A Shifted Landscape
The fiduciary landscape for self-funded employer pharmacy benefits has shifted materially. The Consolidated Appropriations Act of 2026 designated PBMs as ERISA covered service providers, added significant noncompliance penalties, and put plan fiduciaries on notice that drug benefit decisions must be documented and defensible. This is not theoretical risk. It is an active compliance requirement that most benefits teams are not yet meeting.
For years, self-funded employers delegated pharmacy benefit oversight almost entirely to their PBMs. The assumption was that PBM selection and periodic contract renegotiation constituted sufficient fiduciary diligence. That assumption no longer holds. The regulatory and legal environment now demands that plan fiduciaries demonstrate, with evidence, that prescription routing decisions serve the interest of plan participants. The employers who adapt to this standard will be protected. Those who continue to rely on delegation alone will carry personal liability that grows with every undocumented routing decision.
What ERISA Actually Requires of Plan Fiduciaries
ERISA's prudent expert standard requires plan fiduciaries to act with the care, skill, and diligence that a knowledgeable expert would exercise in the same circumstances. Applied to pharmacy benefits, this means the fiduciary must be able to demonstrate that routing decisions were made in the interest of plan participants. It means all available channels were evaluated. And it means the selected channel represented the lowest net cost for the plan.
This standard is not new. It has governed retirement plan investments for decades, and the courts have developed a clear body of case law around what constitutes prudent oversight. An investment fiduciary who placed plan assets in a single fund without evaluating alternatives would face immediate liability. The pharmacy benefit equivalent is a plan that routes every prescription through a single PBM channel without evaluating whether manufacturer-direct, independent pharmacy, or other supply paths offer a lower net cost.
Historically, the practical enforcement of this standard in pharmacy benefits was limited. PBMs were not classified as covered service providers, disclosure requirements were minimal, and the opacity of the rebate chain made it difficult for anyone to challenge specific routing decisions. That has changed.
What CAA 2026 Changed
CAA 2026 expanded ERISA's covered service provider definition under Section 408(b)(2) to include PBMs and TPAs. This single change created a cascade of new obligations.
PBMs must now disclose all direct and indirect compensation, including spread pricing, rebate retention, and fees from affiliated pharmacies. They must pass through 100 percent of rebates to the plan. They must provide detailed semiannual reporting on drug costs, utilization, and rebate flows. Noncompliance carries penalties of up to $10,000 per day, and the DOL has signaled active enforcement intent.
For benefits directors and HR teams at self-funded employers, the practical effect is significant. The plan sponsor can no longer treat the PBM relationship as a set-and-forget vendor contract. CAA 2026 expects active oversight. The plan fiduciary must review the PBM's compensation disclosures, evaluate whether the PBM's routing decisions serve the plan's interest, and maintain records showing that oversight was conducted. Passive reliance on PBM reporting is no longer a defensible position.
The DOL's proposed rule on pharmacy benefit fiduciary obligations reinforces this direction. It clarifies that plan fiduciaries have an ongoing duty to monitor service providers and to act when monitoring reveals conflicts of interest or suboptimal outcomes. The combination of CAA 2026 and the proposed rule creates a regulatory framework that expects the same level of fiduciary rigor for pharmacy benefits that has long been required for retirement plan investments.
The Documentation Problem
Most self-funded employers cannot produce decision-level documentation proving that any given prescription was routed to the lowest net cost. They have PBM reports showing aggregate rebates and average net costs across a population over a quarter. They do not have per-prescription records showing which channels were evaluated, what rules were applied, and why the winning channel was selected for each individual script.
That gap is the fiduciary exposure. If a plan participant, a regulator, or a plaintiff's attorney asks how a specific high-cost drug routing decision was made, the current answer for most employers is some variation of "we trusted our PBM." Under ERISA's prudent expert standard, that answer is insufficient. It is the equivalent of an investment fiduciary saying "we trusted our broker" when asked why plan assets were placed in a high-fee fund when lower-cost alternatives were available.
The problem is structural, not a matter of effort. Standard PBM reporting is designed to show aggregate outcomes, not individual decision rationale. The PBM's internal routing logic is proprietary. The plan sponsor receives summary data after the fact, not real-time visibility into the decision process. Even a diligent benefits director working with a cooperative PBM cannot produce the per-prescription documentation that the prudent expert standard contemplates, because the PBM's systems were not built to generate it.
This is not a criticism of any specific PBM. It is a description of how the current infrastructure works. The reporting tools that exist today were designed for a regulatory environment that did not require decision-level proof. That environment has changed, and the infrastructure must change with it.
Direct Drug Channels and the Fiduciary Duty to Evaluate Them
As manufacturer-direct and direct-to-employer pharmacy channels become operational, plan fiduciaries face an additional obligation: the duty to evaluate these alternatives. ERISA's prudent expert standard does not allow a fiduciary to ignore a potentially lower-cost channel simply because adopting it requires operational change.
This does not mean every self-funded employer must immediately adopt a DTE program. It means the decision to stay with the current model must itself be documented and justified. If a manufacturer offers direct pricing on a GLP-1 medication at 30 percent below the PBM's net cost, and the plan fiduciary never evaluates that option, the fiduciary has a documentation problem. The question in any subsequent review or litigation will be straightforward: did the fiduciary consider all available channels, and can they show their work?
The emergence of direct-to-employer pharmacy programs has made this duty concrete. When no alternatives existed outside the PBM channel, the fiduciary's obligation to evaluate alternatives was largely academic. Now that operational, compliant DTE infrastructure exists and is serving employer populations at scale, the fiduciary cannot claim ignorance of the option. The pharmacy benefit fiduciary must evaluate these channels on their merits and document the decision either way.
What Fiduciary-Grade Documentation Looks Like
For each in-scope prescription, fiduciary-grade decision-level documentation answers a specific set of questions. Which channels were available for this drug and this member? What was the net cost in each channel after all pricing adjustments? What program rules were applied, including cost share, prior authorization, and utilization management criteria? Which channel was selected? And why was it selected over the alternatives?
This is the pharmacy benefit equivalent of an investment committee memo. It transforms a routing decision from a black-box outcome into an auditable record. If a regulator, a participant, or a plaintiff asks why a specific prescription was routed through a specific channel, the plan sponsor can produce a document showing the analysis, the alternatives considered, and the basis for the decision.
This standard is achievable with the right pharmacy benefit infrastructure. A platform that evaluates multiple channels in real time, applies the employer's configured rules, selects the lowest net cost option, and records the entire decision process can generate this documentation automatically for every prescription. The record is created at the point of decision, not reconstructed after the fact from aggregate data.
Standard PBM reporting cannot meet this standard. PBMs report what happened in their channel. They do not report what would have happened in a channel they do not operate. They do not produce comparative analysis across channels they do not control. And they do not generate per-prescription records showing why their channel was selected over alternatives, because their systems evaluate options within their own network, not across structurally independent supply paths.
The gap between what PBM reporting provides and what ERISA's prudent expert standard requires is the central compliance challenge for every pharmacy benefit fiduciary at a self-funded employer today. Closing that gap requires infrastructure that was built for the task.
Meeting the Standard by Design
ApalyRx produces decision-level documentation for every in-scope prescription. The platform evaluates all activated channels in real time, applies the employer's program rules, routes to the lowest net cost, and generates a complete record of the decision. For self-funded employers seeking to meet ERISA's prudent expert standard for pharmacy benefit fiduciary oversight, learn how the platform works.