for the 2026 reference year, covering January through December 2026, is due June 1, 2027.
The due date is the same for calendar-year and non-calendar-year plans, since the report is built on calendar-year data. Plan for the deadline as fixed. Allow up to two weeks to set up CMS Enterprise Portal and HIOS access if your plan will upload any files itself.
What does the employer supply?
Even when vendors file everything, the employer usually has to provide the data only it holds. The most common gap is D1. CMS requires premium to be reported separately for what members paid and what the employer paid, and a carrier or TPA often does not know your contribution split.
Expect a carrier, TPA, PBM or broker survey in the first part of the year asking for:
- Total employee contributions and total employer contributions for the year, by plan
- Your plan sponsor name and EIN, plan number and plan year dates
- For self-funded plans, the admin fees and stop-loss premium paid
That survey is not from CMS. It is how your vendor gathers what it needs to file P2 and D1 for you. If your vendor will not file P2 and D1 for your plan, the plan (or another reporting entity) must file them directly with CMS. Answer surveys early, keep a copy, and confirm the vendor’s survey deadline.
How do you confirm your vendors filed?
CMS does not tell a plan when a vendor submits on its behalf, and one vendor cannot see what another filed. Confirmation has to come from your vendors.
- Map every file to an owner. List P2 and D1 to D8 and write next to each one which carrier, TPA or PBM will file it. Gaps usually show up at D1 and at carved-out pharmacy or behavioral health benefits.
- Put it in writing. For a fully insured plan, make sure your carrier agreement requires the carrier to report for the plan. For a self-funded plan, get each vendor’s commitment in writing, knowing the duty stays with the plan.
- Send your data early. Return employer contribution data well before the vendor’s internal deadline.
- Ask for proof after June 1. Request written confirmation from each vendor that lists the files it submitted for your plan and the reference year.
- Keep the records. Store vendor agreements, survey responses and confirmations with your plan records.
Ethos Benefits coordinates this with clients as part of its compliance work, alongside the other federal deadlines on the plan calendar.
What is the penalty for missing RxDC reporting?
RxDC reporting is a group health plan requirement under the Internal Revenue Code, so a failure can trigger the excise tax under section 4980D, generally $100 per day for each affected individual. The Departments can also take enforcement action under ERISA and the Public Health Service Act. For fully insured plans with a written agreement in place, the insurer, not the plan, is the party that violates the rule if it fails to report.
What changed for the 2025 reference year?
Almost nothing. The CMS instructions for the 2025 reference year, last updated February 2026, made no changes from the prior version other than moving the reference year from 2024 to 2025 and minor clarifications. Two rules from earlier years still trip plans up:
- Average monthly premium in D1 is total annual premium divided by 12, not a per-member-per-month figure. That method has applied since the 2023 reference year.
- The aggregation restriction is enforced, also since the 2023 reference year.
CMS updates the instructions for each reference year. Before you start the 2026 reference year report, check the CMS RxDC page for the latest instructions and templates.
How does RxDC relate to the gag clause attestation?
Both requirements come from the CAA, and both are filed with CMS, but they ask different things. RxDC reporting sends CMS your plan’s spending and drug data by June 1. The gag clause attestation confirms by December 31 that your service provider contracts do not block your plan from its own cost, quality and claims data. A plan that can’t get its own claims data from a vendor will have trouble with both.