State PBM Oversight Has Been Growing But Enforcement Still Falls Short: Why Pharmacies Must Step Up

States across the country have made a genuine effort to rein in the conduct of Pharmacy Benefit Managers (PBMs). Legislators have heard the complaints from independent pharmacies, plan sponsors and patient advocates, and they have recognized the unchecked power PBMs wield over reimbursement, audits and network access. As a result, many states have enacted new laws designed to regulate PBMs more directly, increase transparency and promote fairness in the administration of prescription drug benefits.

On paper, the progress looks meaningful. In practice, however, PBMs continue to operate as though many of these laws do not apply to them. And because most state agencies have been reluctant—or simply under-resourced—to enforce the laws they have passed, PBMs often face few consequences for ignoring state requirements. A handful of states, most notably Oklahoma, have shown that strong oversight is possible when regulators take their role into practice. The lesson is clear; pharmacies must report PBM violations if they want meaningful enforcement. Otherwise, PBMs will continue to disregard the rules with little fear of accountability.

The Rise of State PBM Regulation

A wave of legislative activity over the last several years has changed the PBM regulatory landscape. Nearly every state has now introduced or passed bills aimed at creating guardrails for PBM conduct. One of the most significant developments has been the creation of licensure and registration requirements for PBMs. Today, well over thirty states require PBMs to obtain a state license or register with the Department of Insurance before conducting business within state borders. These licensure frameworks usually require PBMs to submit corporate information, disclose affiliated entities, comply with state insurance or pharmacy laws and remain subject to ongoing oversight.

States adopted these requirements because they recognized that PBMs now perform functions similar to insurance carriers and claims administrators. If insurers must be licensed, states reasoned, then PBMs – who administer the pharmacy benefit, handle billions of dollars in drug claims, and exercise enormous control over patient access – must also be licensed. In theory, these laws give state agencies real leverage. A PBM that violates state law risks having its license suspended or revoked, which would disrupt its ability to operate within that state.

Another major area of state regulation involves PBM audit conduct. Most states now have some form of fair audit law designed to prevent PBMs from engaging in unreasonable or predatory audit practices. These laws address issues such as proper notice of audits, the types of documentation a PBM may demand, the time periods during which documentation may be requested, the circumstances under which extrapolation may or may not be used, the need for auditors to consider legitimate dispensing practices and the provision of a meaningful appeals process. States passed these audit protections because PBM audits had become a source of financial and operational instability for pharmacies, with many audits used as pretexts for recoupments or network suspensions.

States have also targeted PBM practices involving spread pricing, MAC price transparency, pharmacy steering, limitations on retroactive post point-of-sale fees and protections for patient choice. They have enacted laws requiring PBMs to disclose reimbursement methodologies, respond to MAC appeals and avoid practices that unfairly discriminate against independent pharmacies. The substance of these laws shows that states are not simply making symbolic gestures; they are attempting to create real, enforceable limits on PBM behavior.

PBMs Continue to Ignore State Requirements

Despite the breadth of these laws, PBMs frequently operate as if compliance is optional. For example, in several states, PBMs have conducted business before completing mandatory licensure or registration. Some file incomplete documentation or fail to update regulators when their corporate structures change. Others attempt to claim exemptions that do not apply to them.

PBMs also routinely undermine state fair audit laws. Pharmacies regularly report audits conducted with inadequate notice, audits demanding documentation outside the state's permitted time window, audits that rely on extrapolation despite clear state prohibitions and audits that refuse to consider substitute documentation even when such documentation is commonly accepted in the industry. In many cases, PBMs use audits as leverage to create cashflow pressure or justify network removals, even when the audits violate clear statutory requirements.

Reimbursement practices often present the same problem. Although many states have enacted MAC transparency laws or protections against below-cost reimbursements, PBMs often continue to pay independent pharmacies at rates that do not cover acquisition costs. Appeals processes, even where mandated by statute, are frequently inadequate or ignored entirely. In states with spread-pricing bans, PBMs have sometimes shifted spreads into affiliated entities such as rebate aggregators or passed them through under different names, with the result that the underlying practice persists despite the statutory language.

In sum, PBMs often will not comply with state law unless a regulator forces them to do so.

Weak Enforcement Has Allowed Violations to Continue

The largest barrier to meaningful reform is not the lack of laws; it is the lack of enforcement. Many Departments of Insurance, Departments of Health and Boards of Pharmacy are dealing with subpar resources to oversee PBMs effectively. PBMs, backed by large corporate parents, bring enormous legal and political power to bear when challenged. As a result, state agencies often hesitate or do not have resources before initiating investigations or imposing sanctions.

Some regulators simply do not fully understand the complexity of PBM practices or the practical effects those practices have on pharmacies and patients. Others may feel constrained by political pressure, particularly when the state's largest insurers or employers contract with PBMs. The result is a familiar pattern: state laws exist, but PBMs continue business as usual because the risk of consequences is low.

But not every state has accepted this status quo. Oklahoma has demonstrated that when regulators choose to enforce the law, PBMs respond.

Oklahoma as a National Model of PBM Accountability

Oklahoma has become one of the clearest examples of how strong enforcement can reshape PBM behavior. In September 2025, the Oklahoma Attorney General announced that the state had secured a settlement exceeding $32 million from CVS Caremark after determining that the PBM had withheld rebates that should have been passed through to the state employee health plan, HealthChoice, from 2020 through 2024. Under the settlement, CVS Caremark agreed to remit more than $32 million, with approximately $27 million going directly to the plan after attorney-fee deductions. The PBM also agreed to remit any additional rebates collected during the same period within ninety days and to pass all future rebates to the plan within ninety days of receipt.

The state strengthened contract definitions to ensure a broader and more comprehensive understanding of what constitutes a "rebate," and it imposed new reporting requirements that will force the PBM to disclose rebate activity on a quarterly basis. The Attorney General stated that this enforcement action reflects Oklahoma's commitment to holding PBMs accountable, safeguarding taxpayer dollars, and ensuring patient access.

Oklahoma's approach proves that strong oversight is possible when regulators take decisive action. It also underscores how PBMs change their conduct quickly when faced with real consequences.

Why Pharmacies Must Report PBM Violations

The uncomfortable truth is that most state regulators only take action when someone brings a violation to their attention. PBM oversight is a complaint-driven system. If pharmacies do not report violations, regulators often assume there are none. PBMs, knowing this, continue practices that contradict state statutes because they expect silence.

When pharmacies document and report violations, however, regulators are prompted to respond. Complaints often lead to investigations, corrective action plans, compliance reviews, and, in some cases, penalties or public enforcement orders. Even when regulators do not immediately impose fines, repeated complaints build a record that can justify future enforcement.

Reporting violations also protects the pharmacies. A documented history of PBM noncompliance can strengthen the pharmacy's position in audit disputes, network termination appeals, Board of Pharmacy matters triggered by PBM complaints, contract negotiations and potential litigation or arbitration. Pharmacies that keep detailed records are better positioned to defend themselves and hold PBMs accountable.

A Call to Action for Pharmacies

State legislatures have done their part by passing meaningful PBM oversight laws. Those laws reflect years of work, decades of advocacy, and the relentless pressure of pharmacies that refused to accept unfair practices as normal. But laws alone are not enough. They require enforcement, and enforcement requires pressure.

Pharmacies must report PBM violations. Regulators cannot act without information, and PBMs will not change without consequences. Oklahoma has proven that PBMs respond quickly when regulators enforce the law. Pharmacies in every state deserve the same level of protection, but they will only get it if they make their voices heard.

The time to act is now. The laws are in place. The tools exist. It is up to pharmacies to ensure that regulators use them.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.