Compliance & Cost Strategy

PBM Spread Pricing: Why the Rules Are Finally Catching Up (and What to Do Before They Do)

For twenty years, PBM spread pricing has let plan costs balloon in the dark. Two federal actions are about to change that. Here’s what’s coming, when it hits, and how to get ahead of it instead of getting caught by it.

Here’s the part nobody put in the sales deck: when your PBM tells you what a drug “costs,” that number was never really the cost. It was a number your PBM chose to charge you, often quietly higher than what it actually paid the pharmacy.

The difference stayed with the PBM. Nobody called it a fee, because a fee would have to be disclosed. Instead, it got a softer name: PBM spread pricing.

You didn’t misread your contract. You couldn’t have. The terms that would have let you catch it were never fully spelled out, and even when you asked for the data, “commercially sensitive” was the answer. That’s not an accident. It’s the business model. And for the first time, federal law is about to make it illegal to run that way.

The old model: opaque by design

PBM spread pricing works like this: your plan pays the PBM one price for a drug, the PBM reimburses the pharmacy a lower price, and the PBM keeps the difference, on top of whatever rebates it’s already negotiating with manufacturers.

You never see the spread. You never see the full rebate. You see a monthly invoice and a renewal that keeps climbing, and you’re told that’s just how pharmacy benefits work.

That’s PBM spread pricing in one sentence: an undisclosed markup with your name on the invoice.

It isn’t how they have to work. It’s how they’ve been allowed to work, because until now, nothing in federal law forced a PBM servicing a self-funded ERISA plan to show its math. The villain in this story isn’t any single PBM. It’s a system built to reward the party that controls the information.

Two federal actions are converging on the same target

This isn’t one law closing one loophole. It’s two separate federal actions landing on the same problem from different directions, with different timelines, which is exactly why employers who wait for “the deadline” are going to miss the first one.

1. The Consolidated Appropriations Act of 2026 (CAA 2026)

CAA 2026 writes PBM spread pricing out of the ERISA playbook. It requires PBMs servicing ERISA group health plans to pass through 100% of rebates, discounts, fees, and other remuneration tied to a plan’s drug spend, and it formally classifies PBMs as “covered service providers” under ERISA Section 408(b)(2), meaning direct and indirect compensation has to be disclosed, not buried.

Large self-insured plans get drug-level reports every six months (quarterly on request), rebate records have to be available for audit at least annually, and the law backs it up with real teeth: civil penalties of $10,000 per day for nondisclosure and up to $100,000 for knowingly submitting false information, according to a detailed breakdown from Morgan Lewis’s analysis of the new fiduciary oversight landscape.

The catch: these provisions generally apply to plan years beginning on or after August 3, 2028, or January 1, 2029, for calendar-year plans.

2. The DOL’s proposed PBM fee disclosure rule

In January 2026, the Department of Labor proposed its own rule, separate from CAA 2026 and moving faster. It’s aimed at the same PBM spread pricing problem CAA 2026 targets, just through a different door.

Under the DOL’s fact sheet on the proposed rule, PBMs serving self-funded and level-funded ERISA group health plans would have to give plan fiduciaries an upfront estimate of direct and indirect compensation before a contract is signed, extended, or renewed, plus semiannual reports on what they actually collected. The proposal also adds an explicit, standalone audit right: plans can choose their own auditor, and the PBM can’t restrict that choice or make the plan pay for it.

If finalized as proposed, this rule would apply to plan years beginning on or after July 1, 2026, or January 1, 2027, for calendar-year plans. The comment period closed March 31, 2026. As of this writing, the rule hasn’t been finalized, but the direction is unmistakable, a point The American Journal of Managed Care and the KFF policy brief on PBM oversight both make plainly: federal regulators, state legislatures, and even the FTC are now pointed at the same target from three different directions at once.

Why “we’ll deal with it at the deadline” is the wrong plan

Notice the gap between those two dates. The DOL rule, if it goes final as written, could be live for calendar-year plans as soon as January 1, 2027, nearly two full years before CAA 2026’s own statutory requirements kick in. Employers who treat 2029 as “the” compliance date are planning for the slower-moving of the two.

That’s the internal problem underneath the external one: benefits has been the one part of your business you manage reactively, waiting for the renewal, the audit, the regulation, instead of getting ahead of it the way you would a supply contract or a lease. Treating PBM spread pricing reform as a someday problem is exactly the mistake the rules are designed to punish.

There’s a real cost to waiting. PBM contracts routinely run three to five years. If your current agreement was signed before this wave of reform, it was almost certainly drafted without the disclosure language, audit protections, or pass-through commitments the new rules will require. Renewing that same contract without renegotiating it doesn’t just leave money on the table. It leaves you exposed at the exact moment your legal audit rights are strongest.

What to do before the rules do

You don’t need to overhaul your plan tomorrow. You need a real, honest look at where your current contract stands relative to where the law is going, and a plan to close that gap on your own timeline, not the DOL’s.

1. Pull your current PBM contract and look specifically for PBM spread pricing language. If your agreement doesn’t explicitly commit to 100% pass-through of rebates and fees, assume PBM spread pricing is happening somewhere in it.
2. Ask for the disclosures now, before you’re required to. Request direct and indirect compensation detail and drug-level reporting voluntarily. A PBM that resists a request it will soon be legally required to honor is telling you something.
3. Confirm your audit rights are real, not decorative. Can you choose your own auditor? Can you get rebate records within a reasonable window? If the answer is no, that’s a renegotiation point today and a compliance gap tomorrow.
4. Time your renewal to the regulatory calendar, not just your plan year. If your contract renews before 2027, you have a window to negotiate in the new language proactively instead of scrambling to amend it under deadline pressure.
5. Bring in a fiduciary partner who’s already tracking both rules. This is exactly the kind of shift where strategy beats reaction, and where a second set of eyes on your contract pays for itself many times over.

This is where a fiduciary-first strategy earns its name. Ethos doesn’t just flag the risk and hand it back to you. We go through your PBM contract line by line, benchmark it against what CAA 2026 and the DOL rule will require, and build the negotiating position that gets you real transparency before it’s mandatory. That’s the difference between a plan that’s compliant because it has to be, and one that’s ahead because you chose to be.

© 2026 Ethos Benefits. This article is for general informational purposes and is not legal advice.