The Consolidated Appropriations Act requires self-funded plan sponsors to review PBM payment disclosures, bans gag clauses that prevent access to claims and pricing data, and holds plan fiduciaries personally responsible for checking that PBM contracts are fair. Ignoring these disclosures can itself become a fiduciary breach under ERISA.
A 1,400-employee manufacturer conducted its first independent claims audit in 2024, eighteen months after starting a new relationship with a pharmacy benefit manager. The audit uncovered $812,000 in overpayments, including a specialty drug billed at 240% of the agreed contract rate. The TPA's internal reviews had missed every one of these problems.
Most HR leaders and CFOs assume their broker or PBM is already providing the information they need to manage their health plan properly. But legally, the responsibility still falls on the plan sponsor and its fiduciaries. ERISA can hold individual fiduciaries personally responsible when they fail to meet their duties, and those duties include making sure the plan's pharmacy benefits are managed properly.
What PBM Transparency Actually Means Under the CAA
A plan sponsor's fiduciary duty under the CAA is not satisfied by simply hiring a PBM. It requires an ongoing, documented process of reviewing what that PBM is paid and how it is paid. Many benefits leaders assume signing a PBM contract discharges their obligation. The law treats that moment as the start of the duty, not the end of it.
The CAA amended ERISA to require certain covered service providers to disclose their compensation. The CAA 2021 disclosure requirements apply to persons who provide brokerage services or consulting to ERISA-covered group health plans who reasonably expect to receive $1,000 or more in direct or indirect compensation. This disclosure has to happen before the contract is signed or renewed, not buried in a report months later.
A newer law raises the bar further. The Consolidated Appropriations Act of 2026 treats PBMs as covered service providers under ERISA Section 408(b)(2), subject to compensation disclosure requirements, and requires 100% rebate and remuneration pass-through to ERISA plans with limited exceptions for bona fide service fees.
It also mandates semiannual reporting of detailed drug pricing, spread pricing, rebate, and compensation data to group health plans. Most of these newer provisions phase in over the next several years, but the direction of travel is unmistakable: PBM relationships are moving from private contract terms to statutory obligations.
Why the Problem Exists
PBM compensation has historically been structured so plan sponsors could not see the full picture, even when they asked. Spread pricing is the clearest example. A PBM bills the plan one amount for a drug and pays the pharmacy a lower amount, keeping the difference without disclosing it as compensation.
State Medicaid audits give a sense of scale. Pennsylvania found that taxpayer payments to PBMs for Medicaid enrollees more than doubled from $1.41 billion to $2.86 billion between 2013 and 2017, and Ohio's state auditor found PBMs pocketed $224.8 million through spread pricing alone in a single year, out of $2.5 billion spent annually. Employer plans are not immune to the same dynamics. They simply have less regulatory scrutiny forcing the numbers into daylight.
Contract terms compound the visibility problem. Many PBM agreements historically included gag clauses that restricted a plan's ability to see claims-level pricing data or compare it to market rates. The CAA specifically targeted this practice, but old habits and vague contract language still linger in many renewals.
The Real Cost and Impact
Undetected PBM and claims errors translate directly into inflated plan spend, and the dollars involved are rarely trivial. Carrier post-pay sampling reviews typically cover only 3 to 5 percent of claims, while independent analysis of 100 percent of claims has consistently identified 5 to 12 percent error rates. That gap between sampled review and full review is where money disappears.
Industry estimates put the overpayment error rate at 2 percent to 5 percent of overall medical claim costs each year, even at the best claims administrators. For a plan spending $20 million annually on claims, a 3 percent error rate translates to roughly $600,000 a year in avoidable losses. Multiply that across a five-year contract term and the number becomes difficult to ignore in a board meeting.
Litigation risk adds a separate cost layer. In one closely watched case, plaintiffs alleged an employer breached its fiduciary duty by agreeing to pay its PBM higher prices for generic drugs when those same drugs were available at lower prices, and by steering beneficiaries to the PBM's mail-order pharmacy where prices were routinely higher than retail. The claims were dismissed twice on standing grounds rather than on the merits, but the legal exposure and the defense costs were real regardless of outcome.
What's Actually Happening Behind the Scenes
Spread Pricing Without Disclosure
A PBM can charge a plan more for a drug than it pays the dispensing pharmacy and record that markup as revenue rather than as compensation. Without an independent audit comparing PBM invoices to actual pharmacy reimbursement, a plan sponsor has no way to see this gap.
Rebate Retention
Manufacturer rebates are negotiated by the PBM using the plan's purchasing volume, but the PBM does not always pass the full rebate back to the plan. The PBM retains a portion or all of the negotiated rebate as its compensation, and the exact split is frequently unclear in contract language.
Formulary Steering and Specialty Drug Markups
PBMs influence which drugs are preferred on a formulary, sometimes in ways tied to their own rebate economics rather than the lowest net cost to the plan. Vertically integrated PBMs that own specialty pharmacies or mail-order channels have an added incentive to steer volume toward their own affiliates.
Claims Processing Errors Hiding Inside "Accurate" Reports
TPAs and PBMs typically self-report high accuracy rates. A TPA's self-reported rate is often around 100 percent, while an independent review found actual financial accuracy closer to 96.8 percent and payment accuracy closer to 96.1 percent, both below the 98 percent service level standard. The gap between self-reported and independently verified accuracy is where dollars quietly leak out of a plan.
Why Current Approaches Aren't Enough
Most plan sponsors rely on their TPA or PBM's own quarterly reporting and treat the annual renewal conversation as sufficient oversight. That approach reviews a small, PBM-selected slice of the data and rarely includes an independent comparison to actual pharmacy reimbursement.
How to Fix It
Red Flags That Signal the Problem Applies to Your Plan
The ROI of Doing It Right
Independent claims audits routinely identify overpayments in the mid to high single digits as a percentage of total claims spend. ClaimInformatics' independent analysis consistently identifies 5 to 12 percent error rates across 100 percent of claims reviewed, well above what carrier sampling ever surfaces.
Recovered dollars are only part of the return. A documented, ongoing fiduciary review process is also the primary defense if a plan is ever investigated or sued. EBSA announced a significant overhaul of its national enforcement priorities for fiscal year 2026, with a pronounced shift of investigative resources toward health and welfare plans and the service providers who operate them. Plans that can show board minutes, disclosure reviews, and audit reports are in a materially different position than plans that cannot.
Think of PBM oversight like an annual physical rather than a one-time checkup. Skipping it does not mean nothing is wrong. It only means no one has looked yet, and problems that go unmeasured tend to compound quietly until the bill comes due all at once.
Conclusion and Next Steps
PBM transparency is no longer a negotiating preference. It is a statutory expectation backed by an ERISA fiduciary duty that falls on the plan sponsor, not the vendor. The plans best positioned for 2026 and beyond are the ones that treat disclosure review, contract audit rights, and documented committee oversight as a standing part of how the plan runs, not as a once-a-year renewal task.
Start with one question in your next benefits committee meeting: when was the last time someone outside your TPA or PBM independently verified the numbers you were given. If no one can answer that with a date and a report, that is the place to begin.
Frequently Asked Questions
What does the CAA require of self-funded plan sponsors regarding PBMs?
It requires covered service providers, including PBMs, to disclose direct and indirect compensation to plan fiduciaries before contracts are signed or renewed.
Is a plan sponsor personally liable for PBM pricing problems?
Individual fiduciaries can be held personally liable under ERISA for breaches of fiduciary duty, including inadequate PBM oversight.
How often should a self-funded plan audit its PBM contract?
Most fiduciary advisors recommend an independent audit every one to two years, with ongoing monitoring in between.
What is spread pricing?
It is when a PBM bills the plan more for a drug than it pays the pharmacy, keeping the difference as undisclosed revenue.
Does the CAA apply to fully insured plans too?
The disclosure and gag clause provisions apply broadly to group health plans, though self-funded plans carry more direct fiduciary exposure.
What happens if a plan ignores 408(b)(2) disclosures?
Failing to review or act on required disclosures can itself constitute a fiduciary breach, separate from whether pricing was unreasonable.
What is the difference between CAA 2021 and CAA 2026 PBM provisions?
CAA 2021 introduced compensation disclosure requirements; CAA 2026 adds mandatory rebate pass-through and detailed PBM reporting obligations, signed into law February 3, 2026.
Can a broker or consultant also trigger CAA disclosure requirements?
Yes. The CAA 2021 mandated transparency improvements including broker and consultant compensation disclosures, not PBMs alone.
