PBM Reform Is Law: What the CAA 2026 Rebate Rules Mean for Your Contract

After a decade of hearings, headlines, and stalled bills, federal PBM reform finally has a signature on it. Here is what actually changed, when each piece bites, and the contract language you should be fighting for right now.

---

You have spent years being told the pharmacy line item is complicated, proprietary, and best left alone. You have signed contracts written by people whose paycheck depends on you not asking the next question. And every renewal, the number went up anyway.

That game just got harder to play. With the Consolidated Appropriations Act, 2026 signed on February 3, 2026, federal PBM reform moved from talking point to statute. The law rewrites how pharmacy benefit managers get paid, what they have to show you, and who is on the hook when the math does not add up. For the first time, a plan sponsor asking “where did my rebates go” has a federal answer waiting instead of a shrug.

Here is the honest read on what this PBM reform package does, what it stops short of doing, and what you should change in your contract before the compliance dates arrive.

What Changed When PBM Reform Became Law

PBM reform arrived because the pharmacy benefit manager business has been the most profitable black box in American healthcare for a long time, and the market is not exactly crowded. The three largest PBMs, CVS Caremark, Express Scripts, and Optum Rx, handle roughly 79% of all prescription drug claims in the United States on behalf of about 270 million people. Each one sits inside a larger company that also owns an insurer, a specialty pharmacy, a mail-order operation, and in some cases a provider group.

Regulators have been documenting the consequences. The Federal Trade Commission’s second interim staff report found that the three largest PBMs marked up specialty generic drugs by hundreds and in some cases thousands of percent, generating $7.3 billion in dispensing revenue above estimated acquisition cost between 2017 and 2022, plus another $1.4 billion from spread pricing on those same drugs. Employers and their employees paid for all of it.

Congress responded inside the appropriations package. The PBM reform provisions amend the Employee Retirement Income Security Act, the Public Health Service Act, and the Internal Revenue Code in parallel, which means the requirements reach self-funded plans, fully insured plans, and the carriers that administer them. The Congressional Budget Office scored the package as reducing federal deficits by about $2.1 billion over ten years, with roughly $1.865 billion of that coming from the employer plan reporting requirements alone.

Two pieces of the PBM reform package matter most to you as a plan sponsor. First, a hard requirement that your PBM remit 100% of what it collects from drug manufacturers. Second, a reporting regime detailed enough that you can finally check the work.

The 100% Rebate Pass-Through Rule in Plain English

The centerpiece of this PBM reform is a new condition inside ERISA section 408(b)(2), the provision that already governs whether a service arrangement counts as reasonable. The new language is blunt: a PBM contract is not reasonable unless the PBM passes through 100% of rebates, fees, alternative discounts, and all other remuneration received in connection with your plan’s prescription drug benefit.

PBM reform does not leave the timing loose either. Amounts have to be remitted quarterly, no later than 90 days after the close of each quarter. That single sentence kills a favorite PBM working capital trick, which is holding your rebate money for six, nine, or twelve months and earning on the float while your plan waits.

What Counts as Remuneration

This is where the drafting is smart. “Rebates” alone would have been trivially easy to route around, and the industry has spent years doing exactly that by renaming money. The statute reaches:

• Manufacturer rebates tied to formulary placement or volume
• Administrative fees and manufacturer service fees
• Alternative discounts and price concessions of any label
• Fees tied to utilization, including data, formulary management, and program fees
• Other remuneration received in connection with the plan’s drug benefit

Layering a markup on top of any of it is off the table. If money moves from a manufacturer or another supply chain participant because of your members’ prescriptions, that money belongs to your plan.

The law also blocks the gag strategy. PBMs may not enter agreements with manufacturers, wholesalers, or other supply chain entities that would restrict the PBM’s ability to produce the reporting the statute requires. “Our manufacturer contract prevents us from telling you that” stops being an available answer.

What This PBM Reform Does Not Do

Be clear-eyed here, because vendors will oversell it.

The statute does not require rebates to be applied at the point of sale. Your plan gets the money, but nothing forces it into the hands of the member standing at the pharmacy counter paying coinsurance on a list price. That remains a plan design decision, and it is one worth making deliberately.

The pass-through requirement also does not appear to reach spread pricing arrangements between a PBM and a pharmacy. Spread pricing shows up in the new reporting, so you will be able to see it, but the law does not ban it outright for commercial plans. Seeing it and stopping it are two different jobs, and the second one still belongs to you and your advisor.

Finally, this PBM reform sets a national floor. A Government Accountability Office review of state PBM regulation found a genuine patchwork of licensing, transparency, and pricing rules across states, and stronger state requirements can still apply to fully insured business.

The Reporting Your PBM Will Owe You

Money follows information, and this is the part of PBM reform that changes what you can actually see. Your PBM will have to deliver a report at least every six months, and quarterly if your plan asks for it. What lands in that report depends on your size, because PBM reform scales the detail to participant count.

Plans With 100 or More Participants

Large plans get claim level and drug level detail, which is the level at which pharmacy waste is visible:

• The contracted rate your plan paid, drug by drug
• The amount the PBM actually reimbursed the dispensing pharmacy, and the difference between the two
• Participant cost sharing on each drug
• Pharmacy type, including whether the dispensing pharmacy is affiliated with the PBM
• Rebates and discounts received by the plan and, separately, received by the PBM
• Gross and net spending by therapeutic class, with total PBM compensation
• Average net spending on 30 day and 90 day fills
• Formulary tier, utilization management controls, and out of pocket spending by class
• Every drug with $10,000 or more in gross plan spending, or the top 50 drugs if fewer qualify, including the rationale for its formulary placement and year over year changes
• Benefit design features that steer members to PBM affiliated pharmacies, the share of claims filled at those affiliates, and acquisition cost detail for drugs they dispense

Read that list again with your last renewal in mind. The formulary placement rationale and the affiliate steering data are the two items your incumbent will least want to produce, and they are exactly where the money hides.

Plans With Fewer Than 100 Participants

PBM reform gives smaller plans a summary level version: aggregate gross and net spending, total PBM compensation, and rebate totals, without the drug by drug breakout. Less granular, still a step change from what most small plans see today.

PBMs also have to make their rebate arrangement records available for audit. Audit rights only work if your contract actually grants them with real teeth, which brings us to the negotiation section below.

PBM Reform Timeline: The Dates That Matter

The PBM reform compliance calendar is staged, and that staging is the single most misunderstood part of the law.

Two things to sit with. Existing contracts are not rewritten by the statute, so the rebate rule reaches your arrangement when you enter or renew it for a plan year starting on or after August 3, 2028. And a three year runway is not three years of quiet. Most PBM contracts run three years. The agreement you sign in 2026 or 2027 is very likely the one that has to comply, which means the negotiation that matters is the one in front of you now.

The Piece of PBM Reform That May Already Be Live

Here is the piece of PBM reform almost nobody is talking about, and it is the one with a deadline that may have already passed.

The CAA 2026 broadened the definition of “covered service provider” under ERISA section 408(b)(2). That disclosure duty used to sit mainly with brokers and consultants. It now reaches pharmacy benefit managers, third party administrators, stop loss carriers, and ancillary vendors delivering medical management, disease management, and employee assistance programs. Those providers must disclose all direct and indirect compensation received under their contracts with your group health plan.

Congress attached no delayed effective date to that change. Most benefits attorneys reading the statute conclude it therefore applies to contracts entered into or renewed on or after February 3, 2026, meaning it is operative now, with enforcement relief possible but not promised. A minority read pushes it to August 3, 2028 alongside the rest of the package. Until the agencies clarify, the prudent posture is to assume it is live.

Practically, that means every TPA, stop loss, care management, and EAP agreement you touch this plan year should come with a written compensation disclosure. If a vendor cannot produce one, that is information about the vendor.

Regulators are moving in the same direction independently. The Department of Labor’s proposed rule, Improving Transparency Into Pharmacy Benefit Manager Fee Disclosure, would require PBMs and affiliated consultants to disclose spread pricing amounts, copay clawback practices, formulary placement incentives, and drug pricing methodologies before a contract is signed, with semiannual updates after. That rule is still pending, and the Department reopened comments specifically to ask whether it should be aligned with the new statute. The direction of travel is not ambiguous.

Penalties for Getting PBM Reform Wrong

PBM reform carries real money behind it:

• Up to $10,000 per day for each day a violation continues or required information goes undisclosed
• Up to $100,000 for knowingly submitting false information

A daily penalty is designed to make stalling expensive rather than merely embarrassing. A PBM that slow walks a report for a quarter is looking at a seven figure exposure.

The penalties are aimed primarily at the entity that owes the disclosure. Your exposure sits somewhere else, and it is arguably larger, because it is not capped by a statutory schedule. It is fiduciary.

Why This Is a Fiduciary Issue, Not a Pharmacy Issue

Strip away the statutory citations and this PBM reform does one thing to you specifically: it removes your excuse.

PBM reform does not invent your obligation here. Under ERISA you already owe a duty of prudence and a duty to pay only reasonable compensation for plan services. The problem has always been evidentiary. You could not confirm whether your PBM’s compensation was reasonable because you could not see it, and “the vendor would not tell me” was a defensible position when no law required the vendor to tell you.

That defense is closing. Once a statute obligates your PBM to hand you drug level pricing, spread amounts, affiliate steering data, and formulary placement rationale, a fiduciary who never requests the report, never reads it, or reads it and does nothing is in a materially worse position than one who never had access. Information you were entitled to and ignored is the harder fact pattern to defend.

The statute does include a limited exception for a fiduciary who takes documented corrective action after discovering a problem, which is worth knowing. It relieves nothing about the underlying obligation to be prudent in the first place. If you want the plain-English version of what that duty involves, we wrote it up here: what it means to be a fiduciary of a health plan.

So the PBM reform fiduciary to-do list is short and unglamorous:

1. Put the PBM report on your compliance calendar the way you already track your 5500 and your gag clause attestation
2. Document that a fiduciary or committee actually reviewed it, with dates
3. Retain the disclosures and any audit work papers, because they are your evidence later
4. Be ready to hand participants summary spend and compensation data if they ask
5. When the data shows a problem, record what you did about it

What PBM Reform Means for Your Next Contract

PBM reform sets a floor. A contract is where you actually get paid. These are the provisions to put on the table at your next renewal, and none of them require you to wait for 2028.

Six Provisions to Negotiate Now

• Full pass-through, defined broadly. Write the definition to cover rebates, administrative fees, manufacturer service fees, alternative discounts, price concessions, utilization based fees, and any other remuneration, however labeled. Add a catch-all so renaming money does not create a loophole.
• Quarterly remittance with a reconciliation. Ninety days is the statutory outside edge. Ask for 45 or 60, require a reconciliation statement with each payment, and attach interest to late remittance.
• Reporting now, not in 2028. Ask for the full statutory report package effective your next plan year. A PBM that intends to comply in 2028 can produce it in 2026. Reluctance is a data point.
• Audit rights with teeth. Your own auditor, your choice of auditor, reasonable notice, access to rebate arrangement records, no pre-approval of findings, and the PBM covering audit costs when a material discrepancy shows up.
• No gag language anywhere. Confirm in writing that no upstream agreement limits what the PBM can disclose to you, and require notice if one is proposed.
• Affiliate transparency and a steering check. Require disclosure of the share of claims filled at PBM affiliated pharmacies, acquisition cost detail for those drugs, and the right to challenge benefit design that steers members to affiliates without a cost or quality justification.

One more structural question deserves attention while contracts are open. The traditional PBM model earns more when drug spending rises, which is the conflict every one of the provisions above tries to manage after the fact. An alternative is to change the compensation model rather than police it: a transparent, flat-fee administrator with no rebate retention and no spread. We laid out the trade-offs in pharmacy benefits administrator versus PBM.

Treat PBM Reform as the Floor, Not the Ceiling

Compliance and strategy are not the same project, and treating PBM reform as only the first is how employers end up fully compliant and still overpaying.

Everything in this PBM reform package is a minimum. The law makes your PBM show you the money. It does not make your PBM stop earning on your drug spend, does not eliminate spread pricing in commercial plans, and does not push a dollar of rebate value to the member at the counter unless you design it that way.

The employers who get real value from this window will use the disclosures as inputs to a decision, not as a filing. That means reading the drug level data against your own claims, testing whether formulary placement rationale holds up against lower net cost alternatives, checking how much of your spend runs through pharmacies your PBM owns, and asking whether the compensation model itself is worth keeping. It also means building the plan around a fiduciary standard instead of bolting compliance onto a structure designed to keep you in the dark.

Patients feel the difference when it works. Analysts reviewing the new law expect the shift away from list price linked, percentage based PBM compensation to weaken the incentive to favor higher priced drugs, which is the mechanism that has been quietly raising your members’ coinsurance for years.

Frequently Asked Questions About PBM Reform

Does this PBM reform apply to fully insured plans or only self-funded plans?

Both. Congress amended ERISA, the Public Health Service Act, and the Internal Revenue Code in parallel, so the requirements reach self-funded plans and fully insured coverage through the issuer. Reporting depth varies by participant count, not by funding type.

Do I have to renegotiate my current PBM contract immediately?

PBM reform does not void existing agreements. The rebate pass-through and reporting conditions attach when you enter into or renew a contract for a plan year beginning on or after August 3, 2028. Given typical three year terms, though, the contract you sign in the next cycle is probably the one that has to comply.

Will rebates now lower what my employees pay at the pharmacy?

Not automatically. The law directs 100% of rebate value to the plan and specifically does not require point of sale application. Passing that value to members at the counter is a plan design choice you make.

What is the very first thing I should do?

Request written direct and indirect compensation disclosure under the expanded PBM reform disclosure duty from your PBM, TPA, stop loss carrier, and care management vendors for this plan year, since that ERISA 408(b)(2) duty carries no delayed effective date. Then get your next PBM renewal on the calendar with the six provisions above attached to it.

Does PBM reform replace state PBM laws?

No. It creates a federal baseline. State licensing, transparency, and pricing requirements continue to apply where they reach, and several states impose stricter standards than the federal floor.