New Federal Transparency Requirements for PBMs

On Feb. 3, 2026, the Consolidated Appropriations Act (CAA) of 2026 was signed into law, a funding package containing significant reforms for the pharmaceutical benefit manager (PBM) industry. As background, health plans generally rely on PBMs to process prescription drug claims, design pharmacy networks and negotiate rebates from drug manufacturers. In recent years, the PBM industry has faced growing scrutiny amid questions from stakeholders regarding a lack of transparency and certain practices, such as retaining a share of drug manufacturer rebates.

To address these growing concerns, the CAA creates the following new disclosure requirements, effective for plan years beginning on or after Aug. 3, 2028:

• PBMs must provide group health plans and health insurance issuers with detailed drug spending data at least twice per year, or quarterly if requested. PBMs must also supply drug spending summary documents that health plans can share with participants upon request.
• Each year, health plans must provide participants and beneficiaries with a written notice explaining that their PBM is required to submit prescription drug spending reports.

In addition, in order for their contracts to be considered reasonable under the Employee Retirement Income Security Act, PBMs must pass on 100% of all rebates, fees, alternative discounts and other remuneration to health plans and issuers. This change is also effective for plan years beginning on or after Aug. 3, 2028.

Separately, the U.S. Department of Labor announced on Jan. 28, 2026, a proposed rule that would establish new PBM fee-disclosure obligations, further underscoring the federal government’s increasing focus on regulatory oversight of the industry.

HHS Updates Model HIPAA Privacy Notices for Part 2 Records

On Feb. 13, 2026, the U.S. Department of Health and Human Services (HHS) released updated model Notices of Privacy Practices (Privacy Notices) under the Health Insurance Portability and Accountability Act (HIPAA) for health plans and health care providers to use. HIPAA covered entities must update their Privacy Notices if they receive or maintain patient records regarding substance use disorder (SUD) treatment provided by a federally assisted treatment program (i.e., a “Part 2 program”). The deadline for making this update was Feb. 16, 2026.

As background, Part 2 is a federal law that protects the confidentiality of patient records for individuals receiving services for SUDs, which are called Part 2 records. A final rule issued by HHS in April 2024 requires covered entities to update their HIPAA Privacy Notices if they receive or maintain Part 2 records. The updated Privacy Notices must address how the covered entity may use and disclose Part 2 records, the entity’s responsibilities with respect to the records and individuals’ privacy rights. According to HHS, its updated model Privacy Notices reflect the changes for Part 2 records.

Employers with self-insured health plans should ensure their HIPAA Privacy Notices are updated for the new privacy requirements for Part 2 records. Employers with fully insured health plans that have access to protected health information should also ensure their HIPAA Privacy Notices are updated for the new requirements.

Health plans that use HHS’ model Privacy Notice should customize it by entering their own information.
View a PDF version of this newsletter.