Listen to Compliance in Minutes here!
Prepare to Review ERISA Group Health Plan §408(b)(2) PBM Compensation Disclosures
Under ERISA §408(b)(2) and the Consolidated Appropriations Act, 2021 (CAA-21), brokers, consultants, and other “covered service providers” who expect to receive $1,000 or more of direct and indirect compensation from group health plans must disclose that compensation and enumerate the services it pays for. However, Pharmacy Benefit Managers (PBMs) largely argued that the CAA-21 did not require them to provide §408(b)(2) disclosures.
With the passage of the Consolidated Appropriations Act, 2026 (CAA-26), Congress officially now requires PBMs and other health plan service providers to also produce §408(b)(2) group health plan compensation disclosures to health plan sponsors. There is no delayed effective date, so the change is effective upon the law’s passage in early February, 2026.
Fiduciaries of ERISA group health plans must request these disclosures and evaluate compensation for reasonableness before entering into, renewing, or extending any contract for group health plan services, including for compensation related to pharmacy benefit management services. Failing to do so means the fiduciary of the plan is entering into a prohibited transaction under ERISA.
Applies To:
- ERISA group health plans, (small or large, fully-insured or self-funded), paying $1,000 or more to a broker, consultant, or other covered service provider. Only governmental and church plans are exempt from ERISA.
- The CAA-26 expands the disclosure requirement to PBM service providers and consultants receiving $1,000 or more in compensation.
Go Deeper:
The CAA-26, signed into law February 3, 2026, officially added PBM service providers and consultants to the list of “covered service providers” who must provide a §408(b)(2) compensation disclosure to ERISA group health plan sponsors.
When the CAA-21 added providers of “brokerage services” and “consulting services” to the list of “covered service providers” who must provide §408(b)(2) compensation disclosures, the Department of Labor (DOL) issued Technical Release 2021-03 clarifying that “comprehensive implementing regulations are [not] needed” and good faith efforts to follow the largely overlapping §408(b)(2) guidance for pension plan compensation disclosures is expected.
Similarly, PBMs and consultants must make a good faith effort to follow the §408(b)(2) guidance for pension plan compensation disclosures. The law firms Ogletree, Spencer Fane, Trucker Huss, and Morgan Lewis affirm this understanding.
This means sponsors of ERISA group health plans who expect a PBM or consultant to receive $1,000 or more in direct and indirect compensation must request a §408(b)(2) compensation disclosure before signing, renewing, or extending a contract, and must review the disclosure to determine whether the compensation is reasonable to provide services necessary for the health plan.
Penalties for Non-Compliance:
An ERISA fiduciary who enters into a prohibited transaction may be assessed civil penalties in two tiers:
- A first tier penalty up to 5% of the amount involved per year.
- A second tier penalty up to 100%, in addition to the first tier penalty, may be assessed if the transaction is not corrected within 90 days of a “final agency order.”
There are also litigation risks from plan participants, and fiduciaries of the plan can be held personally liable to restore plan overpayments for unreasonable compensation and any profits improperly earned from a prohibited transaction.
Practical Impact to Employers:
PBMs and consultants are largely indicating thus far they are not prepared to provide the required §408(b)(2) compensation disclosures. A recurring theme heard is many PBMs want to wait for implementation guidance and perhaps a model disclosure form. However, providers of broker services and consulting services were told by the DOL in 2021 that additional guidance and model forms would not be provided and they should make good faith efforts to comply with pension guidance already provided. Until the DOL explicitly says there is a delay in applicability to PBMs and consultants, there is no reason to delay compliance with the new disclosure.
Health Insurers Expected to Distribute $234 Million in MLR Rebates to Employers
Each year, health insurers must calculate their Medical Loss Ratio (MLR) for their fully insured individual, small group, and large group medical/Rx book of business in each state. If their 3-year average MLR shows the carrier collecting more in premium than is allowed under the Affordable Care Act (ACA), the excess for that state’s segment must be returned to policyholders (in the individual market) or plan sponsors (in the group market) by the following August.
The Kaiser Family Foundation (KFF) has analyzed data to estimate insurers are expected to issue $759 million in MLR rebates next month. The lion’s share (almost $525 million) will go to individual policyholders, leaving an estimated $121 million going to small group plan sponsors and $113 million to large group plan sponsors.
Employers receiving MLR rebates have a responsibility to determine how much might belong to plan participants (and former participants) and distribute what belongs to them within 90 days.
Applies To: Employers with fully insured medical plans during one or more of the last three calendar years.
Go Deeper:
In 2025, the average MLR rebate per participant was $190 in the small group market and $91 in the large group market. Some employers have plan language giving them discretion to not share any of those small rebates with plan participants. For employers who do calculate an amount to share, they typically share a small portion of the overall rebate, as the employer often pays a much larger percentage of the medical premium compared to employees.
Once the rebate is pro-rated to determine how much (if any) belongs to participants, it is often such a negligible amount that the government gives employers permission to distribute it evenly without having to further allocate based on how much or how little various plans and tiers cost. It is crucial to deliver those negligible amounts to participants (and possibly to former participants) within 90 days to avoid having to put such a small sum in trust.
KFF also did an analysis of the 2025 average simple MLRs to find the small group market averaged 87% (well above the 80% target) and the large group market averaged 91% (well above the 85% target). Once those numbers are reconciled by state, it gives a strong indication of low MLR rebates for next year as well.
Penalties for Non-Compliance:
There are specific MLR distribution rules for governmental employers and for all employers subject to ERISA, regardless of size. Failing to abide by these rules can result in penalties and legal risk, which should be avoided given the small amount of the MLR rebates.
Practical Impact to Employers:
An employer who receives an MLR rebate should consult with their benefits advisor to walk through calculations to help determine how much may belong to participants, utilize any form letters to help explain the rebate to participants, and determine how the employer will distribute that amount to participants within 90 days.
FTC Settlement Reached with Caremark
On July 14, 2026, the Federal Trade Commission announced a settlement agreement with Caremark, one of the “big 3” PBMs. The FTC sued Caremark for allegedly inflating the list prices of drugs (particularly insulin) to encourage manufacturers to pay them larger rebates and fees, which the FTC alleges ultimately hurt patients whose cost-sharing is linked to inflated list prices.
This follows the settlement agreement with Express Scripts announced February 4, 2026. Each agreement “delinks PBM [and Group Purchasing Organization] fees from drug list prices, enhances transparency, and provides retail community pharmacies with the opportunity to shift to a cost-plus reimbursement model.” Caremark agreed to a long list of requirements, and the public has 30 days to submit comments on the proposed consent agreement package. Once approved, the final consent order carries the force of law.
Optum is the last of the “big 3” being challenged by the FTC. “The Commission’s case against Optum has been withdrawn from adjudication to consider a proposed consent agreement.”
Final HIPAA Rules Are on the Docket
The proposed rule for HIPAA Privacy introduced in 2021 is expected to be finalized next month and may once again affect the Notice of Privacy Practices (NPP). Finalization of the proposed rule with HIPAA cybersecurity updates (introduced in early 2025) was expected in May 2026, but now appears delayed until July 2027.
Applies To:
- Employers sponsoring group health plans that are self-funded, including level-funded plans, health Flexible Spending Arrangements (health FSAs), or Health Reimbursement Arrangement (HRAs).
- Employers sponsoring a fully insured group health plan which provides the employer or their business associates with Protected Health Information (PHI), such as a claims analytics data feed.
Go Deeper:
The HIPAA Security proposed rule from early 2025 was expected to be finalized in May 2026, but that has been postponed until July 2027.
- It is expected to require a host of cybersecurity modernizations which we flagged as “extensive and expensive.”
- Looks like we will wait another year to see how far they go, but there is a lot employers can and should proactively do now:
- Evaluate how much PHI the employer truly needs for plan oversight and administration, how best to minimize PHI, identify ways to only have PHI temporarily to accomplish a task, and keep PHI secure at all times so there can never be a breach of ‘unsecured’ PHI.
- Proactively adopt some of the more common-sense provisions now, such as user-based access roles (everyone needing access to PHI does not necessarily need access to all PHI), prompt termination of access no longer needed or authorized (such as an employee moving to a different role or terminating employment), requiring multi-factor authentication, active monitoring and auditing of access to PHI, and encryption of all PHI at all times (in motion and at rest).
- Work on a plan for cybersecurity needs like robust penetration testing, establishing and regularly testing backup environments that are routinely fed data at least daily if not more often, and promptly disabling all PHI access when a potential compromise occurs in order to switch to that backup environment until safety can be confirmed.
The HIPAA Privacy proposed rule from 2021 is expected to be finalized in August 2026. We will keep an eye on what the final rule implements, but the proposed provisions that could impact group health plans included the following:
- Notice of Privacy Practices (NPP): New header content and contact details, plus a right to discuss the notice. Anytime they amend NPP language requirements, an updated model notice is likely.
- Care Coordination: A clearer “health care operations” definition and a new minimum necessary exception for individual-level care coordination and case management.
- Broader Disclosures: Plans could share PHI with social services, community organizations, and home- and community-based services (HCBS) providers to coordinate care.
- Access Rights: A stronger right to inspect (including notes and photos), fee changes, and API-based delivery of electronic records.
- It appears the proposed 15-day access deadline (down from 30) may get its own separate rulemaking in November 2026.
Penalties for Non-Compliance:
The Office of Civil Rights (OCR) can enforce penalties and settlements against employers who do not comply with HIPAA’s Privacy Rule and Security Rule, and individuals impacted by unauthorized uses or disclosures of PHI can pursue litigation.
Practical Impact to Employers:
Once the final rule for HIPAA Privacy is published, an alert will be provided to explain what employers need to know. If new NPP language is indeed needed, an updated model NPP will be expected sometime before the due date to provide the new language to plan participants.
While the cybersecurity updates are postponed another year, we urge employers to proactively adopt some of the more common-sense provisions now and use the extra year to have robust budget and operational discussions on more complicated cybersecurity measures.
HHS and Treasury Publish Regulatory Agendas
On Friday, July 3, the Departments of Health and Human Services (HHS) and the Treasury released their 2026 Regulatory Agendas. For the remainder of 2026, we can expect to see:
- Final regulations on HIPAA Privacy
- Final regulations on Transparency in Coverage and Advanced EOBs, and proposed regulations on provider nondiscrimination
- Proposed regulations by the end of this year addressing the Mental Health Parity and Addiction Equity Act (MHPAEA)
- As a reminder, enforcement of the September 2024 final rule was paused for 2025 and 2026 under the federal government’s compromise to reexamine the rules and publish revisions as appropriate
- While the federal government is likely to revisit the enhanced requirements that 2024 rule was going to impose, it is worth noting that robust MHPAEA protections remain a top priority of this administration
- A proposed rule regarding employer-sponsored Trump Account Contribution Programs (TACPs)
- Proposed regulations on ICHRAs
We will provide alerts shortly after each proposed or final rule is published.
Court Strikes Down Several Regulatory Changes to Exchanges
While the premium adjustment methodology remains intact for 2026 (meaning out-of-pocket maximums remain at previously published indexing levels), several other Exchange provisions that were paused during litigation are now deemed invalid by a federal trial court. Several address eligibility and substantiation rules, but noteworthy items include the inability to shorten the annual enrollment period or to adjust the de minimis ranges for actuarial value metal levels.
HHS Vacates Gender Identity Provisions of ACA Section 1557 Nondiscrimination Rules
As a result of the US District Court in Tennessee v. Kennedy vacating portions of the §1557 rules that expanded the Title IX definition of sex discrimination to include gender-identity discrimination in health plans, the Department of Health and Human Services (HHS) has withdrawn that portion of the §1557 rule.
As a reminder, medical care for gender dysphoria remains subject to other discrimination laws. While HHS may not take enforcement action against a plan on this issue under §1557, the biggest risk to employers remains Title VII civil rights claims that a plan limitation or exclusion of gender identity care may be sex discrimination. Any employer wishing to have such a restriction needs to discuss it with counsel first, with the oscillating court decisions in Lange v. Houston County, Georgia demonstrating how unsettled this area of the law remains.
Federal Courts Split on IRS Certification of ESRPs
A federal court recently ruled that the IRS can make the certification necessary in Letter 226J to assess Employer Shared Responsibility Penalties (ESRPs). This creates a split in the federal courts, so we will see how the issue progresses from here.
In lawsuits where employers have challenged the IRS on their authority to assess ESRPs, the employers that had to pay the fees to avoid accruing interest and having assets seized, then filed suit against the IRS. It is important for any employer receiving a letter 226J, 5699, or other ACA Reporting penalty letter to work with their legal/tax advisor to respond promptly, timely pay if the IRS makes a demand for payment, and then follow that up with requesting abatement or filing suit if they disagree.
Louisiana Blue Takes Hard Stance Against Alternative Care Arrangements for High-Cost Claimants
Blue Cross and Blue Shield of Louisiana issued a warning to all licensed brokers and producers that any involvement in activities “to identify and remove high-cost or potential high-cost claimants from group health plans, and facilitating the enrollment of those persons into the individual market,” will result in the immediate termination of their appointment to work with and represent Louisiana Blue’s products. This is even enforced against appointed brokers and producers facilitating such arrangements for clients who are not with Louisiana Blue.