A new federal law, the Consolidated Appropriations Act, 2026 (CAA-26), significantly changes how pharmacy benefit managers (PBMs) must disclose pricing and compensation. It also expands employer and fiduciary responsibilities related to prescription drug benefits.
While these rules do not take effect immediately, they will have a major impact on PBM contracts, reporting, and oversight.
Below is what matters most for employers.
What Changed?
CAA-26 does three key things:
- Requires PBMs to provide much more detailed pricing and compensation data
- Requires employers to notify participants about PBM transparency rights
- Requires ERISA plans to use PBMs that pass through 100% of non-transparent compensation
The law is designed to give employers and fiduciaries clear visibility into PBM fees, rebates, and potential conflicts of interest.
Why Did This Change?
Congress acted due to growing concern that:
- PBM compensation (rebates, spread pricing, pharmacy differentials) is often opaque
- Employers and fiduciaries lack the information needed to determine whether PBM fees are reasonable
- Existing transparency laws did not clearly apply to PBMs
CAA-26 closes these gaps by requiring clear disclosure, audit rights, and full pass-through of hidden compensation.
Who Does This Apply To?
The rules apply broadly to employers offering prescription drug coverage:
- All Employers (Any Size) If you offer prescription drug coverage:
- You must provide an annual notice to participants explaining PBM transparency rights
- PBMs must provide summary aggregate reporting that can be shared with participants upon request
- Large Employers (100+ Participants) If your plan has 100 or more participants:
- PBMs must provide detailed semiannual (or quarterly) reports with drug-level data
- ERISA Plans (Any Size) If your plan is subject to ERISA:
- PBM contracts must require 100% pass-through of all non-transparent compensation
- Fiduciaries must review PBM compensation for reasonableness and conflicts of interest
- These rules apply whether the plan is insured or self-insured
These requirements also apply to church plans and nonfederal governmental plans.
What Employers Are Expected to Do
Employers and plan fiduciaries will be expected to:
- Review PBM reporting and compensation disclosures
- Ensure PBM contracts:
- Allow audits
- Provide access to required data
- Include full pass-through of non-transparent compensation (ERISA plans)
- Distribute required annual participant notices
- Monitor PBM arrangements for reasonableness and conflicts of interest
What Happens If There Is Noncompliance?
CAA-26 includes significant penalties, including:
- $10,000 per day for reporting or disclosure failures
- $100,000 per item for knowingly inaccurate information
Failure to disclose PBM compensation can also create ERISA prohibited transaction risks.
When Do These Rules Take Effect?
- Most requirements apply to plan years beginning on or after August 3, 2028
- Federal agencies have 18 months to issue standardized reporting guidance
- Employers have time—but should begin planning now
Bottom Line for Employers
You don’t need to act immediately, but PBM transparency and fiduciary oversight are about to change significantly. Employers that begin reviewing PBM contracts, audit rights, and data access provisions now will be best positioned to comply when the rules take effect.