BlogCost ContainmentMar 16, 20265 min read

PBM Reform Is Here: What Self-Funded Employers Must Do Before 2029

The CAA 2026, FTC enforcement actions, and new DOL disclosure rules are converging to reshape pharmacy benefits. Here's what self-funded employers need to audit, renegotiate, and document before penalties kick in.

PBM ReformPharmacy BenefitsERISA Compliance

1The largest pharmacy shakeup in a decade

Three regulatory forces are converging on pharmacy benefit managers simultaneously. The Consolidated Appropriations Act of 2026 mandates 100% rebate pass-through for plans with 100+ employees. The FTC's Express Scripts settlement established precedent for spread-pricing enforcement. And the DOL's new disclosure rule requires drug-level cost reporting that most PBM contracts weren't built to support.

Individually, each rule is manageable. Together, they dismantle the margin model that PBMs have relied on for two decades — and shift compliance burden squarely onto plan sponsors.

CodaHx perspective: pre-pay audits preserve speed when 95%+ of claims clear automatically and <3% need human review. We keep false positives under 2%.

2What the new rules require

Self-funded employers with 100 or more covered employees face concrete new obligations starting in 2027, with full enforcement by 2029:

  • 100% pass-through of all manufacturer rebates to the plan — retention by the PBM is prohibited.
  • Drug-level cost reporting: plans must disclose per-NDC spend, rebate amounts, and net cost annually.
  • ERISA fiduciary documentation proving PBM contract terms were negotiated in members' best interest.
  • Spread-pricing prohibition: PBMs cannot charge the plan more than they reimburse the pharmacy.
  • Penalties of up to $10,000 per day per violation for non-compliant plan sponsors.

3Where PBMs will shift the math

PBMs aren't absorbing margin loss — they're relocating it. Expect administrative fee increases of 15–30% as PBMs compensate for lost spread and rebate retention. Watch for new line items: clinical program fees, formulary management charges, and network access premiums that didn't exist in your current contract.

The most sophisticated tactic is rebate reclassification — converting what was previously a rebate into a 'performance guarantee' or 'administrative credit' that falls outside the pass-through mandate. If your contract language doesn't explicitly cover these categories, you'll comply on paper while losing the same dollars under different labels.

4A pre-2029 contract audit playbook

Start now — renegotiating PBM contracts takes 12–18 months, and the enforcement timeline leaves little room for delay:

  • Pull your current PBM contract and map every fee, rebate, and spread term against the new CAA requirements.
  • Request a full NDC-level claims extract for the last 24 months to establish your baseline cost and rebate profile.
  • Compare your net drug costs against NADAC (pharmacy acquisition) and WAC (wholesale) benchmarks to identify hidden spread.
  • Renegotiate or RFP before Q4 2027 — contract transitions require 6+ months of data migration and formulary alignment.
  • Document your fiduciary process: meeting minutes, market comparisons, and rationale for PBM selection to satisfy ERISA requirements.

5How CodaHx helps

Our pharmacy analytics module ingests NDC-level claims and cross-references against NADAC and WAC pricing benchmarks in real time. Employers see exactly where their PBM's reimbursement rates diverge from market pricing — by drug, by pharmacy, by fill.

Rebate pass-through tracking surfaces the gap between reported rebates and manufacturer-published WAC discounts, so you can verify compliance without relying on the PBM's self-reporting.

Key takeaways

  • Penalties of up to $10,000/day start in 2029 — but contract renegotiation cycles mean the real deadline is 2027.
  • PBMs will restructure fees to recover lost margin; audit every new line item against your total cost of care, not just drug spend.
  • A documented fiduciary process — NDC-level benchmarking, market comparisons, and meeting records — is now a compliance requirement, not a best practice.

See how CodaHx catches issues before payment

Book a 20-minute walkthrough of our pre-pay audit flow.