Banner artwork by Viktoriia_M / Shutterstock.com
When we published our 2022 analysis of ERISA group health plan disclosure obligations, the Consolidated Appropriations Act of 2021 (CAA-21) had just codified new transparency requirements for brokers and consultants. The question then was what those obligations meant in practice. We now have more answers and a clearer path forward.
The pharmacy benefit management (PBM) industry is undergoing the most significant regulatory transformation in its history. Two federal developments, the enactment of the Consolidated Appropriations Act of 2026, H.R. 7148 (CAA-26), signed into law on February 3, 2026, and the Department of Labor’s proposed rule under ERISA §408(b)(2) (DOL Proposed Rule), together establish a comprehensive transparency framework that will fundamentally reshape how plan fiduciaries engage with and monitor their PBMs.
For the first time, federal law provides a detailed road map of what a compliant PBM arrangement looks like. Plan fiduciaries now have a statutory checklist against which their contracts and oversight practices will be measured. The question is no longer what transparency means in theory, it is whether existing PBM contracts measure up to the new legal standard.
This article synthesizes the legal and regulatory requirements of these new rules with real-world contract review findings to provide employer plan fiduciaries, benefits counsel, and HR professionals with both the substantive knowledge and actionable steps needed to help fulfill their fiduciary duties in this new environment.
Background
CAA-26 enacted comprehensive transparency requirements specific to PBMs and other health plan service providers by amending ERISA §408(b)(2)(B), the provision added by CAA-21, to extend its compensation disclosure requirements beyond brokers and consultants to PBMs, third-party administrators, and other health plan service providers.
As applied to PBMs, these reforms include threshold-based reporting requirements for rebates, fees, and all other manufacturer remuneration (applying to drugs with more than $10,000 in gross spending during the reporting period or, where that test yields fewer than 50 drugs, to the top 50 drugs by plan spend, with the drug-level detail required only for specified large employers and specified large plans); mandatory semiannual reporting of spread pricing, rebate, and compensation data to group health plans; a prohibition on PBMs paying for, subsidizing, or providing credits toward audit costs; and a requirement that 100 percent of rebates, fees, alternative discounts, and other remuneration pass through to plans on a quarterly basis. Bona fide service fees, as defined under amended §408(b)(2)(B), are the only permitted exception to this pass-through requirement.
Separately, the DOL Proposed Rule requires covered service providers, including PBMs, to disclose all direct and indirect compensation, including manufacturer payments, rebate arrangements, pharmacy clawbacks, and administrative fees, before a health plan services contract is established or renewed, with semiannual updates thereafter. As proposed, the rule reaches only self-funded ERISA group health plans and does not apply to governmental or church plans. It also addresses audit rights that permit plan fiduciaries to verify the accuracy of disclosures without PBM-imposed restrictions. The comment period on the DOL Proposed Rule closed on April 15, 2026, after a 15-day extension, and we are waiting on issuance of final regulations which will likely be harmonized with the new requirements in CAA-26. Plan fiduciaries should monitor the publication of the final rule, which may modify or clarify several provisions discussed below.
Taken together, these developments do something the prior rules did not: they describe, in statutory and regulatory detail, what an ERISA-compliant PBM arrangement looks like. Plan fiduciaries now have a checklist and the tools to see how their existing contracts measure up.
What needs to change: Your contract
Analysis of 37 employer-held PBM contracts by Nautilus Health Institute (Nautilus) across a range of employer types and PBM business models found that most will require significant changes to meet the new legal requirements.
Contract analysis by Nautilus, using fiduciary-aligned standards derived from ERISA, CAA-21, CAA-26, and the disclosure framework under the DOL Proposed Rule found gaps across pass-through, transparent, and traditional spread-pricing PBM arrangements. The findings outlined below revealed specific gaps that may expose plan fiduciaries to liability under the new legal framework.
- Audit rights. The median score on audit rights across the 37 employer-held contracts reviewed by Nautilus was 35 out of 100, and 65 percent scored in the Red Flag band, below 45. None reached the Good band of 75 to 89, and the highest score among them was 68. Several contracts contained auditor gag clauses: provisions barring the employer's own auditor from reporting findings back to the employer who commissioned and paid for the audit. Under CAA-26, PBMs are now expressly prohibited from paying for or subsidizing audit costs. The DOL's Proposed Rule includes an audit cost-split provision (proposed as a 50/50 allocation, subject to change in the final rule), but CAA-26 sets a stricter standard: PBMs may not pay any portion of audit costs. The DOL extended the comment period on the proposed rule by 15 days specifically to take input on how the rule should account for the CAA-26 amendments. Contracts that restrict audit scope or auditor independence are directly in tension with both CAA-26 and the DOL Proposed Rule.
- Data ownership. 76 percent of the 37 employer-held contracts reviewed by Nautilus scored in the Red Flag band on data ownership, where the median was 40 out of 100. Several contained irrevocable assignments of de-identified claims data to the PBM, meaning the employer's own claims data, stripped of identifying information, was assigned to the PBM for commercial use with no compensation or consent requirement. A fiduciary who has not secured explicit ownership of and access to plan data and restricted its commercial use has left a significant governance gap unaddressed.
- Carve-out rights. The median score on carve-out rights, meaning the ability of the plan sponsor to carve out specific services or add-on programs to other vendors, was 20 out of 100 across the 37 employer-held contracts. 84 percent scored in the Red Flag band and none reached 75. Several contracts contained blanket repricing triggers: if an employer directed even a single drug to an outside vendor or alternative funding program, the PBM retained the right to reprice the entire remaining contract retroactively. One contract prohibited employer participation in alternative funding programs entirely. These provisions directly impair a plan fiduciary's ability to act on information and seek lower-cost alternatives, which is precisely the obligation the new transparency rules are designed to enable.
- Termination and clean exit. The median score on termination and clean exit, meaning the plan sponsor's ability to leave the contract without financial penalty, was 48 out of 100 across the 37 employer-held contracts. 46 percent scored in the Red Flag band. Of the contracts reviewed, the dominant pattern was rebate forfeiture on exit: contracts that condition the right to terminate on surrendering rebates already earned, and in several cases on waiving any final reconciliation. Other contracts deterred exit structurally rather than financially, through multi-year lock-ins, notice periods running past twelve months, or run-out administration priced at one hundred fifty percent of three months of fees. Several of the contracts described termination fees as a measure of anticipated harm to the vendor rather than recovery of any stated cost. One contract stacked all three mechanisms, a full rebate forfeiture, a three-year lock-in, and repayment of administrative credits, which together make exit economically difficult for the plan sponsor to terminate early. Rebates earned under a contract before a termination date could be construed as ERISA plan assets depending on the funding arrangement and terms of the plan. Thus, conditioning the exit right on forfeiting rebates arguably converts a termination right into a termination penalty which is not considered a reasonable fee under ERISA.
- Formulary management. 86 percent of the 37 employer-held contracts reviewed by Nautilus scored in the Red Flag band on lowest net cost and formulary management, where the median was 35 out of 100 and no contract exceeded 50. One contract explicitly reserved the right to penalize the plan if formulary changes were made "for the purpose of achieving lower net drug cost." Under CAA-26, PBMs must report drug-level pricing, rebate, and spending detail to group health plans, and the DOL Proposed Rule would require disclosure of formulary-related incentives. The CAA-26 drug-level obligation is threshold-based: it applies to drugs with more than $10,000 in gross spending during the reporting period or, where that test yields fewer than 50 drugs, to the top 50 drugs by plan spend, and only for specified large employers and specified large plans. A contract that actively penalizes cost optimization is directly in tension with the intent of the statutory reporting requirement.
Health plan fiduciary exposure
The significance of these findings is not merely that contractual rights are misaligned; it is that the legal framework set by these new transparency requirements creates an explicit road map against which a plan fiduciary's conduct will be measured.
The legal framework set by these new transparency requirements create an explicit roadmap against which a plan fiduciary's conduct will be measured.
Plan fiduciaries should start now to assess compliance gaps in their PBM contracts before the CAA-26 and DOL Proposed Rule implementation dates. CAA-26 and the DOL's Proposed Rule codify and enhance fiduciary obligations already imposed by ERISA. Namely, the duty of prudence under ERISA §404(a) has always required fiduciaries to act with the care, skill, diligence, and prudence of a knowledgeable person in determining the reasonableness of service provider arrangements and ERISA fiduciaries today are required to assess the reasonableness of fees paid out of plan assets. Thus, a plan fiduciary already has a fiduciary obligation to ensure that PBM arrangements have strong audit rights and clear disclosure from vendors of all direct and indirect fees earned from the arrangement. The new rules describe, in statutory and regulatory detail, what prudent PBM contracting actually requires.
With these new tools, plan sponsors will have additional leverage to negotiate around spread pricing, restricted audit rights, and undisclosed manufacturer payments. A plan fiduciary who becomes aware of these gaps through a contract review and takes no corrective action before the next renewal has documented knowledge of a deficiency and a record of inaction. That is precisely the fact pattern that is at risk in ERISA fiduciary litigation.
The exposure is not merely theoretical. Under ERISA §502(a)(2), plan participants may bring suit against fiduciaries for breach of duty, and §409 makes a breaching fiduciary personally liable to make good to the plan any losses resulting from the breach. Courts may also award appropriate equitable relief, including surcharge, under §502(a)(3). The DOL’s enforcement authority further amplifies this risk, as the Department has historically pursued fiduciary breach actions where plan sponsors failed to adequately monitor service provider compensation.
What plan sponsors and their counsel should do now
Plan sponsors and their legal counsel should treat the current period, before implementation timelines of CAA-26 and the DOL Proposed Rules fully take effect, as an opportunity to perform a gap analysis on their PBM contracts. The law provides a detailed road map of what compliant PBM contracting looks like. Plan sponsors should take the following steps now:
1. Conduct a contract review against the new statutory framework. Map your current PBM agreement against the specific requirements of CAA-26 and the DOL's Proposed Rule disclosure framework, as finalized. Identify gaps. Document the review.
2. Assess auditor independence. If your contract requires PBM approval of the auditor, limits audit scope, or contains any provision restricting what the auditor can report to you, those provisions are likely in tension with CAA-26 upon its effective date. The statute prohibits PBM payment of any portion of audit costs, and the DOL's Proposed Rule addresses audit rights but has not yet been harmonized with this stricter statutory standard which we anticipate when the final rule is issued.
3. Confirm data ownership and access. Review whether your contract contains explicit terms regarding plan ownership of or access to claims data, restrictions on PBM commercial use of de-identified data, and unrestricted access to claims information.
4. Evaluate carve-out rights. If your contract contains exclusivity provisions, blanket repricing triggers, or restrictions on alternative funding programs, those provisions may impair your ability to fulfill your fiduciary duty to seek reasonable costs from other service providers. Document the limitation and its financial implications.
5. Evaluate termination rights. If your contract contains an early termination penalty, examine whether it is commensurate with the business impact. Reimbursement for amortized upfront costs may be reasonable. Recapture of rebates may be unreasonable relative to the cost.
6. Review fee disclosure against the CAA-26 bona fide service fee standard. All PBM compensation, including manufacturer payments, rebate arrangements, and any other remuneration, should be documented and assessed for reasonableness and disclosed to the plan sponsor annually. Under the amended §408(b)(2)(B), bona fide service fees are the only permitted exception to the law’s full pass-through requirement. Any compensation structure that does not meet this exception requires scrutiny.
7. Score your contract against the fiduciary-aligned analytical standard. The CAA-26 framework, combined with existing ERISA fiduciary duties, defines what a reasonably prudent PBM arrangement looks like. The first step is a systematic evaluation of your current agreement against that standard, provision by provision, including audit rights, data ownership, carve-out rights, formulary management, fee transparency, and pass-through compliance. Documentation of your analysis should become part of your ERISA procedural prudence record.
8. Document everything. Whether your contract review results in immediate remediation, a renegotiation timeline, or a decision to go to market, the documentation of a prudent and systematic process is the foundation of any fiduciary defense.
9. Implementation timeline considerations. CAA-26's rebate pass-through, standardized reporting, and audit requirements apply to contracts entered into, extended, or renewed for plan years beginning on or after August 3, 2028, which is January 1, 2029 for calendar-year plans. The expansion of covered service provider status to PBMs appears to be effective now, so the §408(b)(2) compensation disclosure requirement already reaches contracts entered into, extended, or renewed on or after February 3, 2026. Plan sponsors should not treat 2029 as the sole compliance deadline. The DOL’s final rule, once issued, will establish its own effective date and transition period. Fiduciaries should map their next contract renewal date against these overlapping timelines and use the intervening period to negotiate contract amendments or prepare for competitive bidding.
Plan sponsors and their legal counsel should treat the current period, before implementation timelines of CAA-26 and the DOL Proposed Rules fully take effect, as an opportunity to perform a gap analysis on their PBM contracts.
Looking ahead
The convergence of legislative and regulatory action on PBM transparency represents a watershed moment for plan sponsors. These developments will provide fiduciaries with unprecedented visibility into PBM compensation structures and practices, giving them the ability to better negotiate and monitor drug and PBM pricing.
However, this increased information flow will necessitate enhanced monitoring and oversight obligations, new reporting and disclosure procedures, and a heightened standard of care against which fiduciary conduct will be measured. With additional transparency and audit tools available to plan sponsors, failure to monitor and audit PBMs, avoid conflicts of interests, and determine reasonableness of compensation paid to PBMs will come with heightened risk of DOL audits and participant class action lawsuits under ERISA. Plan sponsors who begin preparing now will be better positioned to meet their fiduciary obligations under these new rules.
With additional transparency and audit tools available to plan sponsors, failure to monitor and audit PBMs, avoid conflicts of interests, and determine reasonableness of compensation paid to PBMs will come with heightened risk of DOL audits and participant class action lawsuits under ERISA.
Legal disclaimer
This article is for informational purposes only and does not constitute legal advice. The analysis and recommendations in this article are based on the statutory framework of CAA-26 and related ERISA provisions, as of the date of publication. Plan fiduciaries should consult with qualified ERISA counsel and professional advisors regarding their specific contractual arrangements, fiduciary obligations, and compliance with applicable law. The information provided does not create an attorney-client relationship and does not substitute for legal counsel. Reliance on this article without consultation with qualified advisors is at the reader's own risk. The authors do not represent or endorse Nautilus Health Institute or its study referenced herein. References to the Nautilus Health Institute study are included solely for informational purposes and do not constitute an endorsement.
The CAA 2026 Readiness Report was prepared by Nautilus Health Institute examining 27 PBM standard contract templates and 37 plan sponsor signed contracts in effect 2024-2026. Contracts are scored zero to one hundred on each of ten provisions and overall, with results reported in five bands: Excellent (90 to 100), Good (75 to 89), Fair (60 to 74), Concern (45 to 59), and Red Flag (below 45). The full report and methodology are available at contractxray.com. The authors have not independently verified the methodology or findings of this study. The sample size, while representative, is limited, and the results should be considered illustrative rather than exhaustive.
Disclaimer: The information in any resource in this website should not be construed as legal advice or as a legal opinion on specific facts, and should not be considered representing the views of its authors, its authors’ employers, its sponsors, and/or ACC. These resources are not intended as a definitive statement on the subject addressed. Rather, they are intended to serve as a tool providing practical guidance and references for the busy in-house practitioner and other readers.
