More employers are finding themselves unexpectedly responsible for submitting portions of their annual Prescription Drug Data Collection (RxDC) reporting to CMS. In prior years, insurers and TPAs widely communicated their data requests, but that outreach has diminished. At the same time, many vendors have moved their internal deadlines earlier, leaving employers with less time to respond. As a result, a growing number of employers are missing these cutoffs and must now complete parts of the RxDC filing on their own.
Applies To:
Employers of all sizes sponsoring prescription drug coverage who missed their insurer’s or TPA’s internal RxDC data request deadline.
Note: RxDC reporting does not apply to health FSAs, HRAs, ICHRAs, excepted benefits (such as standalone dental or vision), fixed indemnity insurance, or retiree-only plans.
Go Deeper:
Group health plans and insurers must report certain medical and prescription drug spending data to CMS annually. Submissions are made through CMS’s Health Insurance Oversight System (HIOS) portal and include a series of data files (D1–D8), along with a Plan List file (P2).
While insurers and TPAs maintain most of the required data, they typically do not track the average monthly employer and employee contributions, which must be reported on the D1 file. If this information is not provided by the employer before the vendor’s internal deadline, the carrier or TPA will submit only the data they have available.
In these cases, the employer must submit the missing D1 and P2 files directly to CMS by the final deadline of June 1, 2026.
Because obtaining access to the HIOS portal can take two or more weeks, employers who missed their vendor’s deadline should begin the registration process immediately.
The HIOS registration process includes identity verification steps, which may require:
- Providing personal identifying information (e.g., Social Security number)
- Completing a soft credit check through Experian
Due to these requirements, waiting until late May may result in missing the filing deadline.
To support employers navigating this process, we can provide a step-by-step RxDC submission walkthrough outlining the five key steps required. Assistance with technical questions is also available.
Penalties for Non-Compliance:
Failure to comply with RxDC reporting requirements may result in:
- Penalties and enforcement actions: Federal agencies may impose penalties under ERISA, the Internal Revenue Code, and the Public Health Service Act
- Increased scrutiny: Non-compliance may trigger audits or investigations
- Plan sponsor liability: Employers may face financial and reputational risk for incomplete or late submissions
Practical Impact for Employers:
Employers should take the following steps to ensure compliance:
- Verify reporting responsibility: Confirm whether the carrier, TPA, or PBM is handling reporting and ensure responsibilities are clearly documented
- Gather required data: Coordinate with vendors and internal stakeholders to collect necessary plan, cost, and contribution data
- Monitor deadlines: Track both vendor and CMS deadlines and confirm submissions are completed
- Self-submit if needed: If a vendor deadline is missed, determine what has already been filed and what remains outstanding. Employers may need to submit D1 and P2 files directly using CMS resources (FAQs, templates, and instructions)
- Document compliance efforts: Maintain records of submissions, vendor agreements, and related communications