This page is updated as rules and guidance are issued.
What does the law now require?
The law requires PBMs to report regularly to employer health plans, keeps contracts from blocking the data those reports need, and gives ERISA plans 100% of rebates and fees with a yearly audit right. The Consolidated Appropriations Act, 2026 (H.R. 7148, Public Law 119-75) was signed on February 3, 2026. Its PBM provisions sit in Division J, mainly sections 6701 and 6702, and they amend ERISA, the Public Health Service Act and the Internal Revenue Code. That means they reach self-funded and fully insured plans, and in many cases non-ERISA plans as well.
For group health plans, the law does five things:
- Opens the data. A plan, its insurer or its PBM may not sign, renew or extend a contract with a drug manufacturer, wholesaler, rebate aggregator, affiliated group purchasing organization or PBM affiliate unless that party agrees not to limit or delay the information the PBM needs to report to the plan.
- Requires regular PBM reports. The PBM must send the plan a report at least every six months, or quarterly if the plan asks, at no extra cost, in plain language and a machine-readable format.
- Passes rebates through to ERISA plans. For ERISA plans, a PBM contract is not “reasonable” under ERISA section 408(b)(2) unless the PBM remits 100% of rebates, fees, alternative discounts and other remuneration tied to the plan’s drug use. Remittances are due quarterly, within 90 days after each quarter ends.
- Gives ERISA plans audit rights. The plan, or a third party it names, can audit the rebate and fee records at least once per plan year, and can audit the PBM’s rebate contracts with manufacturers and aggregators. The auditor is chosen by the plan fiduciary, and the PBM may not pay for it, directly or indirectly.
- Adds penalties. Failing to provide required information carries a civil penalty of $10,000 per day. Knowingly providing false information carries up to $100,000 per item. Regulators may waive penalties or extend deadlines for an entity that made a good-faith effort to comply.
The law does not ban spread pricing in employer plans outright. It makes spread visible: the drug-level report must show, for each claim, the difference between what the plan paid and what the pharmacy was paid. PBMs may still charge bona fide service fees, as long as those fees are transparent and quantifiable to the plan. For more on how spread works, see PBM spread pricing.
When does PBM reform take effect?
Most employer plan requirements apply to plan years beginning on or after August 3, 2028, which is 30 months after the law was signed. For a calendar-year plan, that means January 1, 2029. A plan year that begins between August 3 and December 31, 2028 starts under the new rules in 2028.
| Requirement | Who it applies to | Starts |
|---|---|---|
| Contract terms that keep reporting data flowing | All group health plans and insurers | Plan years beginning on or after August 3, 2028 |
| Semiannual PBM report, quarterly on request (plan-level summary) | All group health plans, any size | Plan years beginning on or after August 3, 2028 |
| Drug-level detail in the PBM report | Self-funded plans of employers with 100 or more employees, plans with 100 or more participants, and insured large employers that opt in | Plan years beginning on or after August 3, 2028 |
| Yearly participant notice, and summary and claim-level data on request | All group health plans | Plan years beginning on or after August 3, 2028 |
| 100% pass-through of rebates, fees and other remuneration | ERISA plans (paid to the insurer on the plan’s behalf for insured coverage) | Plan years beginning on or after August 3, 2028 |
| Yearly audit of rebate and fee records, auditor chosen by the plan | ERISA plans | Plan years beginning on or after August 3, 2028 |
| Standard report format and implementing rules | Federal regulators | Due within 18 months of enactment, by August 3, 2027 |
| PBM pay limited to bona fide service fees (delinking) | Medicare Part D plans, not employer plans | Plan years beginning on or after January 1, 2028 |
One detail matters more than the dates. As written, the requirements attach to PBM contracts entered into, renewed or extended on or after the effective date. A contract in force on that date keeps its terms until it renews or is extended. A three-year PBM contract signed in 2027 could delay these protections for your plan.
What will the PBM reports show?
The reports will show net prices, rebates, fees and broker or consultant compensation for every plan, with claim-level drug detail for larger plans. The law creates two levels of reporting.
Every group health plan receives a summary built for choosing and overseeing a PBM, covering items such as net price, cost per claim, fee structure and estimated cost per member. The report also shows total net drug spending, total rebates and fees received, manufacturer copay assistance where feasible, and any compensation paid to brokers, consultants or advisors for referring, considering or keeping the PBM, including who received it.
Larger plans receive drug-level detail. That covers self-funded plans of employers that averaged at least 100 employees in the prior year, plans with at least 100 participants, and fully insured large employers that elect it each year. For each drug, by National Drug Code, the report covers:
- what the plan paid the PBM and what the pharmacy was paid, and the difference for each claim
- dispensing channel (retail, mail order or specialty), with list price benchmarks
- net price per fill after rebates and fees, net spending and member out-of-pocket cost
- rebates and other payments received by the plan and by the PBM
- therapeutic class summaries, formulary tiers and utilization rules such as prior authorization
- for drugs over $10,000 in gross spending (or the top 50 drugs), the rationale for formulary placement and any change from the prior year
- for PBM-affiliated pharmacies, including mandatory mail and specialty programs, what the plan was charged compared with other network pharmacies
Reports must follow HIPAA privacy rules and contain only summary health information. Participants can ask the plan for an aggregate summary and for the claim-level spread on their own claims, and the plan must tell participants about the reporting each year.
What does it mean for self-funded employers?
Self-funded employers get the most from the law, and carry the most responsibility for using it. If your plan is subject to ERISA, the pass-through and audit rights are written into the test of whether your PBM contract is reasonable. That ties them directly to your fiduciary duty to pay only reasonable plan expenses.
The law also protects a fiduciary who acts. If a PBM fails to remit what it owes, the plan fiduciary is protected from prohibited transaction liability when it did not know of the failure, asks the PBM in writing to pay, and notifies the Department of Labor if the PBM does not pay within 90 days. That relief does not replace the duty to monitor the PBM. It rewards the plan that is watching.
Expect PBMs to price their compliance costs into new contracts and to try to shift penalty exposure to the plan through indemnification terms. Both are worth negotiating.
What does it mean for fully insured employers?
Fully insured employers are covered too, but at one step removed. The insurer usually holds the PBM contract, so rebates flow to the insurer on the plan’s behalf rather than to the employer. Every insured plan receives the summary report. An employer with 100 or more employees can elect, each year, to receive the full drug-level report, and that election is worth making. Without it, you will not see claim-level spread or affiliate pharmacy pricing for your own plan.
If the PBM is owned by your carrier, the drug-level report is the first standard view you will have of how much of your drug spend runs through the carrier’s own pharmacies.
What should employers do now?
No federal action is required of employers today, but the contract you sign before 2028 decides when your plan gets these protections.
- Read your PBM contract’s term and renewal dates. If it renews before August 2028, negotiate the new terms in now rather than waiting for a renewal after the effective date.
- Define rebates broadly. Make sure “rebates” includes administrative fees, price protection, and other manufacturer payments, however labeled, and that 100% passes to the plan.
- Secure audit rights. At least once a year, with an auditor your plan selects and the PBM does not pay, covering claims, rebate records and manufacturer rebate contracts.
- Ask for the reports early. Ask whether your PBM can produce semiannual drug-level reporting today. The answer shows what your plan has been missing and how ready your PBM is.
- Set up a review process. Decide who reads the reports, how often, and how decisions are recorded. Reports nobody reviews protect no one.
- Plan for participant requests. Confirm who will answer member requests for claim-level data and how protected health information will be handled.
- Check compensation disclosures. The summary report will show payments to brokers and consultants tied to your PBM. Ask for that information now.
Existing rules still apply in the meantime, including the yearly gag clause attestation. If you are weighing a change of PBM, see how to choose a PBM. Ethos Benefits reviews PBM contracts and runs PBM marketing through its pharmacy and PBM service.
What is still pending?
Implementing rules, the DOL’s PBM fee disclosure rule, parts of the FTC insulin case and many state PBM laws were still open as of October 21, 2026.
| Item | Status as of October 21, 2026 |
|---|---|
| Rules under the CAA 2026 PBM sections | The Departments must set a standard report format and issue implementing rules by August 3, 2027. Regulators will also define key terms such as “remuneration” |
| DOL PBM fee disclosure rule | Proposed in January 2026 for self-funded ERISA plans, with initial and semiannual compensation disclosures and an audit right. Not final as of this update |
| FTC insulin case against the three largest PBMs | Express Scripts settled February 4, 2026, agreeing to delink manufacturer pay from list prices in its standard offering and to provide drug-level reporting. A proposed consent order with Caremark followed on July 14, 2026. The Optum Rx matter was withdrawn from adjudication in June 2026 for the FTC to consider a proposed settlement |
| State PBM laws | States continue to pass PBM laws, and many are being challenged on ERISA preemption and other grounds |
State laws matter mostly for fully insured plans. In Rutledge v. Pharmaceutical Care Management Association (2020), the Supreme Court held that ERISA did not preempt an Arkansas law regulating what PBMs pay pharmacies. Laws that reach further into plan design are still being tested in court, so self-funded ERISA plans are generally governed by the federal rules above rather than state PBM statutes.
A short history.
Federal PBM bills had bipartisan support for years, including the PBM Reform Act of 2025 (H.R. 4317), introduced in July 2025, before Congress enacted PBM reform as part of the Consolidated Appropriations Act, 2026.
