What benefits leaders need to know about CAA 2026—and why compliance isn't enough.
The Consolidated Appropriations Act (CAA) of 2026 is the most significant federal PBM reform in years, creating new obligations for employers and PBMs. While the compliance deadline isn't until January 1, 2029, most PBM contracts run three years. The decisions you make at your next renewal will determine what you're locked into when the law takes effect.
Key highlights:
- Signed into law: February 3, 2026
- Full compliance deadline: January 1, 2029
- Covers all employer-sponsored health plans with PBM arrangements
- Penalty for noncompliance: Up to $10,000/day; $100,000 for false disclosures
- Rightway is already compliant with all four requirements
- Compliance does not prohibit vertical integration between PBMs, pharmacies, and insurers
What changed.
Congress turned best-practice PBM contracting into a federal requirement. Four things matter most:
1. 100% rebate pass-through.
- Any contract without full pass-through exposes the plan sponsor to personal liability under ERISA.
- All rebates, discounts, fees, and any other payments received from drug manufacturers or pharmacies must go to your plan, paid out quarterly.
- Spread pricing, where your PBM charges the plan more than it pays the pharmacy and keeps the difference, is effectively prohibited for covered plans.
2. Semiannual drug-level reporting.
- If your plan has 100+ employees, your PBM must deliver machine-readable reports every six months, or quarterly on request.
- These cover gross and net drug spend, PBM compensation, formulary decisions, rebate data, and affiliated pharmacy pricing comparisons.
- All plans, regardless of size, receive a plan-level summary.
3. Annual audit rights.
- Plan sponsors have the right to audit PBM compensation-related disclosures and rebate remittances at least once per plan year.
- The plan sponsor selects the auditor.
- The PBM cannot pay for it, and may not restrict, limit, or veto that choice.
- Plan sponsors who do not exercise available audit rights may face heightened scrutiny in the event of a fiduciary breach inquiry.
4. PBMs as ERISA fiduciaries.
- PBMs must disclose all direct and indirect compensation.
- Plan sponsors who fail to obtain and act on required disclosures face the same liability as the PBM.
Compliant isn't the same as aligned.
CAA 2026 requires rebate pass-through and more detailed reporting, but it does not eliminate ownership-driven conflicts or guarantee lowest-net-cost formulary design. Here's why:
- A PBM can meet every disclosure deadline and still steer utilization toward affiliated pharmacies or products that are not optimal for the plan.
- CAA 2026 gives plan sponsors visibility, but managing conflicts of interest still remains their fiduciary responsibility.
Rightway isn't adjusting for CAA 2026, because there's nothing to adjust.
Most PBMs are spending 2026-2028 retrofitting disclosure processes, rebate flows, and audit workflows onto a business model that was built to obscure them. Rightway doesn't own any part of the pharmacy supply chain, so there's no conflicted incentive sitting underneath the numbers to begin with.
Disclaimer: This communication is provided for informational purposes only and does not constitute legal advice. Employers should consult with legal or compliance advisors regarding their specific obligations under applicable law.
