On November 2, the Department of Labor (DOL) published a final rule that requires pharmacy benefit managers (PBMs) to tell large, self-insured employer health plans how they get paid. PBMs must disclose their expected compensation before a contract is signed or renewed, report what they actually earn twice a year, and let plans audit those numbers.
The rule does not cap or lower PBM fees. It gives the HR and benefits leaders who oversee these contracts information many have struggled to obtain, so they can judge whether their PBM arrangements are reasonable and negotiate from a stronger position. The requirements apply to plan years beginning on or after July 1, 2027, which means January 1, 2028, for calendar-year plans.
What PBMs Must Do
The rule has three core requirements:
- Disclose compensation upfront. Before a plan signs, extends or renews a contract, the PBM must describe its services and the compensation it expects to receive, both from the plan and from other sources such as manufacturer rebates, spread pricing and pharmacy payments. PBMs are required to provide the required information sufficiently in advance of entering into, renewing, or extending an agreement. For renewals and extensions, the DOL states that delivering disclosures at least 90 days in advance counts as reasonable.
- Report actual earnings. Every six months, or quarterly if the plan asks, the PBM must report the compensation it received within 30 days after the period ends. It must explain any category that runs 5% or more above its initial estimate.
- Allow audits. Plans may audit the disclosures at least once a year using an auditor of their choosing. PBMs must turn over records, transaction-level data and relevant contracts with pharmacies and drug manufacturers, generally within 60 days. The plan pays the auditor, and the PBM bears the cost of producing the information.
Who Is Covered and When
The rule applies to self-insured plans with at least 100 participants and to self-insured plans of employers with at least 100 employees. Fully insured plans fall outside the rule’s added requirements.
Covered service providers include PBMs and their affiliated brokers and consultants that expect at least $1,000 in compensation from the arrangement. The definition turns on the services provided, not the label, so it also reaches entities that manage drugs covered under a plan’s medical benefit.
The rule takes effect January 1, 2027, and its requirements apply to plan years beginning on or after July 1, 2027.
What’s Next for Institutions
Colleges and universities with self-insured plans that meet the size thresholds do not need to act immediately, but early preparation will help. HR and benefits leaders should note when their PBM contracts come up for renewal, check whether current terms limit audits or data access, and decide who will review the disclosures once they arrive. Institutions may also want to involve legal counsel, benefits consultants and finance leaders in that review.
CUPA-HR will keep members apprised of developments related to the PBM rule.