Understanding PBM legislation and regulatory compliance.

PBM legislation is moving faster than most employers can track. A new federal law now sets rebate and reporting rules for your plan; a proposed federal rule would add disclosure requirements on top of them, and employers are already facing lawsuits over how they manage their pharmacy benefits. Together, these developments determine how your plan should operate to maintain your fiduciary responsibility.

You don't need to track every bill or court filing to stay protected. You need to know which requirements apply now, which ones are coming, and what your contract needs to say before your next renewal locks you in for another three years.

Key highlights:

• PBM legislation is the body of federal and state law that governs how pharmacy benefit managers price drugs, disclose compensation, and report data to plan sponsors.
• Several regulatory fronts are converging on employers at once, spanning enacted federal law, a proposed federal rule, state-level action, and active litigation, each raising the bar for what a plan sponsor has to prove.
• Rightway's PBM model already meets these emerging requirements because it was built without rebate retention, spread pricing, or pharmacy ownership from day one.

What is PBM legislation?

PBM legislation is the set of federal statutes, proposed federal rules, state laws, and enforcement actions that regulate how a pharmacy benefit manager (PBM) prices drugs, discloses compensation, and reports data to the employers and health plans that hire it. It covers rebate handling, spread pricing, pharmacy ownership, audit rights, and the fiduciary status of the PBM itself.

Pharmacy benefit manager legislation has existed at the state level for years. Every state now has some form of PBM law on the books. What changed in 2026 is the extent of federal reach. For the first time, Congress set baseline pass-through and reporting rules for PBMs serving ERISA plans nationwide, and a Department of Labor rule would layer additional disclosure duties on top of them.

Why PBM regulatory compliance matters for employers.

PBM regulatory compliance now sits squarely on the plan sponsor. Several fronts are moving at once: an enacted federal law, a proposed federal rule, a contested state ban, a federal enforcement report, and active litigation. Each one raises the bar for what a plan sponsor has to prove, and the exposure splits into two categories: direct financial risk from what a plan pays and reports, and legal risk from how a plan oversees its PBM relationship.

Here's where that exposure shows up in practice:

• Inadequate PBM oversight increases ERISA fiduciary liability: A plan sponsor who signs a PBM contract without reviewing compensation terms carries the same fiduciary exposure as the PBM itself. Courts have already found that hiring a PBM is a fiduciary act, which means the standard of care applies to every renewal decision.
• Unverified PBM compensation and rebates leave revenue exposed: CAA 2026 requires PBMs to disclose direct and indirect compensation, including manufacturer rebates, fees, and any spread retained on a claim. That disclosure only protects your plan if your team actually reviews it, since a disclosure that arrives but goes unread carries the same fiduciary risk as no disclosure at all.
• Missed reporting deadlines carry real financial penalties: CAA 2026 requires plans with 100 or more employees to receive machine-readable drug-level reports every six months, or quarterly on request, covering gross and net drug spend, PBM compensation, and formulary rationale for high-spend drugs. Penalties for non-reporting run up to $10,000 a day, and a plan sponsor who never requests or reviews the report carries that same exposure alongside the PBM.
• Unaudited drug-level data leaves plan assets unprotected: Plan sponsors now have the right to audit PBM compensation and rebate remittances at least once per plan year, and the PBM cannot restrict, limit, or veto the sponsor's choice of auditor. A plan sponsor who never exercises that right may face heightened scrutiny of its own in a future fiduciary-breach inquiry, since regulators increasingly treat an unused audit right as evidence of inadequate oversight.

Top 5 regulatory changes influencing the PBM industry.

PBM reform is accelerating, but the rules are far from settled. State and federal actions are moving at different speeds, and most haven't yet become law. Employers don't need to wait for the market to settle. This is the time to scrutinize PBM contracts, challenge misaligned terms, and evaluate more transparent models.

Here's a closer look at these PBM regulatory changes and their implications for employer-sponsored health plans.

1. Consolidated Appropriations Act, 2026 (CAA 2026) and 100% rebate pass-through.

Congress passed CAA 2026, and the president signed it into law on February 3, 2026. The law requires a PBM to return every dollar it collects from drug manufacturers on your plan's behalf, rather than retaining a portion. That includes rebates, fees, and any other payments that a manufacturer or rebate aggregator sends to the PBM. The law also eliminates spread pricing, the practice of a PBM telling your plan a drug costs more than it actually paid the pharmacy and keeping the difference.

These requirements phase in over several years. Medicare Part D plans must comply by 2028. Employer plans have until plan years beginning on or after January 1, 2029, for calendar-year plans. A PBM that fails to meet the reporting requirements once they take effect faces penalties up to $10,000 a day, or $100,000 for a false disclosure. While the compliance deadline sits years out, a renewal signed today without full pass-through language locks a plan into terms that may already fall short of the law by the time the contract comes up again.

2. Executive Order 14273 and Department of Labor fee disclosure rules.

In April 2025, the president signed an executive order directing the Department of Labor to draft a rule requiring PBMs to disclose exactly how they earn revenue from a plan. The department published the DOL's proposed rule on January 30, 2026, under ERISA Section 408(b)(2), which would require PBMs to disclose all direct and indirect compensation, closing the door on hidden spread pricing and rebate aggregator retention. If finalized, a PBM would have to make that disclosure before a plan sponsor signs or renews a contract, with updates every six months after that.

The DOL's proposed rule remains a proposal, not a final rule. The comment period closed in April 2026, and because it overlaps significantly with what CAA 2026 already requires, the Department of Labor is expected to revise the rule before finalizing it.

3. Arkansas Act 624 and the fight over PBM pharmacy ownership.

Arkansas's governor signed Act 624, the state-level anti-steering statute, in April 2025. The law is narrow but consequential: a PBM operating in Arkansas could no longer own or operate a retail, mail-order, or specialty pharmacy, closing off an incentive to steer patients toward pharmacies the PBM profits from directly.

The Act 624 never took effect. A federal judge blocked it on July 28, 2025, finding it likely discriminates against out-of-state companies and conflicts with TRICARE, the federal military health program. Arkansas has appealed that ruling, and the underlying case continues in federal court. The law's injunction hasn't slowed the broader push behind it. Thirty-nine state attorneys general have urged Congress to enact a similar restriction nationwide, which signals where state-level pressure is headed even with Arkansas's own law on hold.

4. FTC Section 6(b) report on specialty drug pricing and self-dealing.

The Federal Trade Commission published a staff report on January 14, 2025, that quantified a problem employers had long suspected. The FTC's second interim staff report found that between 2017 and 2022, the three largest PBMs marked up specialty generic drugs while also owning the pharmacies dispensing them, a conflict of interest regulators refer to as self-dealing. That markup generated an estimated $7.3 billion in excess revenue and pushed member out-of-pocket costs up by $279 million in 2021 alone.

The FTC Section 6(b) report carries no binding force. No PBM is required to change its practices as a result of it. But the finding gave employers concrete figures to point to, and it's a significant reason more of them are now seeking PBM partners with no ownership stake in the pharmacy supply chain.

5. ERISA fiduciary duty and mitigating employer litigation exposure.

Employees at Johnson & Johnson, Wells Fargo, and JPMorgan each sued their employers in 2024 and 2025, alleging that inadequate PBM oversight left them paying inflated prescription prices. Courts dismissed the Wells Fargo and J&J cases early for lack of standing, and J&J's case is now on appeal.

JPMorgan's case proceeded differently. On March 9, 2026, a federal judge allowed part of the case to move forward, finding sufficient evidence that JPMorgan's contract with CVS Caremark marked up hundreds of generic drugs by an average of 211%. The judge dismissed the general duty-of-care claim as a benefit-design choice, but let a separate theory, that the arrangement was a prohibited transaction under ERISA, proceed to discovery.

That distinction between a business decision and a fiduciary one matters. Courts treat certain PBM decisions, like choosing pass-through pricing, as business choices an employer is free to make. Hiring and paying that PBM is a separate matter that carries a direct fiduciary duty.

How plan sponsors can conduct a PBM contract compliance audit.

A PBM contract compliance audit helps your team ensure that your PBM is meeting compliance obligations. Most existing contracts were negotiated before these requirements existed, so language that once looked standard may no longer hold up against them. Running this audit surfaces the gap between what your contract says today and what the law now requires.

Here are the four steps needed to conduct a PBM contract compliance audit:

Step 1: Demand full disclosure of direct and indirect PBM compensation.

Request a written breakdown of every revenue source your PBM earns from your plan, including manufacturer rebates, administrative fees, and any payments from pharmacies or rebate aggregators.

Without a full breakdown of PBM compensation, you have no way to verify anything the PBM reports in later steps, since every other check in this audit depends on knowing where the money actually goes. The proposed DOL rule would make this disclosure a legal requirement rather than a negotiating ask, but you don't need to wait for that rule to be finalized before requesting it now.

Step 2: Ensure 100% of rebates are passed through.

Review your contract's rebate definition line by line, since many agreements define rebate narrowly enough to exclude certain manufacturer payments, which lets the PBM retain money that should flow back to your plan. A drug with a $400 list price might carry a true net cost of $180 after manufacturer discounts, and whether that $220 gap reaches your plan or stays with the PBM depends entirely on how the contract defines "rebate." Confirm the contract requires 100% pass-through of PBM rebates, discounts, and fees, with no exceptions.

Step 3: Secure continuous, drug-level claims audit rights.

Your contract should give you the right to audit compensation and rebates at least once per plan year, let you choose the auditor, and prohibit the PBM from paying for or restricting that choice. Specify how quickly the PBM must respond to an audit request and in what format the data arrives, since a right to audit means little if the PBM can slow-walk the response for months.

Step 4: Verify formulary integrity and supply chain conflicts.

Ask how your drug formulary decisions are made and whether any placement is tied to rebate value rather than net cost. Request the share of specialty prescriptions filled at pharmacies your PBM owns or is affiliated with, and compare that figure against the PBM's broader network to see whether steering is actually happening. This is the conflict that disclosure, pass-through, and audit rights alone don't catch. A PBM can meet every requirement in the first four steps and still direct members toward higher-cost, higher-margin medications.

Meet PBM compliance standards with Rightway's neutral model.

Rightway earns its profit through a single administrative fee, fully disclosed at contract signing, and passes through 100% of rebates with no retained spread. Rightway owns 0% of the pharmacy supply chain, so there's no affiliated pharmacy to steer members toward and no conflicted revenue hidden beneath the numbers.

Pharmacist-led navigation replaces the call-center model most PBMs still use, guiding members to the lowest-net-cost clinically appropriate option instead of the option that pays the largest rebate. And Rightway's SureSpend pricing model backs all of this with a contractual guarantee: if actual spend exceeds the guarantee, Rightway refunds the difference dollar for dollar.

While most PBMs are spending 2026 through 2028 retrofitting disclosure processes and audit workflows onto a business model built to obscure them, Rightway isn't adjusting for reform because there's nothing to adjust. This is what an aligned, transparent PBM looks like when it's built that way from the start.

See how Rightway can help strengthen your PBM compliance. Book a demo.