Proposed Regulations Would Require Extensive Disclosures From PBMs

On January 30, 2026, the Department of Labor (DOL) published proposed regulations adding new health plan disclosures under the ERISA prohibited transaction exemption requirements set forth in ERISA section 408(b)(2). If finalized in their current form (which, following passage of CAA 2026 might be unlikely) PBMs will be required to provide new disclosures detailing the compensation they receive in connection with a group health plan contract.

The proposed regulations seem to be on an unusually fast track towards adoption. Although published at the end of January 2026, comments are due by the end of March. It appears that the DOL intends to quickly finalize the regulations so that the regulations can apply for plan years starting on or after July 1, 2026. If the DOL sticks to this aggressive timeline, PBMs for some non-calendar-year plans will likely have only a few months (maybe less) to come into full compliance and plan fiduciaries may start receiving reports later this year or early in 2027.

Generally, the regulations apply to group health plans that are self funded, including excepted benefits such as "retiree-only" plans. Fully insured group health plans are currently exempt, although the DOL did consider whether to include them under the Proposed Regulation.

While the regulations apply to group health plans, the bulk of the compliance obligations will fall on a plan's service providers – namely the PBM, though others could be captured due to the broad definition of a "covered service provider." Covered Service Providers are, in general, entities that receive $1,000 or more in compensation, directly or indirectly, for services that are "in connection with" providing "pharmacy benefit management services" and those entities that provide "advice, recommendations or referrals regarding the provision of pharmacy benefit management services."

The definition clearly applies to a PBM but is broad enough to potentially include other plan service providers such as TPAs, brokers and consultants who provide "recommendations" related to PBM services. Importantly, brokers and consultants remain subject to disclosures under ERISA 408(b)(2) as well as under the Proposed Regulations if they also meet the definition of a Covered Service Provider.

Covered Service Providers must report a variety of information in the Initial Disclosure (e.g., when first entering into the contract with the plan/plan sponsor), including: a description of services, essentially all compensation the Covered Service Provider receives regardless of source, disclosure of formulary placement incentives, explanation of formulary authority, confirmation of fiduciary status (if applicable), description of drug cost to the plan, conflict of interest disclosure, and statement of audit rights. Covered Service Providers must also provide Semiannual Disclosures, of essentially the same information, to the plan/plan sponsor. Notably, the Semiannual Disclosure will also disclose differences in the expected and annual compensation received.

In addition to detailing the disclosure obligations, the Proposed Regulations also add specific audit rights available to plan sponsors, including the right to select the auditor. The Covered Service Provider is prohibited from paying for the audit and from imposing conditions that have the effect of restricting the plan's right to audit.

As noted above, the Proposed Regulations amend the regulations implementing the ERISA prohibited transaction exemptions. That is, for a contract between a plan and a Covered Service Provider to be considered reasonable and exempt from the ERISA prohibited transaction rules, the plan must receive the above-described disclosures so that the plan fiduciaries can confirm the compensation paid to the Covered Service Provider is reasonable. Recognizing plans might not always be well positioned to force a disclosure, the Proposed Regulations provide that if the Covered Service Provider fails to meet the applicable requirements of the Proposed Regulation, the plan fiduciary is not liable for a breach of ERISA's prohibited transaction rules if:

1. Fiduciary Did Not Know. Fiduciary did not know that the Covered Service Provider failed or would fail to meet the requirements of the Proposed Regulation, and the fiduciary reasonably believed that the requirements had been met.
2. Fiduciary Requests Correction. Upon discovery of the failure, the fiduciary requests in writing that the error be corrected.
3. Fiduciary Notifies DOL. If the Covered Service Provider fails to correct the error within 90 calendar days of the request, the fiduciary must notify the DOL of the failure. The notice to the DOL must be filed within 30 calendar days of earlier of: (1) the Covered Service Provider's refusal to correct the error; or (2) 90 calendar days after the written request from the fiduciary.

Fiduciaries should consider how best to evaluate the information in a usable manner. Because the disclosure is a necessary element of the ERISA prohibited transaction exemption, fiduciaries must review the information; it is not sufficient to simply receive and file the disclosure. We expect that plan sponsors will need to engage an expert to assist with reviewing the disclosures, whether that is the plan's current consultant or engaging a prescription-drug-specific consultant.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.