On Thursday, October 29th, the Department of Labor (DOL) finalized regulations requiring any entity providing “pharmacy benefit management services” to a self-insured group health plan to disclose specified compensation streams this entity receives to the plan’s fiduciary.
Important Things To Know About These Final Regulations
This Final Reg Is Not Just for PBMs
Importantly, these final regulations do not just apply to PBMs. These new compensation disclosure requirements apply to any entity providing “pharmacy benefit management services” to a self-insured group health plan. This includes TPAs that contract with a plan to provide “pharmacy benefit management services.” This also includes TPAs that contract with a plan to provide a whole host of services, one of which is “pharmacy benefit management services.” TPAs remain subject to these compensation disclosure requirements even if the TPA subcontracts with another entity that actually provides the “pharmacy benefit management services” to the plan. These compensation disclosure requirements also apply to consultants, brokers, and other plan service providers (like MEWA operators and operators of level-funded plans) who in practice typically provide, among other services, “pharmacy benefit management services” to a self-insured plan.
Two Compensation Disclosure Requirements Under the Law, Not Just One
It is important to understand that these final regulations are in addition to the existing compensation disclosure requirement set forth under ERISA. Why is this important? Because many plan service providers may read these final regulations and determine that they are not subject to these compensation disclosure requirements because they do not provide “pharmacy benefit management services.” But, that does not mean that this service provider is exempt from ERISA’s general compensation disclosure requirement (which is currently set forth under ERISA section 408(b)(2)(B) and now applicable to all plan service providers). This means that if you are a TPA, a broker, a consultant, an entity building transparency tools, an entity providing cost-containment services, and even, in some cases, an entity providing services related to stop-loss insurance, you are subject to ERISA’s general compensation disclosure requirement, and therefore, must disclose direct and indirect compensation received for providing services to a self-insured plan.
The DOL has yet to issue detailed guidance on the specificity of the types of compensation disclosures that entities providing the above stated services must furnish. These final “pharmacy benefit management services” regulations are the first foray into providing some level of specificity. Specificity around “third-party administrative services” – and what types of compensation streams must be disclosed by TPAs and entities providing “third-party administrative services” – is next on the DOL’s rulemaking agenda (as noted by the DOL in the preamble of these “pharmacy benefit management services” regs). Specificity on other types of services may come in the form of subregulatory guidance (as also noted by the DOL in the preamble).
Audit Rights
The final regulations confirm that a self-insured plan must be permitted to audit the entity providing “pharmacy benefit management services” at least once per year to verify the accuracy of the disclosure and to ensure that this entity’s compensation disclosure complies with these regulatory requirements. In addition, this entity cannot limit the period of the plan’s audit, the location of the audit, or the number of records, data, or information to be provided for the audit. The plan must also be able to select their own auditor, and the plan shall bear all expenses related to the auditor, while the entity providing “pharmacy benefit management services” must pay for the costs of providing the auditor with the records, data, and information needed to perform the audit.
The final regulations also make a very important clarification: The auditor may request – and the entity providing “pharmacy benefit management services” must provide to the auditor – the plan’s health claims and transaction-level data. The DOL explained that plan fiduciaries need access to material information to assess the quality and accuracy of the entity’s disclosures.
Also just as important, the DOL explicitly stated that if an entity providing “pharmacy benefit management services” fails to provide information in compliance with this audit provision, such failure would result in a violation of ERISA. The DOL went on to say that the Department may choose to impose monetary penalties on those entities that are not compliant.
Sharing the Disclosed Compensation Information With Other Plan Service Providers
These final regulations confirm that the plan is permitted to share the disclosed information with other third-party service providers (such as consultants, attorneys, and other service providers like data analytics and cost-containment firms), which is good news.
However, an entity providing “pharmacy benefit management services” may prohibit these third parties from sharing this information with fourth parties (i.e., this entity can require the plan to enter into confidentiality agreements with their third-party service providers to prohibit re-disclosures).
It also appears that the DOL agreed with arguments that compensation and payment-related agreements (like rebate agreements) are proprietary by adding to the final reg the following requirement: The plan may share the disclosed information with another third-party, but that third-party can only use the information to perform the services this third-party is contracted to perform for the plan. In other words, the entity providing “pharmacy benefit management services” can prohibit the use of the shared information for purposes unrelated to the services this third-party is contracted to perform for the plan.
***
We will be preparing a more detailed summary of the requirements set forth in these final “pharmacy benefit management services” regulations, so stay tuned.
In the meantime, you may access our write-up of the proposed regulations (which you can findhere). These final regulations track much of what you see in this write-up.
In addition, if you have any questions regarding these final regulations or ERISA’s general compensation disclosure requirement, please contact Chris Condeluci atccondeluci@siia.org or Anthony Murrello at amurrello@siia.org.
SOURCE: Self-Insurance Institute of America, Inc. personal communication, October 30, 2026





