The Blind Spot Is Closing
ERISA has always imposed fiduciary obligations on self-funded employer health plans. But for most of the law's history, pharmacy benefits existed in a practical blind spot. Plan sponsors delegated pharmacy benefit management to their PBM, assumed the arrangement was reasonable, and rarely faced scrutiny over individual prescription decisions.
That era is ending. CAA 2026 designated PBMs as ERISA covered service providers, added significant noncompliance penalties, and made clear that plan fiduciaries can no longer treat pharmacy benefits as a black box. The question is no longer whether fiduciaries are responsible for pharmacy benefit decisions. It is whether they can prove each decision was made in the plan's interest.
For every self-funded employer with a pharmacy benefit, the fiduciary exposure is real, personal, and growing. This article explains what the law actually requires, what changed in 2026, and what practical steps a benefits director or plan trustee should take now.
What ERISA's Prudent Expert Standard Actually Requires
ERISA requires plan fiduciaries to act with the care, skill, prudence, and diligence of a knowledgeable expert familiar with such matters. This is not a vague aspiration. It is a legal standard that courts have interpreted with increasing specificity over four decades of retirement plan litigation. The same standard now applies with full force to pharmacy benefits.
For pharmacy benefits, the prudent expert standard means the fiduciary must be able to demonstrate three things. First, that all available options for high-cost drug fulfillment were evaluated, not just the PBM's default channel. If manufacturer-direct pricing, independent pharmacy fulfillment, or other supply paths exist for a given drug, the fiduciary must show those alternatives were considered. Second, that the selected option represented the lowest net cost, or that a documented rationale exists for why a higher-cost option was chosen. There may be legitimate clinical or operational reasons to select a channel that is not the absolute lowest cost, but those reasons must be recorded. Third, that the decision-making process is documented at the individual prescription level, not just in aggregate reports.
Most self-funded employers currently cannot demonstrate any of these three things for a specific high-cost prescription. They can show that they selected a PBM through a competitive process. They can show aggregate savings reports. But they cannot show that a specific GLP-1 prescription filled last Tuesday was evaluated across all available channels and routed to the lowest net cost. That gap between what the law requires and what the employer can prove is the ERISA fiduciary pharmacy benefit exposure.
What CAA 2026 Changed
CAA 2026 made several changes that directly affect pharmacy benefit fiduciary obligations. It designated PBMs as ERISA covered service providers under Section 408(b)(2), requiring them to disclose direct and indirect compensation including rebates, fees, and spread. It mandated 100% rebate pass-through for ERISA plans. It created semiannual reporting requirements on drug costs, utilization, and rebate flows. It gave plan sponsors audit rights over PBM compensation arrangements. And it established noncompliance penalties of up to $10,000 per day that apply to both PBMs and plan sponsors who fail to exercise adequate oversight.
The practical effect is significant. Before CAA 2026, a plan fiduciary could argue with some credibility that PBM compensation structures were opaque and that the fiduciary lacked the tools to evaluate them. That argument no longer holds. CAA 2026 gives fiduciaries the legal right to see PBM compensation in full. Failing to exercise those rights and act on what they reveal is itself a fiduciary breach.
The DOL has signaled active enforcement intent. The proposed rule on pharmacy benefit oversight clarifies that fiduciaries have an ongoing duty to monitor pharmacy benefit service providers and to take corrective action when monitoring reveals conflicts of interest or suboptimal outcomes. For benefits directors and HR teams at self-funded employers, this means pharmacy benefit oversight is no longer a set-and-forget vendor management task. It is an ongoing fiduciary obligation with personal liability attached.
The Documentation Gap Most Employers Have
Even employers who have reviewed their PBM contracts, requested compensation disclosures under CAA 2026, and renegotiated rebate terms typically lack the most critical piece of fiduciary documentation: per-prescription records showing how each high-cost drug routing decision was made.
Aggregate reporting does not close this gap. A report stating that the plan saved 20% on specialty drugs overall does not demonstrate that any specific prescription was routed to the lowest net cost. It is an average across a population over a time period. It cannot answer the question that a regulator, a plan participant, or a plaintiff's attorney will ask: how was this specific prescription for this specific member handled, and can you show me the analysis?
Standard PBM reporting is designed to show what happened in the PBM's channel. It does not show what would have happened in a channel the PBM does not operate. It does not produce comparative analysis across structurally independent supply paths. And it does not generate per-prescription records showing why the PBM's channel was selected over alternatives. This is not a failure of any specific PBM. It is a structural limitation of reporting systems that were designed for a regulatory environment that did not require decision-level documentation.
The environment has changed. The documentation requirements have not caught up for most employers.
What Fiduciary-Grade Documentation Looks Like
For each in-scope prescription, a fiduciary-grade record should show which channels were evaluated for that specific drug and member, what the net cost was in each channel at the time of the decision, which program rules were applied, which channel was selected, and why. This is the pharmacy benefit equivalent of an investment committee memo documenting a trade execution.
The record does not need to be elaborate. It needs to be complete, contemporaneous, and per-prescription. Complete means all available channels were included in the evaluation. Contemporaneous means the record was created at the point of decision, not reconstructed months later from aggregate data. Per-prescription means each high-cost drug decision has its own record, not a summary across the population.
Aggregate quarterly reports and annual PBM performance reviews do not substitute for decision-level documentation. They serve a different purpose. They help the employer understand population-level trends and negotiate future contract terms. They do not prove that any individual decision was made prudently. Under ERISA's prudent expert standard, the individual decision is what matters.
This standard of documentation is achievable with the right pharmacy benefit infrastructure. A platform that evaluates multiple channels in real time, applies the employer's configured rules, routes to the lowest net cost, and records the entire decision process can generate this documentation automatically for every prescription. The technology exists. The question is whether the self-funded employer has implemented it.
The Manufacturer-Direct Channel Evaluation Requirement
As manufacturer-direct and direct-to-employer drug programs become operational, plan fiduciaries face an additional obligation under the prudent expert standard: the duty to evaluate these alternatives alongside traditional channels.
A fiduciary who knows that a lower-cost channel exists for a high-cost drug and makes no effort to evaluate it is not acting with the care of a knowledgeable expert. When Lilly offers Zepbound at $449 per month through its Employer Connect program and the plan is paying $750 or more through the PBM channel, the fiduciary has an obligation to at least evaluate the alternative. Ignoring it because it requires operational change is not a defensible position under ERISA.
This does not mean the plan must adopt every new model. There may be legitimate reasons to remain in the current channel for a specific drug: clinical considerations, member disruption, or contract obligations that cannot be modified in the near term. But the decision to stay with the current model must be documented and justified on the specific facts. A blanket policy of not evaluating new channels is precisely the kind of passive approach that CAA 2026 was designed to end.
Meeting the Standard by Design
ApalyRx produces decision-level documentation for every in-scope prescription. The platform evaluates all activated channels in real time, applies the employer's program rules, routes to the lowest net cost, and generates a complete per-prescription record of the decision. For self-funded employers seeking to meet ERISA's prudent expert standard for pharmacy benefit oversight, learn how the platform works. For a detailed guide to PBM fiduciary compliance under CAA 2026, read the full compliance resource.