SUPPORTING STATEMENT FOR PAPERWORK REDUCTION ACT 1995 SUBMISSIONS

Status: Original and derived artifacts are available for this document.

Download: docx | pdf | html

SUPPORTING STATEMENT FOR PAPERWORK REDUCTION ACT 1995: PBM FEE DISCLOSURE REGULATION UNDER 408(B)(2)
		
This ICR seeks approval for a revision of an existing control number.

A. 	JUSTIFICATION

    1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

In Executive Order 14273, Lowering Drug Prices by Once Again Putting Americans First, President Trump instructed the Department to propose regulations under ERISA section 408(b)(2) requiring greater transparency into pharmacy benefit managers (PBM) compensation.1 The Executive Order seeks to increase transparency and accountability in the prescription drug market, and this final rule implements that directive.2 This final rule is also a part of the Trump Administration’s larger initiative to address rising healthcare costs for Americans.3 

ERISA section 408(b)(2) exempts certain service arrangements from ERISA’s prohibited transaction rules if the arrangement and compensation are reasonable and the services are necessary. The Consolidated Appropriations Act, 2026 (CAA, 2026) added disclosure requirements for PBMs and other covered service providers as a condition of that exemption.4 This final rule implements those requirements for PBMs and affiliated brokers and consultants serving covered plans. PBMs provide services to ERISA-covered self-insured group health plans, including managing pharmacy networks, negotiating reimbursements and rebates, establishing formularies, processing claims, and managing utilization.5,6,7 PBMs, brokers, and consultants that assist plan fiduciaries, may receive compensation from multiple sources, creating a need for greater transparency. 

Longstanding concerns about incomplete compensation disclosures led to recommendations for expanded disclosure requirements, which Congress subsequently enacted.8,9 Congress also imposed additional requirements, effective for plan years beginning on or after August 3, 2028, concerning rebate pass-throughs and disclosures of drug spending and utilization10,11

The final rule requires covered service providers to disclose their compensation and provides audit rights so responsible plan fiduciaries of large, self-insured group health plans can assess the reasonableness of PBM arrangements and monitor covered service providers.

    2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

The final regulation would require covered service providers to disclose information to responsible plan fiduciaries of group health plans regarding services and compensation in connection with the service contracts or arrangements with the plan. Covered service providers under the final rule are (i) providers of pharmacy benefit management services and (ii) providers of advice, recommendations, or referrals (e.g., brokers and consultants) regarding pharmacy benefit management services who are themselves providers of pharmacy benefit management services or their affiliates.

The three main components of the final regulation are: (i) initial disclosure requirements; (ii) follow-up disclosure requirements; and (iii) requirements designed to preserve the group health plans’ abilities to audit such disclosures. Additionally, the final rule includes a prohibited transaction class exemption for responsible plan fiduciaries acting in good faith in the event the covered service provider fails to comply with the regulation. 

The final regulation would require PBMs to provide disclosures only to large, self-insured group health plans. The final rule reserves disclosure obligations with respect to fully insured group health plans for future action. This approach was taken based on the view that responsible plan fiduciaries may focus on different considerations when contracting with an insurance company for health insurance coverage that integrates prescription drug coverage, as opposed to self-funding medical care and contracting on an unbundled basis for pharmacy benefit management services. 

    1. Initial Disclosures

The final rule’s initial disclosure requirements, which would be provided reasonably in advance of the contract or arrangement, would include disclosures of the services to be provided as well as a description of compensation reasonably expected to be received on a semiannual (or at the request of the covered plan, quarterly) basis in connection with the service contract or arrangement. The final rule specifies that the compensation to be disclosed includes: (i) direct compensation paid by the plan or plan sponsor on behalf of the plan; (ii) payments from drug manufacturers (e.g., rebates PBMs receive from manufacturers); (iii) spread compensation; (iv) pharmacy recoupment; (v) price protection agreements; (vi) compensation for termination of the service contract or arrangement, as well as (v) other compensation not specifically enumerated by name in the final rule (this is to function as a “catchall” category). The initial disclosure would also include a description of incentives and arrangements with drug manufacturers related to the placement of their drugs on the plan’s formulary, identification of reasonably available alternatives omitted from the formulary and a reason for the omission, and  the drug pricing methodology that would be used to determine the drug prices paid by the plan. Additionally, this disclosure would also include a statement of fiduciary status if the covered service provider, an affiliate, an agent, or a subcontractor will provide, or reasonably expects to provide, services as a fiduciary; and will also include a statement of audit rights. 

    2. Follow-up Disclosures

The final rule’s semiannual disclosures would describe compensation received in connection with the service contract or arrangement covering the preceding six-month period (or at the request of the covered plan, quarterly). The compensation would be presented in the same categories of compensation as the initial disclosures, with the exception of compensation for termination of the service contract or arrangement (direct compensation, manufacturer payments, spread compensation, pharmacy recoupment, price protection agreements, and other compensation not otherwise disclosed). The semiannual disclosures would provide transparency into the actual compensation received in connection with the service contract or arrangement and a means for the responsible plan fiduciary to assess the estimates used by the covered service provider in its initial disclosure. Where any category of compensation, in aggregate, exceeds specified thresholds, the covered service provider would be required to identify the amount and reason for the overage. This disclosure would also include statements of fiduciary status and of audit rights. 

    3. Audit Rights

The regulation would also preserve the group health plans’ ability to conduct an audit of any disclosures made pursuant to the regulation not less than once per year. In this regard, the final rule provides that the plan fiduciary may select an auditor without limitations imposed by the covered service provider, and the covered service provider would be required to make available within a commercially reasonable period all records, data, and other information that is reasonably necessary to confirm the accuracy of the disclosures, including data owned or held by an affiliate, an agent, or a subcontractor. While the plan would have responsibility for the expenses related to the selection and retention of the auditor, the covered service provider would bear the cost of providing the information, data, and other materials needed to perform the audit. The covered service provider may not impose conditions that would restrict the covered plan’s right to conduct an audit, including restrictions on the period of the audit, the location of the audit, or the number of records to be provided, except that the scope of the audit is limited to the period covered by the disclosures made pursuant to the regulation.

    4. Innocent Fiduciary Exemption

The final rule also includes special relief – in the form of a prohibited transaction exemption from the restrictions of ERISA section 406(a)(1)(C) and (D) – for a responsible plan fiduciary where the covered service provider fails to meet obligations set forth in the final regulation, if certain conditions are met. See 29 CFR 2550.408b-22(n)(1). Otherwise, the final rule could inadvertently impose harm on responsible plan fiduciaries for failures outside of their control. 

Upon discovering a failure, the responsible plan fiduciary must request in writing that the covered service provider correct the failure. If the covered service provider refuses to correct the failure or fails to do so within 90 calendar days of the written request, the responsible plan fiduciary must notify the Secretary. The notice must identify the covered plan, plan sponsor, responsible plan fiduciary, and covered service provider; describe the services provided and the covered service provider’s failure; identify the date corrective action was requested; and state whether the covered service provider continues to provide services to the plan. The notice must be filed with the Department no later than 30 calendar days following the earlier of the covered service provider’s refusal to correct the failure or 90 calendar days after the written request was made. See 29 CFR 2550.408b-22(n)(1)(ii)–(iii), (n)(2)–(4) for content and filing requirements. 

The responsible plan fiduciary must assess whether to terminate or continue the contract or arrangement consistent with the duty of prudence under section 404 of ERISA and document the basis for that determination. See 29 CFR 2550.408b-22(n)(5).

    3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration for using information technology to reduce burden.

Section 2520.104b-1(c) sets forth conditions under which disclosures under Title I of ERISA made through electronic media will be deemed to satisfy the requirement of § 2520.104b-1(b). Section 2520-107-1 establishes standards concerning the use of electronic media for maintenance and retention of records. Under these rules, all pension and welfare plans covered under Title I of ERISA may use electronic media to satisfy disclosure and recordkeeping obligations, subject to specific safeguards.

The use of electronic methods of compliance is neither required nor precluded in this information collection. The Department has assumed that the information collection requirements will be performed by sophisticated financial entities. These entities will generally comply with disclosure requirements by electronic means. 

The final rule and accompanying class exemption does not limit the ability of covered service providers to furnish information required by the regulation to responsible plan fiduciaries via electronic media. In addition, the final regulation provides that upon request of a responsible plan fiduciary of a self-insured group health plan, descriptions of compensation must also be provided, within a reasonable time after such request, in a machine-readable file. For this purpose, the final rule provides that “machine-readable file” means a digital representation of data or information in a file that can be imported or read by a computer system for further processing without human intervention, while ensuring no semantic meaning is lost. This requirement of the final rule is designed to ensure that a responsible plan fiduciary can obtain information in this format if the responsible plan fiduciary determines that this will aid in its evaluation of the reasonableness of the contract or arrangement.

    4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.

No duplication with other Federal statutes exists. In some circumstances, several states have adopted disclosures requirements for PBMs regarding elements included in this final rule, including rebate payments, spread pricing and drug prices.12 However, no duplication occurs because the same information disclosure may be used to satisfy duplicative or overlapping requirements.

    5. If the collection of information impacts small businesses or other small entities, describe any methods used to minimize burden.

The final rule applies only to self-insured group health plans offered by “specified large employers” and self-insured group health plans that are “specified large plans.” The exclusion of small plans from the final rule will likely help small PBMs. While the Department lacks explicit information on the clients of small PBMs, small PBMs likely have small plans for which they will not have to provide required disclosures or other items covered by the final rule.13  

    6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

The purpose of the final regulation is to ensure that responsible plan fiduciaries have sufficient information to evaluate the quality and competitiveness of the fees received by their potential service providers. The enhanced disclosure will increase efficiency and competition in the service provider market, thereby generating benefits to self-insured group health plans and plan participants. These benefits will not be realized if the information is not collected or is collected less frequently.

    7. Explain any special circumstances that would cause an information collection to be conducted in a manner:
    • requiring respondents to report information to the agency more often than quarterly;
    • requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it;
    • requiring respondents to submit more than an original and two copies of any document;
    • requiring respondents to retain records, other than health, medical, government contract, grant-in-aid, or tax records for more than three years;
    • in connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study;
    • requiring the use of a statistical data classification that has not been reviewed and approved by OMB;
    • that includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or
    • requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law.

The final rule would require a covered service provider to confirm receipt of a request for an audit no later than 10 business days after the information is requested. The 10-day deadline is limited to confirmation of receipt of the request for an audit; the audit information requested is required to be provided within a commercially reasonable period. 

    8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years -- even if the collection of information activity is the same as in prior periods. There may be circumstances that may preclude consultation in a specific situation. These circumstances should be explained.

In addition to requesting public comments on the proposed regulation, the NPRM solicited public comments on the paperwork burden of the proposed regulation (91 FR 4348.) The Department received comments that specifically addressed the paperwork burden analysis of the ICRs contained in the proposed rules. 

The Department received several comments regarding its base-year cost assumptions. One commenter stated that the hour burden was underestimated, arguing that updating systems, generating required client reports, and maintaining the reporting infrastructure could require thousands of hours. Another commenter stated that rule review and compliance activities could exceed $1 million in annual expenditures. The Department acknowledges concerns regarding the cost and complexity of implementing the IT system changes. In response to these comments, the Department has revised its burden estimates to include an additional 160 hours of outside legal counsel support in the first year and 100 hours in subsequent years for reviewing, advising on, and facilitating compliance with IT system changes. 

The Department also received comments concerning whether there were circumstances where the covered service provider should bear the entire cost of the audit. One specifically raised concerns that requiring PBMs to financially contribute to the audit could compromise audit findings. Other commenters suggested the PBM should bear the full costs if the audit reveals material inaccuracies in the disclosures. The Department understands these concerns, and has determined that, consistent with the proposal, under the final rule plans that choose to conduct an audit bear the costs; PBMs and other service providers are only responsible for the cost of providing the underlying data to the auditor. 

One commenter expressed concerns that these provisions could increase administrative burden and costs associated with responding to audit requests, particularly where proprietary information may be involved. However, the Department assumes that most PBMs maintain the underlying data needed for invoices, rebate reconciliation, and contractual compliance. Audit responses are often generated through standardized templates or automated reports, though custom data pulls may be required in some cases. 

One commenter argued the proposed rule raised concerns under the PRA regarding duplication, burden, and practical utility. The commenter stated that the proposal overlaps with the existing CAA reporting requirements for rebates and fees, creating a risk of duplicative and inconsistent reporting. The Department acknowledges the concern regarding potential overlap with the CAA. However, to prevent unnecessary burden, the Department has harmonized the disclosure requirements in this final rule with the existing CAA reporting framework. This harmonization avoids inconsistent reporting and minimizes additional compliance costs. Therefore, the Department concludes that the final rule provides necessary practical utility without creating an unwarranted duplicative burden.

Another commenter suggested updating Schedule C of Form 5500 to capture the compensation disclosures required under the final rule and the CAA 2026. The commenter noted that Schedule C currently does not reflect the expanded disclosure obligations for group health plan service providers. The Department believes that this rulemaking under ERISA section 408(b)(2) is properly focused on disclosures to responsible plan fiduciaries of covered plans. This rulemaking does not establish a new reporting framework for information to be submitted to the Department, other than the reporting provision in the administrative exemption in paragraph (n), which is discussed in greater detail in the preamble. Accordingly, changes to Schedule C of the Form 5500 are outside the scope of this rulemaking. 

    9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

There are no payments or gifts in this information collection. 

    10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

Under the audit provision, information necessary to confirm the accuracy of the disclosures must be provided to the self-insured group health plan including contracts with retail pharmacies and drug manufacturers, subject to reasonable confidentiality agreements to prevent redisclosure of the information. If redisclosure to a third party by the self-insured group health plan is necessary, the covered contract or arrangement may also require the responsible plan fiduciary to establish reasonable confidentiality agreements with such third parties preventing redisclosure and limiting the use of disclosed information to purposes related to the plan’s contract or arrangement. 

    11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

There are no questions of sensitive nature in this information collection. 

    12. Provide estimates of the hour burden of the collection of information. The statement should:
    • Indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than 10) of potential respondents is desirable. If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices.
    • If this request for approval covers more than one form, provide separate hour burden estimates for each form. 
    • Provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead, this cost should be included in Item 14.
    • The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead, this cost should be included in Item 14.

Affected Entities
Group Health Plans
The final rule applies only to a subset of ERISA-covered group health plans, which are self-insured group health plans. Fully insured ERISA plans are not subject to these requirements and are therefore excluded from the estimates. The final rule applies only to self-insured plans of specified large employers and self-insured group health plans that are specified large plans. A specified large employer generally means an employer that employed an average of at least 100 employees on business days during the preceding calendar year or plan year, as applicable, and that employs at least one employee on the first day of the calendar year or plan year. A specified large plan generally means a group health plan that had an average of at least 100 participants on business days during the preceding calendar year or plan year, as applicable. Self-insured plans with 100 or more participants are used as a proxy for identifying an affected plan. 

The Department estimates that there are 113,226 self-insured group health plans with 100 to 999 participants and beneficiaries, and 17,876 self-insured group health plans with 1,000 or more participants and beneficiaries.14 While all 131,102 of these plans are considered self-insured group health plans, the Department uses this distinction to categorize self-insured group health plans by size and other unique features. The 2025 KFF Employer Health Benefits Survey also found that nearly all covered workers (99 percent) are at firms that provide prescription drug benefits to enrollees in their group health plans.15,16 As such, the Department assumes that all large, self-insured group health plans will be affected by the final rule.

TPAs and Issuers 

The Department also estimates that the final rule will affect 205 TPAs and 373 issuers (i.e., health insurance companies) in the group market with 809 issuers/State combinations17 that provide services such as plan management to self-insured group health plans. The Department assumes that these TPAs and issuers will provide their services to self-insured group health plans with fewer than 1,000 participants and beneficiaries. TPAs and issuers are typically hired by self-insured group health plans to perform key administrative and compliance functions, including claims processing, formulary design, and oversight of pharmacy benefits. These service providers will offer economies of scale in regulatory compliance by leveraging their expertise and infrastructure to implement the final rule’s requirements on behalf of multiple self-insured group health plans. While responsible plan fiduciaries remain ultimately responsible for ensuring compliance, they rely on TPAs and issuers to manage the day-to-day operations of the self-insured group health plan and fulfill the requirements of the final rule. Plans may contract with the TPAs or issuers, who in turn sub-contract with PBMs. In that case, the TPAs or issuers would be covered service providers. The TPAs or issuers would be responsible for making the disclosures to the self-insured group health plan as required under the final rule and therefore must be able to obtain information from the provider performing the pharmacy benefit management services necessary for those disclosures. 

The following wage rates were used in this analysis: $187.58 (legal professional), $178.08 (IT professional), $124.74 (benefit specialist), $131.29 (project management specialists), $124.74 (business operations specialists), and $178.08 (software and web developers, programmers, and testers).18 

    1.  IT Infrastructure Costs

the Department believes that most PBMs already have the required information needed to fulfill the disclosure requirements, as they manage complex healthcare operations and track the flow of pharmaceuticals and payments within the healthcare system as part of their regular business practices. Moreover, PBMs already provide this information, or elements of it, to self-insured group health plans and other entities, as required under the CAA, 2021 and State laws.19 Therefore, the Department does not expect that PBMs will need to devote significant resources to obtain or share information on the services provided under the agreement, direct and indirect compensation, rebates, drug prices and the pricing methodology, reimbursement rates, formulary placement incentives, and agreements with agents, affiliates and subcontractors. 

Nonetheless, greater transparency could identify practices such as rebates and spread pricing that are often regarded as hidden revenue mechanisms. As a result, PBMs may explore alternative revenue strategies, including fee-based models, and renegotiate contracts with self-insured group health plans, manufacturers, and wholesalers. Moreover, the Department anticipates that PBMs will need to revise current disclosure documents to include: revised definitions of contract terms that are objectively determinable; a description of all arrangements and compensation received by the PBM and any agents, affiliates or subcontractors related to providing these benefits; pricing and reimbursement information for all drugs on the formulary by distribution channel; more detailed descriptions of the services provided including the development and ongoing management of the formulary; as well as projecting potential costs and extracting actual payments to the level stipulated in this final rule. The Department acknowledges that these updates and revisions may require substantial effort and coordination by PBMs and their agents, affiliates and subcontractors.
 
In Table 1, the Department estimates the costs associated with PBMs developing and maintaining the IT infrastructure system necessary to collect and report the required data. To develop these estimates, the Department reviewed IT infrastructure costs associated with reporting complex, sensitive, or high-frequency data for similar disclosure regulations, including Prescription Drug Data Collection,20 ACA Medical Loss Ratio (MLR) Reporting,21 Medicare Part D Reporting Requirements,22 and the Hospital Price Transparency Requirements.23 Of these rules, the IT costs associated with Prescription Drug Data Collection rule seemed most analogous to this final rule, as it specifically identified costs for PBMs to develop, implement, and maintain IT system changes to come into compliance with rulemaking related to prescription drug disclosures. 
The Department used the Prescription Drug Data Collection rule as a benchmark but made a few notable adjustments. First, because the Department of Health and Human Services utilizes a different source for labor categories and wage rates than the Department, that information was mapped to the Department’s source. Additionally, the hour burdens from the Prescription Drug Data Collection rule were adjusted downward by 50 percent to account for both the Prescription Drug Data Collection rule requiring additional information and calculations not found in this final rule, and the fact that the final rule relies on contract and pricing data that PBMs already track for commercial and compliance purposes, which should mitigate the associated costs. Finally, while data submission began in the second year for Prescription Drug Data Collection disclosures, the final rule requires reporting in the first year, and so the Department reallocated hour burdens from Prescription Drug Data Collection’s second year into first and subsequent year categories for the final rule. Based on these considerations, the Department estimates the average, first-year per-PBM cost for designing, developing, and implementing the IT system to be $1,100,000.24 In subsequent years, the estimated per-PBM average cost for maintaining and updating the IT system is $300,000.25 This includes providing quality assurance, conducting maintenance and making updates, and updating any needed security measures. 

The Department acknowledges that these costs likely vary by the size of PBMs as well as their business model (i.e., fully pass-through PBMs and traditional PBMs may face very different costs to bring systems into compliance). Additionally, while the Department discounted the Prescription Drug Data Collection costs to reflect its impact on more of the overall market and requiring additional calculations and standardized submissions, the chosen discount rate may not have been appropriate. 

Please see Table 1 for calculations and burden. 

TABLE 1. IT Infrastructure Costs

 
Number of Notices 
Number of Hours Per Notice 
Total Hour Burden
Hourly Wage
Cost Equivalent of Hour Burden 
 
(A)
(B)
(C) = (A x B)
(D)
(E) = (C x D)
PBMs design, develop, and implement needed IT systems changes (first year)
Lawyers
73
160
11,680
$659.15
$7,698,872 
Project Management Specialists
73
2,250
164,250
$131.29  
$21,564,383  
Business Operations Specialist
73
750
54,750
$124.74  
$6,829,515  
Software and Web Developers, Programmers, and Testers
73
3,500
255,500
$178.08  
$45,499,,440  
PBMs design, develop, and implement needed IT systems changes (subsequent years)
Lawyers
73
100
7,300
$659.15
$4,811,795 
Project Management Specialists
73
500
36,500
$131.29  
$4,792,085  
Business Operations Specialist
73
50
3,650
$124.74  
$455,301  
Software and Web Developers, Programmers, and Testers
73
750
54,750
$178.08  
$9,749,880  
First Year Total 
73
-
486,180
-
$81,592,210  
Subsequent Year Total
73
 
102,200
 
$19,809,061  
Three-Year Average 
73
 
230,193
 
$40,403,444  

    3. Number of Notices from PBMs

The following sections discuss the number of notices that PBMs would provide to self-insured group health plans and the associated costs. These notices apply to self-insured plans with 100 or more participants and beneficiaries.

Number of Initial Notices from PBMs

The final rule would require PBMs or other covered service providers to provide initial disclosures to responsible plan fiduciaries of self-insured group health plans, reasonably in advance of the date on which the contracts or arrangements are entered into, extended or renewed. Standard industry contracts appear to be for three-year periods, though it is unclear if the agreements themselves are extended or renewed during that time.26 The Department anticipates that approximately one-third of the self-insured group health plans will annually initiate new contracts, extend existing contracts, or renew contracts. 

Number of Follow-Up Notices from PBMs

The final rule also requires that PBMs or other covered service providers furnish disclosures on a semiannual basis (or at the request of the covered plan, quarterly) within 30 calendar days following the conclusion of each six-month period starting from the contract or arrangement initiation date. The Department estimates that PBMs or other covered service providers would submit these disclosures to each self-insured group health plan twice each year. The required semiannual disclosures cover two quarters each year, leaving two quarters in which no semiannual disclosure is provided. During those remaining quarters, the Department assumes that ten percent of plans will request quarterly disclosures

Number of Notices Upon Requests from PBMs

The final rule also requires PBMs or other covered service providers to provide any other information related to the contract or arrangement that is required for the self-insured group health plan to comply with the reporting and disclosure requirements of Title I of ERISA and the regulations, forms, and schedules issued, upon request of the responsible plan fiduciary. Without a strong data source for determining the number of expected requests, the Department assumes that approximately ten percent of responsible plan fiduciaries will request covered information annually.

Number of Notices from Plans

Exemption for Responsible Plan Fiduciaries

The final rule also includes an administrative class exemption that would provide relief from ERISA section 406(a)(1)(C) and (D) for responsible plan fiduciaries who enter into a contract or arrangement, where the PBM or covered service provider fails to comply with its obligations under the regulation. To rely on the exemption, the responsible plan fiduciary must not have been aware that the PBM or covered service provider failed or would fail to meet these requirements and, upon discovering this omission, requests in writing that the PBM or other covered service provider furnish the required information or comply with the audit requirement. The Department does not have data on how often responsible plan fiduciaries do not receive all of the required disclosures from a covered service provider. In this analysis, the Department assumes that 0.3 percent of arrangements may experience an omission or error that will require the responsible plan fiduciary to send the request to the PBM.27 This assumption is based on the Department’s experience that it is rare for pension plans to submit a notice under the requirement in 29 CFR section 2550.408b-2. 

If the PBM or other covered service provider does not respond within 90 calendar days, the responsible plan fiduciary must notify the Department of the failure and further must assess whether to terminate or continue the service contract or arrangement consistent with the duty of prudence under section 404 of ERISA, including documenting the basis for that determination. The Department assumes that approximately 10 notices will be submitted, based on the experience that pension plans rarely submit these notices under the requirement in 29 CFR section 2550.408b-2

Number of Notices from Self-Insured Group Health Plans Requesting Audits Information

As part of their oversight responsibilities, responsible plan fiduciaries must assess the quality of the PBM or other covered service provider’s performance under the contract or arrangement (e.g., review and analyze claims data, network discounts, rebates, administrative fees), ensure that PBMs are meeting their contractual obligations, and ensure that self-insured group health plans are only paying reasonable and necessary costs. The final rule contains audit rights which are needed for fiduciaries to carry out these functions. While the cost of performing an audit of PBMs and other service providers is borne by the self-insured group health plan itself, service providers are required to provide the necessary information to the self-insured group health plan or its auditor. This final rule provides a self-insured group health plan’s right to audit the PBM or other covered service provider not less than once per year. The PBM or other covered service provider must confirm receipt of the audit request within 10 business days and must provide the information within a commercially reasonable period.

The Department estimates that one-third of self-insured group health plans will annually submit a request to their PBM or other covered service provider for all information necessary to perform an audit. The Department does not anticipate smaller, self-insured group health plans to submit a request themselves, but expects all issuers or TPAs that market to those self-insured group health plans to request audit materials
Please see Table 2 for calculations on the number of notices. 

	TABLE 2. Number of Notices 

Notice
Number of Plans
Percent of Plans that will Initiate New Contracts, Extend Existing Contracts, or Renew Contracts
Percent of Plans Receiving or Sending Notices
Number of Notices Sent Each Year
Number of Notices
 
(A)
(B)
(C)


(D)
(E) = (A x C x D) or (A x B x C x D)
Disclosures from PBMs to Self-insured Group Health Plans with 100 or more participants and beneficiaries
PBMs provide initial disclosures to plans whose contract is entered, extended, or renewed for plans 
131,102
33%
100%
1
43,701
PBMs provide missing/additional information requested by 
131,102
33%
10%
1
4,370
PBM provides semiannual disclosures 
131,102
100%
100%
2
262,204
PBM provides quarterly disclosures to plans upon request
131,102
100%
10%
2
26,220
Disclosures from Self-insured Group Health Plans with 100 or more participants and beneficiaries
Plans send request to PBMs to disclose other/missing information 
131,102
33%
0.3%
1
131
Plans document the basis for determination on whether to terminate or continue the service contract or arrangement, after PBMs has not responded in 90 days
10
-
100%
1
10
Plans send notice to DOL after PBMs has not responded in 90 days, and document basis for determination 
10
-
100%
1
10
Self-insured Group Health Plans with 100 or more participants and beneficiaries send audit requests to PBM
Plans send request for audits to PBMs
131,102
33%
100%
1
43,701
Total
131,102
-
-
-
380,347

    4. Disclosure Costs

Initial Disclosures

The Department acknowledges that the final rule will impose costs associated with producing initial disclosures before a service contract or arrangement is entered into, extended or renewed. While the Department expects that much of this information will have already been provided to the self-insured group health plan under the solicitation process and in response to a Request for Proposal, it acknowledges that the rule requires additional elements to be included or expanded upon in the required disclosures. Moreover, while it is expected that PBMs have the necessary underlying information readily available, PBMs will need to prepare plan-specific disclosures such as detailed descriptions of projected compensation, payments, formulary placement incentives, and drug pricing. 

The Department assumes that disclosures for large, self-insured group health plans with 100 or more participants and beneficiaries will need to be customized. Therefore, the Department estimates that it will take 30 minutes, due to the customization and review required. Please see Table 3 for calculations and burden.

Finally, paragraph (e)(6) of the final rule requires that the initial disclosure must provide that the responsible plan fiduciary will be notified in advance of any modifications to the formulary that, individually or in the aggregate, are reasonably expected to have a material impact on the reasonableness of compensation under the contract or arrangement. The Department considers that this is a regular business activity and PBMs are providing this information prior to the final regulation. Therefore, PBMs will not incur any additional cost burden. 

Semiannual Disclosures from PBMs

The final rule requires that PBMs or covered service providers furnish disclosures on a semiannual basis (or at the request of the covered plan, quarterly) within 30 calendar days following the conclusion of each six-month period starting from the contract or arrangement initiation date, disclosing the actual compensation that the PBM or other covered service provider received or reasonably expected to receive, under the specific categories that were estimated in the initial disclosures, as discussed earlier. This includes all direct compensation, rebate payments, spread pricing, recoupments from pharmacies by the PBM or other covered service provider, price protection payments, and other compensation. If any category of compensation, in the aggregate, materially exceeds the corresponding estimate described in the initial disclosure, the PBM or other covered service provider must provide an identification of the amount and a reason for the overage. For this purpose, “materially” means five percent or more, or a lower dollar amount or percentage agreed to by the responsible plan fiduciary and set forth in writing in the contract or arrangement.

It is anticipated that the PBM or other covered service provider will already possess the necessary information to fulfil this requirement, as these breakouts are already required in the initial disclosure and standard practice in PBM contracts is to regularly provide self-insured group health plans with invoices or statements that include claims payments, rebates, and administrative fees. The Department assumes these semiannual disclosures will require less time, as they often involve system-generated data, draw on similar information from initial disclosures, and rely on standardized templates. The Department assumes PBMs will rely on standardized templates and batch processing to prepare the notice. Therefore, the Department estimates that requiring PBMs to compile and disclose this information will require 15 minutes of work from a benefits specialist for compilation and distribution of the information semiannually, resulting in 30 minutes of benefit specialist time each year.

The required semiannual disclosures cover two quarters each year, leaving two quarters in which no semiannual disclosure is provided. During those remaining quarters, the Department also estimates that it will take 15 minutes of a benefit specialist’s time to prepare and distribute the requested information. Please see Table 3 for calculations and burden. 

Information Upon Request

Paragraph (i) of the final rule provides that, upon the written request of the responsible plan fiduciary, the covered service provider must furnish any other information relating to the contract or arrangement that is required for the self-insured group health plan to comply with the reporting and disclosure requirements of Title I of the Act and the regulations, forms and schedules issued thereunder. Paragraph (i)(1) requires the covered service provider to disclose the information requested reasonably in advance of the date upon which such responsible plan fiduciary states that it must comply with the applicable reporting or disclosure requirement, unless such disclosure is precluded due to extraordinary circumstances beyond the covered service provider's control, in which case the information must be disclosed as soon as practicable. The Department assumes that PBMs will rely on automated IT systems to prepare the information. Therefore, the Department estimates that it would only require 15 minutes of a benefit specialist’s time to prepare and distribute the covered information for each plan annually. Please see Table 3 for the estimated costs of disclosures.

Notice to PBMs and DOL

The exemption contained in paragraph (n) of the final rule provides relief from the restrictions of ERISA section 406(a)(1)(C) and (D) for plan fiduciaries who enter into a contract or arrangement where the PBM or other covered service provider fails to comply with its obligations under the regulation. Upon discovering that a PBM or other covered service provider failed to comply, the responsible plan fiduciary must request in writing that the PBM or other covered service provider furnish the information or comply with the audit requirement. As discussed earlier, the Department assumes that 0.3 percent of arrangements may experience an omission or error that will require the responsible plan fiduciary to send the request to the PBM or other covered service provider.28 This assumption is based on the Department’s experience that it is rare for pension plans to submit a notice under the requirement in 29 CFR 2550.408b-2. The Department also assumes that PBMs will rely on standardized templates and batch processing to prepare the notice. Therefore, the Department estimates that it will take 15 minutes of a benefit specialist’s time to prepare and send the notice.

If the PBM or other covered service provider does not respond within 90 calendar days, the responsible plan fiduciary must notify the Department and further must assess whether to terminate or continue the service contract or arrangement consistent with the duty of prudence under section 404 of ERISA, including documenting the basis for that determination. As discussed earlier, the Department assumes that approximately 10 notices will be submitted. Similar to other notices, the Department assumes that PBMs will rely on standardized templates and batch processing to prepare the notice. Therefore, the Department estimates that it will take 15 minutes of a benefit specialist’s time to document the basis for the determination, and 15 minutes of a benefit specialist’s time to prepare and send the notice. Please see Table 3 for the estimated costs of disclosures. 

TABLE 3. Annual Disclosure Costs


Number of Notices 
Number of Hours Per Notice
Total Hour Burden
Hourly Wage Rate
Cost Equivalent of Hour Burden

(A)
(B)
(C) = (A x B)
(D)
(E) = (C x D)
PBMs send disclosures to self-insured group health plans with 100 or more participants and beneficiaries
PBMs provide initial disclosures to self-insured group health plans
Legal professionals and benefit specialists prepare disclosures for self-insured group health plans 
43,701
0.50
21,851
$156.16
$3,412,174
PBMs provide missing/other information requested by self-insured group health plans
Benefit specialists prepare and send information to plans 
4,370
0.25
1,093
$124.74
$136,278
PBMs provide semiannual disclosures to self-insured group health plans
Benefit specialists prepare and send disclosures to plans 
262,204
0.25
65,551
$124.74
$8,176,832
PBM provides quarterly disclosures to plans 
Benefit specialists prepare and send disclosures to plans 
26,220
0.25
6,555
$124.74
$817,671
Self-insured group health plans with 100 or more participants and beneficiaries send notice to PBMs and DOL
Self-insured group health plans send request to PBMs to disclose missing/other information
Benefits specialists prepare and send request
131
0.25
33
$124.74
$4,085
Self-insured group health plans document the basis for determination on whether to terminate or continue the service contract or arrangement, after PBMs has not responded in 90 days
Benefit specialists document determination 
10
0.25
3
$124.74
$312
Self-insured group health plans send notice to DOL after the PBM has not responded within 90 days
Benefits specialists prepare and send notice, and document basis for determination
10
0.25
3
$124.74
$312
Total
336,636
-
95,087
-
$12,547,664 

    5. Audit Right Costs

A right to audit the veracity of any and all disclosures made by the PBM or other covered service provider to a responsible plan fiduciary under the regulation is an essential part of the final rule’s framework for establishing transparency in the marketplace for pharmacy benefit management services. This includes the responsibility of the PBM or other covered service provider to deliver all necessary information to conduct such an audit, subject to reasonable confidentiality agreements that prevent redisclosure of such information and limit its use to purposes related to the covered plan’s contract or arrangement. Though the final rule does not impose an obligation for responsible plan fiduciaries to conduct an audit, it does require that the PBM or other covered service provider allow, not less than once per year, for the self-insured group health plan to conduct an audit for accuracy of any disclosures made to comply with the regulation. 

Under the final rule, the cost of selecting an auditor and performing an audit of PBMs and other service providers is borne by the plan itself, while service providers are required to provide the necessary information to the self-insured group health plan or its auditor without conditions that would restrict the self-insured group health plan’s right to conduct the audit. The PBM or other covered service provider must confirm receipt of the audit request within 10 business days and must provide the information within a commercially reasonable period.

The Department estimates that only one-third of self-insured group health plans will annually submit a request to their PBM or other covered service provider for all information necessary to perform an audit. This assumption is based on PBM contracts being structured around a three-year master agreement and audits typically taking six to nine months to complete, making it challenging to conduct more than one audit in a given contract period.29 As one commenter stated, PBM contracts are usually set up as one-to-three-year agreements, with three years being the typical standard. These contracts often renew automatically unless one party provides an advance notice to end the agreement.

To estimate the burden associated with responding to an audit request, the Department assumes that PBMs already have access to all information and data available, but may require time to compile the records, data and other necessary information, including contracts with retail pharmacies and drug manufacturers, for each self-insured group health plan. As one commenter stated, PBMs already collect and analyze the data underlying these disclosures as part of their normal business operations to negotiate with manufacturers, establish pharmacy reimbursement rates, design formularies, and report to State regulators and CMS (for Medicare Part D). Additionally, because this disclosure will also include contracts with agents, affiliates and service providers such as retail pharmacies and drug manufacturers, the Department also assumes that PBM may require additional legal assistance to put in place confidentiality agreements to prevent sharing of the disclosed information.

Therefore, the Department assumes that PBMs will rely on standardized templates and batch processing to prepare the audit request. The Department estimates it will take 30 minutes for a benefit specialist at a TPA or issuer to prepare and send the audit request on behalf of self-insured group health plans with 100 or more participants and beneficiaries. The Department also assumes it will take two hours of a PBM’s benefit specialist and IT staff’s time to prepare and disclose information needed for each requested audit, at a composite wage rate of $151.41.30 This includes the time to retrieve documents, gather data and put in place any necessary confidentiality agreements. Please see Table 4 for calculations and burden. 

TABLE 4. Annual Audit Cost

 
Number of Requests
Number of Hours Per Requests
Total Hour Burden
Hourly Wage
Cost Equivalent of Hour Burden

(A)
(B)
(C) = (A x B)
(D)
(E) = (C x D)
Self-insured group health plans with 100 or more participants and beneficiaries send audit request
Benefit specialists prepare and send audit request 
43,701
0.5
21,851
$124.74
$2,725,631
PBMs prepare and disclose the needed info for the audit
Benefit specialists and IT staff prepare for requested audit
43,701
2
87,402
$151.41
$13,233,537
Total 
43,701

109,253
-
$15,959,168

    6. Summary of Hour Burden

Table 5 provides a summary of the hour burden. 

TABLE 5. Summary of Hour Burden

 
Hour Burden 
Cost Equivalent of Hour Burden
Cost Burden
IT Infrastructure (first year)
474,500
$80,300,000
$0 
IT Infrastructure (subsequent year)
94,900
$21,900,000
$0 
Disclosure (annual)
95,087
$12,547,664
$0
Audit (annual)
109,253
$15,959,168
$0
First Year Total
678,839
$108,806,832
$0
Subsequent Year Total 
299,239
$50,406,832
$0
Three-Year Average Total
425,773
$69,873,499
$0

TABLE 6. Estimated Annualized Respondent Cost and Hour Burden

Activity 


Number of Respondents
Number of Responses per Respondent
Total Responses
Average Burden (Hours) 
Total Burden (Hours) 
Hourly Wage Rate
Equivalent Cost of Hour Burden




























(1) IT Infrastructure Costs
(A) PBMs design, develop, and implement needed IT systems changes (first year)
Lawyers
73
1
73
160
11,680
$659.15
$7,698,872

Project Management Specialists
73
1
73
2,250
164,250
$126.72
$20,813,760

Business Operations Specialist
73
1
73
750
54,750
$120.40
$6,591,900

Software and Web Developers, Programmers, and Testers
73
1
73
3,500
255,500
$171.89
$43,917,895

(B) PBMs design, develop, and implement needed IT systems changes (subsequent year)
Lawyers
73
1
73
100
7,300
$659.15
$4,811,795

Project Management Specialists
73
1
73
500
36,500
$126.72
$4,625,280

Business Operations Specialist
73
1
73
50
3,650
$120.40
$439,460

Software and Web Developers, Programmers, and Testers
73
1
73
750
54,750
$171.89
$9,410,978

(2) Disclosures
(A) PBMs send disclosures to self-insured group health plans with 100 or more participants and beneficiaries
PBMs provide initial disclosures to self-insured group health plans
Legal professionals and benefit specialists prepare disclosures 
73
598.64
43,701
1
21,851
$156.16
$3,412,174

PBMs provide missing/other information requested by self-insured group health plans
Benefits specialists prepare information 
73
59.86
4,370
0.25
1,093
$124.74
$136,278

PBMs provide semiannual disclosures to self-insured group health plans
Benefit specialists prepare disclosures 
73
3,591.84
262,204
0.25
65,551
$124.74
$8,176,832

PBM provides quarterly disclosures to plans with 100 or more employees upon request
Benefit specialists prepare disclosures 
73
359.18
26,220
0.25
6,555
$124.74
$817,671

(B) Self-insured group health plans with 100 or more participants and beneficiaries sends notice to PBMs and DOL
Self-insured group health plans sends request to PBMs to disclose missing information
Benefits specialist prepares request 
953,420
0.00014
131
0.25
33
$124.74
$4,085

Self-insured group health plans document the basis for determination on whether to terminate or continue the service contract or arrangement, after PBMs has not responded in 90 days

Benefits specialists prepare and send request
10
1
10
0.25
3
$124.74
$312

Self-insured group health plans send notice to DOL after the PBM has not responded within 90 days
Benefits specialist prepares notice 
10
1
10
0.25
3
$124.74
$312

(3) Audit Costs
(A) Self-insured group health plans with 100 or more participants and beneficiaries send audit request
Benefit specialists prepare and send audit request
10
4,370.10
43,701
0.50
21,851
$124.74
$2,725,631

(B) PBMs prepare and disclose the needed info for the audit
Benefit specialists and IT staff prepare for requested audit
10
4,370.10
43,701
2
87,402
$151.41
$13,233,537

Total
131,175
-
424,111
-
425,773
-
$69,873,499

Note:
* The number of respondents is calculated in the following manner: 131,102 self-insured Group Health Plans with 100 to 999 employees + 73 PBMs = 131,175 respondents.
**The number of responses is calculated in the following manner: 73 PBMs updating and developing IT infrastructure + 336,636 disclosures + 43,701 audit request + 43,701 preparing and disclosing information needed for audits = 424,111 responses. 

    13. Provide an estimate of the total annual cost burden to respondents or record-keepers resulting from the collection of information. (Do not include the cost of any hour burden shown in Items 12.)
    • The cost estimate should be split into two components: (a) a total capital and start up cost component (annualized over its expected useful life); and (b) a total operation and maintenance and purchase of service component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major cost factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s), and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and record storage facilities.
    • If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate. In developing cost burden estimates, agencies may consult with a sample of respondents (fewer than 10), utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection, as appropriate.
    • Generally, estimates should not include purchases of equipment or services, or portions thereof, made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information or keep records for the government, or (4) as part of customary and usual business or private practices.

The final regulation does not preclude distribution through the use of electronic technology. Consequently, the Department has assumed that interactions between parties will be carried out electronically. As a result, the cost burden is $0 and all costs associated with distributing the disclosures have already been included in Question 12.

    14. Provide estimates of annualized cost to the Federal government. Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), and any other expense that would not have been incurred without this collection of information. Agencies also may aggregate cost estimates from Items 12, 13, and 14 in a single table.

	There are no costs to the Federal government associated with this information collection.

15. 	Explain the reasons for any program changes or adjustments.

The Department is issuing the final rule. 

    16. For collections of information whose results will be published, outline plans for tabulation, and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

There are no plans to publish the results of this collection of information.

17. 	If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

This information collection will display the expiration date.

18. 	Explain each exception to the topics of the certification statement identified in “Certification for Paperwork Reduction Act Submissions.”

There are no exceptions to the certification statement identified in Item 19. 

B.	COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL METHODS

There are no statistical methods used in this information collection.