An ERISA fiduciary breach occurs when a plan sponsor fails to act prudently and solely in participants' interest when managing a health plan, such as failing to monitor a PBM's pricing or negotiate reasonable fees. Recent lawsuits against Johnson & Johnson and Wells Fargo show courts scrutinizing these failures closely, even when claims get dismissed on legal technicalities.
In February 2024, a Johnson & Johnson employee filed a 75-page class action alleging the company let its prescription drug benefit program bleed money through an unmonitored pharmacy benefit manager contract.
Five months later, four Wells Fargo plan participants filed a nearly identical suit, claiming the bank squandered its bargaining power and let Express Scripts overcharge the plan.
In 2025, Illinois recovered $45 million from CVS Caremark after alleging the PBM withheld manufacturer rebates it owed the state's employee health plan. These are not isolated incidents. They are the opening chapters of a litigation wave that mirrors the excessive-fee lawsuits that reshaped 401(k) plan governance a decade ago, and self-funded employer health plans are now the target.
What ERISA Fiduciary Breach Actually Means for a Health Plan
A fiduciary breach happens when the people responsible for running a health plan fail to act with the care, skill and diligence ERISA requires, regardless of whether a lawsuit ever gets filed. Most HR leaders assume fiduciary duty is a retirement plan concept that only applies to 401(k) committees. That assumption is increasingly wrong.
ERISA Section 404 imposes the same prudent expert standard on anyone who exercises discretion over a group health plan's assets or administration. If your organization signs a PBM contract, approves plan design or reviews claims data even occasionally, you likely function as a fiduciary. The exclusive benefit rule adds a second layer, requiring that plan assets be used only to provide benefits and pay reasonable expenses, not to preserve a convenient vendor relationship.
The common misconception is that hiring a reputable TPA or PBM satisfies the duty. It does not. Delegating administration does not delegate the fiduciary's obligation to monitor that vendor's performance on an ongoing basis.
Why the Problem Exists
Health plan fiduciary duty gets overlooked because most plan sponsors treat benefits as an HR function rather than a financial oversight function. The committee structure, meeting cadence and documentation habits that retirement plan fiduciaries built over 20 years of ERISA litigation simply do not exist yet on the health plan side.
PBM and TPA contracts also compound the problem through complexity. Rebate formulas, spread pricing and administrative fee structures are often opaque by design, and few internal teams have the claims data expertise to audit them without outside help.
Finally, self-funded plans grew faster than fiduciary governance kept pace. KFF's 2025 Employer Health Benefits Survey found 67 percent of covered workers are now in self-funded plans, rising to 80 percent at large firms. Many of those plans still run on the oversight habits of a fully insured plan, where the carrier absorbed the risk and the scrutiny.
The Real Cost or Impact
Prescription drug spending is where fiduciary failures show up fastest. KFF found that 36 percent of large firms say drug prices contributed "a great deal" to premium increases in 2025, and the average family premium reached $26,993 that year.
Litigation creates a second layer of cost on top of the original overpayment. The Johnson & Johnson complaint alone was 75 pages and named individual committee members, not just the company. That should concern HR leaders who assume the company will always fully protect them from personal liability.
The Illinois settlement shows that vendor-related payment problems can involve millions of dollars. If similar problems exist across many self-funded employer plans, the total financial impact could be huge.
What's Actually Happening Behind the Scenes
PBM Contracts Nobody Re-Negotiates
Most self-funded plans sign a PBM contract and revisit it only when it expires. The Wells Fargo complaint alleged the company paid Express Scripts administrative fees that "greatly exceeded" what comparable plans paid, a gap that persisted because nobody benchmarked it mid-contract.
Rebates That Never Reach the Plan
Rebate pass-through language sounds protective on paper but is rarely audited in practice. Illinois only uncovered CVS Caremark's shortfall through a formal state investigation into an affiliated rebate aggregator, not through routine contract review.
Formulary and Mail-Order Steering
Both the J&J and Wells Fargo complaints alleged fiduciaries steered participants toward higher-cost mail-order channels and branded drugs without evaluating whether cheaper, clinically equivalent options existed. That is a design choice a committee approved once and never revisited.
No Independent Claims Data Review
In every one of these cases, the plaintiffs' core allegation is not that fiduciaries acted maliciously. It is that nobody with independent authority was checking the PBM's own numbers against outside benchmarks on a recurring basis.
Why Current Approaches Aren't Enough
Most plan sponsors believe their existing TPA or broker relationship already covers this ground. It usually does not, because the entity administering the plan has limited incentive to flag its own pricing.
How to Fix It
Red Flags That Signal the Problem Applies to Your Plan
The ROI of Doing It Right
Independent claims audits typically recover a meaningful share of total plan spend in overpayments and billing errors that routine TPA review misses. On a plan spending $20 million annually, even a modest recovery rate represents a substantial six-figure return.
Beyond recovery, documented fiduciary governance is itself protective. Courts in the Lewandowski and Navarro cases dismissed claims on standing grounds partly because plaintiffs could not tie specific harm to specific fiduciary failures. A plan sponsor with clean documentation is in a materially stronger position if that standing bar shifts in future litigation.
The ongoing savings compound. Fee benchmarking and rebate audits performed annually, rather than once at contract signing, tend to catch cost creep before it accumulates into a multi-year shortfall like the one Illinois uncovered.
Conclusion and Next Steps
Every case examined here traces back to the same gap: nobody independent was checking the numbers. Courts have so far dismissed the highest-profile suits on procedural grounds, but that offers plan sponsors a narrowing window, not a permanent shield. The prudent expert standard doesn't pause while standing law develops.
Start by asking whether your plan could produce, today, a written record of when your PBM contract was last benchmarked and by whom. If the honest answer is "not recently" or "never," that's the gap to close first.
An independent claims audit is the fastest way to establish both the documentation and the cost recovery this article describes.
Frequently Asked Questions
Is an HR director personally liable for ERISA fiduciary breaches?
Yes, if they exercise discretion over plan administration. The J&J case named individual committee members, not just the company.
Does hiring a PBM or TPA transfer fiduciary liability to them?
No. Delegating administration does not delegate the ongoing duty to monitor that vendor's performance.
Why were the Johnson & Johnson and Wells Fargo lawsuits dismissed?
Courts found plaintiffs lacked Article III standing, meaning they hadn't shown concrete, traceable financial injury, not that the conduct was proper.
How often should a self-funded plan audit its PBM?
At minimum annually, with rebate pass-through and administrative fees benchmarked independently of the PBM's own reporting.
What is the prudent expert standard under ERISA?
It requires fiduciaries to act with the care and skill a knowledgeable person familiar with plan administration would use under similar circumstances.
Can a plan sponsor be sued even if premiums didn't rise?
Yes, though recent rulings suggest plaintiffs must show a clearer causal link between fiduciary conduct and specific financial harm.
What triggered the CVS Caremark settlement with Illinois?
A state investigation found Caremark's affiliate withheld manufacturer rebates owed to the state's employee health plan over a four-year contract period.
Is a written fiduciary policy legally required?
ERISA doesn't mandate a specific document, but documented process is the primary evidence fiduciaries have if their conduct is challenged.
