The PBM Disclosure Rule: What Employers Finally Get to See

The Department of Labor's new PBM fee disclosure rule makes your pharmacy benefit manager tell you, in dollars, how it gets paid. Before every renewal, every six months, and in an audit you control. It covers self-funded and level-funded plans at employers with 100 or more employees, starting with plan years that begin on or after July 1, 2027.

DOL announced the final rule on October 29, 2026. It took 14 years to get here. Here's what it requires, when it lands on your desk, who it leaves out, and what you can ask for today.

What does the PBM fee disclosure rule require?

Three things. Disclose. Report. Audit.

Disclose. Before every renewal or extension, the PBM tells you what it expects to make. Ninety days ahead counts as reasonable. Every figure has to be a dollar amount. Not a formula. Not a percentage off a list price nobody pays. The disclosure covers:

• What you pay the PBM directly, split out by service
• Rebates and other payments from drug makers, drug by drug, with how much comes to your plan and how much the PBM keeps
• The spread on each drug, at retail, mail order and specialty
• Money clawed back from pharmacies after the fact
• Price protection deals with drug makers, and who keeps that money
• Formulary deals. When a drug pays the PBM something it doesn't pass on, the PBM has to name the cheaper equivalents it left off your formulary, biosimilars included, and say why.
• The net price of every drug on the formulary, after rebates

Report. Every six months, the PBM reports what it actually made, within 30 days of the period. You can ask for quarterly reports instead. Any category that runs 5% or more over the estimate needs an explanation. You can negotiate a lower trigger.

Audit. At least once a year, you can check the numbers with an auditor you choose. The PBM can't limit who that is. It has 10 business days to confirm your request and 60 days to hand over claims-level data, plus its contracts with pharmacies, drug makers and rebate aggregators. Data its affiliates hold counts too, so the rebate middlemen a PBM owns don't put the records out of reach. You pay the auditor. The PBM pays to pull the data.

Why did it take 14 years?

Because health plans got left out, then left out again. On February 3, 2012, DOL made 401(k) and pension providers disclose what they're paid. Health plans got one line in that rule: "(2) Welfare plan disclosure. [Reserved]."

That blank sat there. In 2021, Congress made brokers and consultants disclose their pay. The PBM's own pay stayed a gray zone. Then the government started looking. In 2024, the FTC found that three PBMs handled nearly 80% of U.S. prescriptions. A few months later, it found more than $7.3 billion in markups on specialty generic drugs at the big three's own pharmacies.

PBM reform made it into the year-end funding bill in December 2024. Then it got cut. In April 2025, an executive order told DOL to write a rule. On February 3, 2026, 14 years to the day after the first rule, the law was signed. This fall, DOL went back to that exact line. It now reads "See § 2550.408b-22."

When will the first disclosure land on your desk?

It depends on your plan year. Three clocks are running, and most coverage mixes them up.

Clock one is the law, and it's running now. Since February 3, 2026, your PBM, your administrator and your broker have owed you a disclosure of what they're paid. DOL is enforcing it on a good-faith basis while everyone catches up. The duty is real today.

Clock two is the rule. It applies to plan years starting on or after July 1, 2027. The first disclosure comes 90 days before renewal. A July 1 plan sees it around April 2027. For a calendar-year plan, the first plan year under the rule starts January 1, 2028, so its first disclosure shows up around October 2027.

Clock three is August 3, 2028. For plan years starting on or after that date, the law says PBMs pass 100% of rebates, fees and discounts through to the plan. Until then, your contract's definition of a rebate decides what you actually get.

Who does the rule cover, and who's left out?

Self-funded plans at employers averaging 100 or more employees. The count is employees, not people on the plan. A company with 150 employees and 80 enrolled is in.

Level-funded plans count. DOL says level-funded arrangements "are actually self-funded." Whoever contracts with your plan for pharmacy services, a TPA or a carrier's level-funded product, has to get the PBM's numbers and pass them to you. That matters, because in a bundled level-funded plan the carrier usually picks the PBM, not you.

Fully insured plans are out for now. DOL left their part of the rule reserved, the same move it made for health plans in 2012. Sound familiar? And when the pass-through starts in 2028, a fully insured plan's rebates go to the insurance company, at least as the law reads today. Not to you.

Self-funded with fewer than 100 employees? You're owed a shorter, simpler disclosure under the law, not the detailed one in the rule.

What can't the rule do?

It doesn't ban anything. The rule says it "does not prohibit spread pricing." It doesn't set prices. It doesn't cap fees. Deciding whether the pay is reasonable is still your job as the plan fiduciary.

Every number in the disclosure comes from the PBM. Truth is, it's the PBM grading its own homework. That's why the audit right matters. DOL's own analysis even cites the risk that PBMs find new ways to get paid outside the disclosures.

Keep the savings in perspective. DOL says the rule could lower drug costs by up to $22 billion over 10 years. That's the top of its own range. Its primary estimate works out to about $8 billion. Plan on less than that.

What should you do before your next renewal?

Three moves.

1. Count back 90 days. Find your renewal date and put the disclosure date on the calendar now. Then check your contract term. A lot of PBM contracts run three years, so one you sign this year runs right into the rule. Write the rule's terms into it now.
2. Ask now. Ask your PBM, your administrator and your broker for their compensation disclosure, in writing. The law already requires it. At renewal, write the rule into your contract: dollars, drug by drug, quarterly reports, a data file you can analyze, an overage trigger lower than 5%, and your audit rights spelled out.
3. Check it and write it down. When the disclosure arrives, read it. Compare what the PBM promised with what it made. Numbers that don't add up are what the audit is for. Then document what you looked at, what you decided and why.

A disclosure nobody reads isn't protection. It's proof you had it.

Frequently asked questions

Does the PBM disclosure rule apply to level-funded plans?

Yes, when the employer averages 100 or more employees. DOL treats level-funded arrangements as self-funded. The TPA or carrier that contracts with your plan for pharmacy services has to get the PBM's numbers and pass them to you. Your TPA still isn't your fiduciary, so reading them stays your job.

When will I get my first PBM disclosure?

About 90 days before your first renewal under the rule. The rule applies to plan years starting on or after July 1, 2027. A July 1 plan should see one around April 2027. A calendar-year plan should see one around October 2027.

Does the new rule ban spread pricing?

No. The rule says it "does not prohibit spread pricing or require that PBMs pass on 100 percent of rebates." It makes the spread visible, drug by drug. The 100% rebate pass-through comes from the 2026 law, for plan years starting on or after August 3, 2028.

What happens if my PBM doesn't send the disclosure?

Ask the PBM in writing to fix it. If it hasn't within 90 days, notify DOL within 30 days after that. Then decide whether to keep the PBM, and write down why. Those steps are what keep you protected as the plan fiduciary.