Major PBM Reforms Passed as DOL Proposes New PBM Fee-Disclosure Rule
Federal oversight efforts directed at the pharmaceutical benefit manager (PBM) industry have accelerated in recent weeks. On Feb. 3, 2026, the President signed the Consolidated Appropriations Act (CAA) of 2026, a funding package containing a broad range of healthcare provisions, including significant PBM industry reforms. In addition, the U.S. Department of Labor (DOL) announced on Jan. 28, 2026, a proposed rule that would establish new PBM fee-disclosure obligations, further underscoring the federal government’s increasing focus on regulatory oversight of the industry.
Background
PBMs are third parties that manage most health plans’ prescription drug benefits. Health plans generally rely on PBMs to process prescription drug claims, design pharmacy networks and negotiate rebates from drug manufacturers. In recent years, the PBM industry has faced growing scrutiny amid questions from stakeholders regarding lack of PBM transparency and certain PBM practices, such as retaining a share of drug manufacturer rebates and using spread pricing. In response, state PBM laws have surged nationwide in the absence of federal regulations.
CAA Bill Highlights
To address these growing concerns, the CAA bill includes comprehensive PBM industry reforms. Key highlights for health plan sponsors and health insurance issuers include the following:
Mandatory PBM Reporting
PBMs must provide group health plans and health insurance issuers with detailed prescription drug spending data at least twice per year, or quarterly if requested. PBMs must also supply drug spending summary documents that plans can share with participants and beneficiaries upon request.
Group Health Plan Notice Requirements
Each year, group health plans must provide participants and beneficiaries with a written notice explaining that their PBM is required to submit prescription drug spending reports. This notice may be incorporated in plan documents or provided separately to individuals. Upon request, plans must also furnish:
- The PBM’s summary document; and
- For large plans, information showing the difference between what the plan paid the PBM and what the PBM paid the pharmacy for a covered drug associated with the requesting participant or beneficiary’s claim.
Penalties
Failure to provide the required information by a PBM or group health plan may result in a civil monetary penalty of $10,000 for each day the information is not reported. Additional penalties may apply if false information is provided. Penalties may be waived for good-faith efforts to comply.
Full Rebate Pass-through to Plans
For their contracts to be considered reasonable under the Employee Retirement Income Security Act (ERISA) compensation disclosure rules, PBMs must pass on 100% of all rebates, fees, alternative discounts and other remuneration to group health plans and issuers. These rebates, fees and alternative discounts must generally be paid on a quarterly basis, fully disclosed and enumerated to the group health plan or issuer and returned to the PBM if an audit by a plan sponsor, issuer or designated third party indicates an overpayment to the plan. If a PBM fails to remit required rebates, plan fiduciaries will not be treated as violating ERISA as long as they satisfy certain requirements.
In addition, the bill expands ERISA’s “covered service provider” definition specifically to encompass PBM services, along with other health plan‑related services. ERISA requires covered service providers to disclose specified information about their services and all expected direct and indirect compensation to ensure plan fiduciaries have the information necessary to evaluate the reasonableness of service contracts.
Medicare Part D Reforms
In addition, the bill contains several Medicare Part D-related reforms, including:
- Prohibiting PBM compensation in Medicare Part D from being tied to the manufacturer’s list price of a drug;
- Requiring the Centers for Medicare & Medicaid Services (CMS) to define and enforce “reasonable and relevant” Medicare Part D contract terms, including reimbursement and dispensing fee information, with enforcement authority to impose monetary penalties; and
- Authorizing CMS to track pharmacy payment trends and pharmacy inclusion in PBM networks, including a designation of “essential retail pharmacies.”
DOL Proposal
Similar to the CAA bill, the DOL’s proposed rule would significantly expand PBM disclosure obligations under ERISA’s compensation disclosure provisions by implementing an April 2025 Executive Order aimed at improving employer health plan transparency regarding PBM compensation.
Specifically, PBMs would be required to provide compensation disclosures to fiduciaries of ERISA-covered self-insured group health plans, enabling those fiduciaries to assess the reasonableness of PBM compensation in fulfilling their fiduciary duties under ERISA. The proposal would require PBMs to disclose the following information:
- Rebates and other payments from drug manufacturers;
- Compensation received when the price paid by the plan for a prescription drug exceeds the amount reimbursed to the pharmacy; and
- Payments recouped from pharmacies in connection with prescription drugs dispensed to the plan.
The proposed rule would also allow plan fiduciaries to audit the accuracy of PBM disclosures and provide additional relief for plan fiduciaries if their PBM fails to meet its obligations.
Employer Takeaway
Employers with self-funded plans should take note of this new legislation and the DOL’s proposed rule (while the DOL’s proposal excludes fully insured group health plans, it stated that disclosure obligations for these plans are being reserved for future action and specifically requested public comments on this issue). Public comments on the DOL’s proposal are due on or before March 31, 2026, and Higginbotham will continue to keep you updated as comments are received and when the final rule is issued. In addition, we will track how the new legislation will be rolled out in the coming months. Finally, please check out our upcoming webinar on fiduciary duties and responsibilities under ERISA.
Medicare Part D Disclosures due by March 1, 2026, for Calendar Year Plans
Group health plan sponsors are required to complete an online disclosure form with the Centers for Medicare & Medicaid Services (CMS) on an annual basis and at other select times, indicating whether the plan’s prescription drug coverage is creditable or non-creditable. This disclosure requirement applies when an employer-sponsored group health plan provides prescription drug coverage to individuals who are eligible for coverage under Medicare Part D.
The plan sponsor must complete the online disclosure within 60 days after the beginning of the plan year. For calendar year health plans, the deadline for the annual online disclosure is March 1, 2026.
Medicare Part D Disclosure to CMS
Group health plan sponsors are required to disclose to CMS whether their prescription drug coverage is creditable or non-creditable. This disclosure is required regardless of whether the health plan’s coverage is primary or secondary to Medicare.
A group health plan’s prescription drug coverage is considered creditable if its actuarial value equals or exceeds the actuarial value of the Medicare Part D prescription drug coverage. In general, this actuarial determination measures whether the expected number of paid claims under the group health plan’s prescription drug coverage is at least as much as the expected number of paid claims under the Medicare Part D prescription drug benefit.
There are a few different ways for employers to determine whether their prescription drug coverage is creditable. Employers should keep in mind that the prescription drug cost reduction provisions of the Inflation Reduction Act may affect the analysis of whether their prescription drug coverage is creditable. Employers with insured plans should ask their health insurance carriers if they have made this determination for the insured product. If an employer must make the determination itself, it may be able to use a simplified method, depending on the plan’s design. When a plan’s design is not eligible for the simplified method, an actuarial determination must be made.
Compliance Tip: If an employer’s group health plan does not offer prescription drug benefits to any Medicare Part D eligible individuals (including active employees, disabled employees, COBRA participants, retirees and their covered spouses and dependents) as of the beginning of the plan year, the group health plan is not required to submit the online disclosure form to CMS for that plan year.
Timing of Disclosures to CMS
The disclosure must be made to CMS on an annual basis and whenever any change occurs that affects whether the coverage is creditable. More specifically, the Medicare Part D disclosure notice must be provided within the following time frames:
- Within 60 days after the beginning date of the plan year for which the entity is providing the disclosure to CMS;
- Within 30 days after the termination of a plan’s prescription drug coverage; and
- Within 30 days after any change in the plan’s creditable coverage status.
Online Disclosure Method
Plan sponsors are required to use the online disclosure form on the CMS creditable coverage website. This is the sole method for compliance with the disclosure requirement, unless the entity does not have internet access.
The disclosure form lists the required data fields that must be completed in order to generate the disclosure notice to CMS, such as types of coverage, number of options offered, creditable coverage status, period covered by the disclosure notice, number of Part D-eligible individuals covered, date the creditable coverage disclosure notice is provided to Part D-eligible individuals and change in creditable coverage status.
CMS has also provided instructions and guidance on how to complete the form.
Disclosures to Individuals
In addition to the annual disclosure to CMS, group health plan sponsors must disclose to individuals who are eligible for Medicare Part D whether the plan’s prescription drug coverage is creditable. At a minimum, creditable coverage disclosure notices must be provided to individuals at the following times:
- Prior to the Medicare Part D annual coordinated election period—beginning Oct. 15 through Dec. 7 of each year
- Prior to an individual’s initial enrollment period for Part D
- Prior to the effective date of coverage for any Medicare-eligible individual who joins the plan
- Whenever prescription drug coverage ends or changes so that it is no longer creditable or becomes creditable
- Upon a beneficiary’s request
If the creditable coverage disclosure notice is provided to all plan participants annually, before Oct. 15 of each year, items (1) and (2) above will be satisfied. “Prior to,” as used above, means the individual must have been provided with the notice within the past 12 months. In addition to providing the notice each year before Oct. 15, plan sponsors should consider including the notice in plan enrollment materials provided to new hires.
CMS has provided model disclosure notices for plan sponsors to use when disclosing their creditable coverage status to Medicare beneficiaries. The model disclosure notices are available on CMS’ website.
Employer Takeaway
To determine if the CMS reporting requirement applies, employers should verify whether their group health plans cover any Medicare-eligible individuals (including active employees, disabled employees, COBRA participants, retirees and their covered spouses and dependents) at the start of each plan year.
Employers that are required to report to CMS should work with their advisor to determine whether their prescription drug coverage is creditable or non-creditable. They should also visit CMS’ creditable coverage website, which includes links to the online disclosure form and related instructions.
Deadline for Updating HIPAA Privacy Notices Is Approaching
The HIPAA Privacy Rule generally requires covered entities (health plans, health care providers and health care clearinghouses) to provide individuals with a Notice of Privacy Practices (or Privacy Notice) to ensure they understand how their protected health information (PHI) may be used and disclosed, as well as their rights with respect to PHI.
A final rule issued by the U.S. Department of Health and Human Services (HHS) requires covered entities to update their Privacy Notices if they receive or maintain patient records regarding substance use disorder (SUD) treatment provided by a federally assisted treatment program (i.e., a “Part 2 program”). Covered entities that receive or maintain Part 2 program records must update their Privacy Notices to include:
- A description of any use or disclosure that is prohibited or materially limited by other applicable laws, including the rules for Part 2 programs;
- A statement that SUD treatment records received from Part 2 programs cannot be used or disclosed in a civil, criminal, administrative or legislative proceeding against the individual without either the individual’s written consent or a court order; and
- If a covered entity intends to use or disclose Part 2 program records for fundraising purposes, a statement that the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
The deadline for updating Privacy Notices for the additional privacy protections for Part 2 program records is Feb. 16, 2026.
Employer Takeaway
Employers that maintain Privacy Notices for their health plans should update them with the changes to SUD treatment records by Feb. 16, 2026. Employers with self-insured health plans should also distribute their updated Privacy Notices by this deadline. Unfortunately, HHS still has not released an updated model notice, so employers should use their best good faith efforts to update and distribute an updated notice by the deadline. If you are enrolled in Higginbotham’s Compliance Dashboard, this item has been added as a task, along with an updated sample model notice for use by your company.
