The Most Significant PBM Legislation in Two Decades
The Consolidated Appropriations Act of 2026 is the most significant federal legislation affecting pharmacy benefit management since the creation of Medicare Part D. It designates PBMs as ERISA covered service providers, mandates 100% rebate pass-through, creates semiannual reporting requirements, and gives plan sponsors formal audit rights over PBM compensation.
For self-funded employers, these are not optional compliance considerations. They are legal obligations with real penalties for noncompliance. Most benefits teams are still working through what CAA 2026 actually requires and how to demonstrate compliance. This article provides a plain-language breakdown of the five key provisions, the fiduciary implications, the implementation timeline, and the practical steps plan sponsors should take now.
What CAA 2026 Actually Requires
CAA 2026 contains five major provisions that directly affect how self-funded employer health plans manage their pharmacy benefit.
The first provision designates PBMs as ERISA covered service providers under Section 408(b)(2). This means PBMs must disclose all direct and indirect compensation to plan fiduciaries before entering, extending, or renewing a contract. The disclosure must include rebates, fees, spread pricing, and any other form of remuneration the PBM receives in connection with administering the plan's pharmacy benefit.
The second provision mandates that 100% of manufacturer rebates, fees, alternative discounts, and other remuneration must be passed through to the group health plan. PBMs may no longer retain a share of manufacturer rebates for ERISA plans. This is a structural change to the PBM business model that has relied on rebate retention as a significant revenue source.
The third provision creates semiannual reporting requirements. PBMs must provide reports to plans in plain language and machine-readable format with drug-by-drug data including total claims, plan payments, participant cost-sharing, and gross and net spend. These reports must be detailed enough for the plan sponsor to evaluate whether the PBM's pricing and routing decisions are serving the plan's interest.
The fourth provision gives plan sponsors formal audit rights to verify the accuracy of PBM disclosures. This is not a request mechanism. It is a legal right that the plan sponsor can exercise to validate that the PBM's reported compensation, rebate pass-through, and pricing align with actual transaction data.
The fifth provision requires plans to disclose a summary of PBM compensation to plan participants each plan year. This means the information the PBM provides to the plan sponsor must flow downstream to the people the plan is supposed to serve.
What These Requirements Mean in Practice
Each of these provisions creates an active obligation for the plan sponsor, not a passive one.
The disclosure requirements mean plan sponsors can no longer accept a PBM's summary reporting as sufficient. They must actively request, review, and act on the detailed compensation disclosures that CAA 2026 requires. Receiving the disclosure and filing it is not compliance. Reviewing it, identifying conflicts or concerns, and documenting the plan's response is compliance.
The rebate pass-through mandate means any PBM retaining a portion of manufacturer rebates after the effective date is in violation. Plan sponsors should review their current contracts to determine whether the existing rebate structure meets the 100% pass-through standard and renegotiate if it does not.
The audit right means plan sponsors should be exercising it, not just acknowledging it exists. An ERISA fiduciary who has the right to audit PBM compensation and never exercises that right may face questions about whether the fiduciary acted with the care of a knowledgeable expert.
The participant disclosure requirement means the information flowing to the plan must be reviewed, understood, and communicated downstream in a form that participants can use. This is an operational task that requires internal process and accountability.
The Fiduciary Liability Dimension
CAA 2026 does not just create new PBM obligations. It creates new plan sponsor obligations. By giving fiduciaries the tools to see PBM compensation and audit PBM behavior, CAA 2026 removes the excuse that the plan sponsor lacked visibility.
A fiduciary who receives a CAA 2026 disclosure showing the PBM earned $200 per prescription by routing to its own specialty pharmacy and takes no action has failed to act prudently under ERISA. The standard is not awareness. It is action. The fiduciary must evaluate the disclosed information, determine whether the arrangement serves the plan's interest, and document the analysis and the decision.
This is the core shift that CAA 2026 pharmacy benefit compliance demands. Before the law, fiduciaries could credibly argue that PBM economics were opaque and that they lacked the tools to evaluate them. After the law, that argument is gone. The tools exist. The disclosures are mandatory. The question is whether the self-funded employer uses them and acts on what they reveal.
Noncompliance penalties apply to both PBMs and plan sponsors. The PBM that fails to disclose faces penalties of up to $10,000 per day. The plan sponsor that fails to request disclosures, fails to review them, or fails to act on material findings faces fiduciary liability under ERISA's prudent expert standard.
Effective Dates and Implementation Timeline
Most provisions of CAA 2026 are effective for plan years beginning on or after January 1, 2029, which is 30 months from the date of enactment. The DOL proposed rule on PBM fee disclosure, if finalized, would apply to plan years beginning on or after July 1, 2026.
Plan sponsors should not treat the 2029 effective date as a reason to delay. PBM contracts are typically negotiated on a three-year cycle, and the next renewal may be the last opportunity to align contract terms with CAA 2026 requirements before the effective date. Internal processes for reviewing disclosures, exercising audit rights, and documenting fiduciary decisions take time to build. Starting now means the plan is prepared when the obligations become enforceable, rather than scrambling after the fact.
What Plan Sponsors Should Do Before the Effective Date
Plan sponsors can take three practical steps now to prepare for CAA 2026 compliance.
First, review your current PBM contract against the CAA 2026 disclosure requirements and identify provisions that will need to be renegotiated at the next renewal. Pay particular attention to rebate retention clauses, reporting frequency and granularity, audit rights, and exclusivity provisions that may limit the plan's ability to evaluate alternative channels for high-cost drugs.
Second, request compensation disclosures from your PBM now, even before the mandatory effective date, using the CAA 2021 framework that is already in effect for self-insured plans. The CAA 2021 provisions require broker and consultant compensation disclosure and provide a template that plan sponsors can adapt for PBM disclosure requests. Requesting this information now establishes a baseline and demonstrates proactive fiduciary oversight.
Third, evaluate whether your current pharmacy benefit produces decision-level documentation sufficient to demonstrate prudent oversight under both ERISA and CAA 2026. If it does not, that gap needs to be addressed now, not in 2029. A plan that cannot produce per-prescription records showing how high-cost drug routing decisions were made cannot demonstrate the active oversight that both ERISA and CAA 2026 require.
How Independent Routing Supports CAA 2026 Compliance
An independent pharmacy benefit routing layer addresses the structural gap that CAA 2026 disclosure requirements expose but cannot eliminate. Disclosure tells the plan what the PBM earned. Independent routing ensures the routing decision was made without a financial conflict in the first place. These are complementary capabilities, and together they produce a complete fiduciary record.
Decision-level documentation for every prescription gives the plan sponsor the per-prescription evidence that demonstrates prudent oversight under the CAA 2026 and ERISA standards simultaneously. Each prescription record shows which channels were evaluated, what the net cost was in each channel, which rules were applied, and why the selected channel was chosen. This is the documentation standard that the law contemplates and that most self-funded employers currently cannot produce.
Building the Compliance Foundation Now
ApalyRx produces decision-level documentation for every in-scope prescription, supporting CAA 2026 pharmacy benefit compliance and ERISA fiduciary obligations by design. For self-funded employers preparing for the new compliance requirements, learn how the platform works. For a detailed guide to PBM fiduciary compliance, read the full compliance resource.