Reform does not enforce itself: Why PBM legislation demands continuous oversight

In brief: The Consolidated Appropriations Act, 2026 (CAA 2026) made federal pharmacy benefit manager (PBM) reform law. Starting in 2028, it limits Medicare Part D PBM compensation to flat, bona fide service fees. Starting in 2029 for calendar-year plans, it requires 100% rebate pass-through, detailed drug-level reporting, and annual audit rights for employer group health plans. Those provisions change what PBM contracts must say, and health plans still need claim-level evidence that the new terms, benefit designs, and state rules are applied correctly. That verification is the work continuous pharmacy claims monitoring is built to do.

Reform does not enforce itself

Recent federal and state actions have pushed pharmacy benefit managers (PBMs) into the spotlight with a level of sustained scrutiny the industry has not seen before. The Federal Trade Commission's interim staff reports describe how the largest PBMs can increase costs for key drug classes, advantage affiliated pharmacies, and influence which therapies members can realistically access. In February 2026, Express Scripts agreed to a proposed settlement of the FTC's insulin case that includes new reporting to plan sponsors and options to move away from spread pricing. The FTC's case against Caremark and Optum Rx continues.

Congress then made federal PBM reform law. CAA 2026, signed Feb. 3, 2026, delinks Medicare Part D PBM compensation from drug prices and rebates, requires full rebate pass-through to employer group health plans, and expands reporting and audit obligations. The U.S. Department of Labor has proposed a PBM fee disclosure rule under ERISA that would require detailed compensation reporting and give self-funded plan fiduciaries explicit audit rights. That proposal, published in January 2026, remains a proposal as of this update. All 50 states have enacted PBM legislation, according to the National Academy for State Health Policy, with ongoing activity around licensing, spread pricing limits, and network and reimbursement rules.

For health plans, the natural question is: If federal and state reforms are finally putting pressure on PBMs, how much more should we invest in independent oversight?

These reforms raise the bar for what credible oversight looks like, and they make continuous PBM monitoring the next discipline sophisticated plans will need to adopt.

Key federal PBM reform dates for health plans

• Feb. 3, 2026: CAA 2026 is signed into law.

• Jan. 1, 2028: PBMs acting for Medicare Part D sponsors, including MA-PD plans, may be paid only through bona fide service fees, defined as flat fees consistent with fair market value. HHS will set the details through rulemaking.

• July 1, 2028: Annual PBM reporting to Part D sponsors and HHS begins.

• 2029 for calendar-year plans: Employer group health plan provisions generally apply to plan years beginning 30 months after enactment. They include 100% rebate pass-through, semiannual drug-level reporting for larger plans, and annual audit rights with an auditor selected by the plan fiduciary.

• DOL fee disclosure proposal: Published Jan. 30, 2026, for self-insured ERISA plans. Its proposed July 1, 2026, applicability date passed without a final rule, so any final rule will set new dates. The DOL has asked for comment on how the rule should align with CAA 2026.

Implementing rules and guidance are still being written, so confirm specific obligations and dates with counsel.

The new PBM landscape pharmacy leaders must manage

Consider what has shifted in just the last few cycles:

• Compensation models are changing. Federal law now requires flat service fees in Part D and MA-PD, full rebate pass-through for employer group health plans, and an end to spread-based PBM compensation in Part D.

• Disclosure expectations are rising. CAA 2026 requires PBMs to give employer group health plans detailed drug-level reports and annual audit access. The DOL proposal would add direct and indirect compensation disclosures and give fiduciaries audit rights to evaluate whether those arrangements are reasonable.

• Regulatory and political focus is sustained, not episodic. FTC staff have indicated continued scrutiny of formulary design, specialty drug pricing, and vertically integrated PBM–payer–pharmacy entities, and the agency's case against Caremark and Optum Rx remains active.

• State requirements are stacking. States continue to revisit PBM licensure, spread pricing bans, MAC requirements, pharmacy network rules, and plan design constraints, creating a layered set of expectations on top of federal rules. In Medicaid, MACPAC reports that at least 31 states have established PBM rebate reporting requirements to the state.

Every one of those shifts has to be expressed in contracts, benefit designs, and configuration. On paper, the direction is favorable: more transparency, different incentives, stronger fiduciary tools. In practice, each round of reform creates another set of moving parts that has to be built correctly and then kept in sync across lines of business.

Why current oversight will feel increasingly out of step

Most health plans already have an oversight toolkit: you negotiate hard on contract terms, run implementation and annual benefit build reviews, use scorecards and operational dashboards, and commission retrospective audits to test guarantees and pricing.

Those tools were built for a world where contract and regulatory change happened in discrete bursts, where checking "Are we generally on track?" a few times a year was sufficient, and where "we audit our PBM" satisfied plan leadership.

The environment has shifted. Three things are happening at once:

• Benefit and contract change is becoming continuous. Federal reforms, state laws, and client demands are pushing more frequent re-cuts of pricing terms, guarantees, and program design.

• Disclosure is shifting the burden back to plans. With new audit rights and data feeds, fiduciaries are expected not just to receive information but to do something with it.

• Stakeholder questions are more pointed. Plan leadership, regulators, and large employer clients are now asking, "How do you know these new rules and terms are actually being applied correctly?" instead of only asking, "Do you have a PBM audit?"

Traditional implementations, scorecards, and audits still answer important questions. However, they are not designed to give a real-time view of whether your benefit design is configured correctly as you roll out changes, whether new compensation and pricing terms are reflected accurately at the claim line, or whether state and federal rules are being applied as expected.

That is the gap continuous PBM oversight is meant to fill.

What continuous PBM oversight actually is

Continuous PBM oversight is an operating discipline that checks, on an ongoing basis, whether pharmacy claims are being adjudicated according to three things you already own:

• Your benefit design and clinical intent

• Your PBM contract, including new fee, pricing, and performance terms

• The regulatory framework that applies across your lines of business

At Rivera, we describe this as pharmacy payment integrity: continuously checking whether each PBM-paid claim matches the benefit, the contract, and the configuration rules that should govern it, instead of assuming the build is right. Health plans have operated payment integrity programs on the medical benefit for years. It's time for pharmacy programs to implement the same rigor.

For a health plan pharmacy leader, this capability means being able to:

1. Validate contract-to-claim performance in production

When you move to delinked compensation, full rebate pass-through, or new specialty guarantees, you should not have to wait for a year-end audit to see whether those terms are being honored. Errors in a pass-through model accumulate across the year as many small under- or overpayments unless you are testing claims as they are paid. Continuous monitoring reprices claims back to contract and flags where results diverge from what was negotiated.

2. Confirm that benefit design is configured and maintained correctly

Configuration drift is the gap that opens when the adjudication setup in a PBM's claims system no longer matches the benefit design and contract terms a plan approved. Each new plan year and each mid-year change introduces opportunities for that drift in accumulators, prior authorization rules, step edits, network constructs, and member cost-sharing logic. A continuous discipline tests whether real-world adjudication matches the benefit you believe you are running.

3. Make sense of new data and disclosure

The combination of CAA 2026 reporting, Part D reforms, and state reporting gives you more PBM data, but not necessarily more insight. A continuous oversight capability lets you line up PBM-reported performance with your own claims, eligibility, and configuration data, so you can answer "What is actually happening?" with numbers, not narratives.

4. Document a defensible oversight posture

As enforcement actions and litigation continue, plans that can show a clear record of issues detected, remediations, and structural fixes will be in a stronger position with leadership, regulators, and large clients than those relying solely on occasional audits and vendor attestations.

For contract terms, governance cadences, and claim-level repricing methodology, see how to build PBM oversight for a health plan. For how audits and continuous monitoring work together, see PBM audits vs. continuous monitoring. For how mid-year changes create errors, see what configuration drift means in pharmacy benefits.

Pharmacy payment integrity is about getting claims right, not clawing money back from pharmacies, members, or providers. When issues are caught and corrected, the result is alignment, not conflict.

Most pharmacy leaders have the intent. What they lack is scale. A team reviewing claims manually will always be working a sample, and systemic issues don't reliably surface in small data sets. Continuous oversight means running every claim, not a subset, against the full set of contract, configuration, and benefit rules. No team can do that with spreadsheets and annual audits. The discipline requires infrastructure that most pharmacy leaders don't have today.

Where Rivera fits

Rivera was built on the premise that pharmacy benefit oversight would have to move from episodic, sample-based checks to continuous, claim-level monitoring, and we help you create it without rebuilding your entire oversight function. Rivera's 750+ proprietary algorithms review 100% of pharmacy claims post-adjudication, and Rivera's clinical pharmacists validate findings before they reach your pharmacy team.

In practical terms, Rivera gives health plans three main advantages in the current environment:

1. A live view of contract and benefit performance

Rivera continuously reprices pharmacy claims against contract and benefit rules, highlighting where new terms around pass-through, fees, or specialty reimbursement are not being applied the way you expect.

2. A single cross-product oversight lens

As Medicare, commercial, Medicaid, and self-funded lines of business experience different mixes of federal and state PBM rules, Rivera normalizes claim-level findings so you can see patterns and address issues once, rather than in siloed projects.

3. Evidence for stakeholders who now expect more

Plan leadership, regulators, and employer clients will not be satisfied with "We have a PBM audit." They will want to see trend lines, financial impact, and corrective actions. Rivera's continuous monitoring produces those proof points: identified and documented overpayments, corrected claims, configuration fixes, and pattern changes that demonstrate active stewardship of pharmacy dollars.

Looking ahead

The FTC's actions, CAA 2026, and the DOL's PBM fee disclosure proposal open a new phase in how pharmacy benefits are governed, priced, and monitored.

Reform has moved the conversation from whether PBMs should be more transparent to how that transparency is implemented and verified. It has raised expectations that plans will understand their pharmacy dollars at the claim, contract, and policy level, and be able to show their work.

The question for health plan pharmacy leaders is whether you can credibly meet your fiduciary, regulatory, and business obligations without beginning to build this discipline now, well before the 2028 and 2029 effective dates arrive.

Plans that treat reform as a reason to ease up on oversight will still be accountable for every dollar that runs through their pharmacy benefit. Plans that use this moment to stand up a continuous, independent monitoring capability will be able to demonstrate something stronger than compliance: that they turned reform into measurable value for members and sponsors.

In practice, that starts with a clear-eyed look at where your current oversight has gaps, not only in audit frequency, but in how quickly you can detect when a new contract term, benefit change, or regulatory requirement is not being applied correctly at the claim level. The plans that can answer that question with evidence, not assumptions, are the ones operating from a position of strength.

Those are the plans that will be ready for whatever comes next.

Frequently asked questions

When do the CAA 2026 PBM provisions take effect?

Medicare Part D compensation changes begin Jan. 1, 2028. Employer group health plan provisions generally apply to plan years beginning 30 months after the Feb. 3, 2026, enactment, which is 2029 for calendar-year plans.

Does PBM reform replace independent PBM oversight?

No. Reform sets new contract, reporting, and audit requirements. Confirming that claims are paid under those terms still requires claim-level review of adjudicated pharmacy claims against the contract, the benefit design, and applicable state and federal rules.

How is continuous monitoring different from a PBM audit?

An audit typically reviews a sample of claims after the plan year closes. Continuous pharmacy claims monitoring reviews 100% of claims on an ongoing basis, so configuration errors introduced mid-year are found in the cycle they occur.

Download the PDF → Reform does not enforce itself