Compliance, General

Compliance Monthly Update: February 2026

by GBS Benefits
March 10, 2026
10:30 am

Compliance Monthly Update
February 2026

A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.

Federal Compliance Update

HHS issues 2027 adjusted ACA annual limitations on cost-sharing.

On January 29, HHS issued a memo announcing the maximum annual limitations on cost-sharing for the 2027 benefit year for non-grandfathered group health plans under the ACA. The maximum annual limit on cost-sharing for 2027 will increase to $12,000 for self-only coverage and $24,000 for other than self-only coverage (the 2026 limits are $10,600 and $21,200, respectively). In general, cost-sharing includes deductibles, coinsurance, copayments, and any other required expenditure that is a qualified medical expense with respect to essential health benefits covered under the plan.

DOL issues proposed PBM disclosure rules for self-funded ERISA plans.

On January 30, the DOL issued proposed regulations (along with an associated news release and fact sheet) that would require providers of PBM services (and affiliated brokers and consultants) to disclose information about their direct and indirect compensation to fiduciaries of self-insured ERISA group health plans. If finalized, the disclosure requirements would apply to plan years beginning on or after July 1, 2026. These proposed regulations follow a 2025 Executive Order that directed the DOL to issue regulations with a goal towards reducing prescription drug pricing through fee transparency for group health plans. This proposed rule is issued under ERISA’s statutory prohibited transaction rules, which require plan fiduciaries to request and review fee information from covered service providers to demonstrate the reasonableness of the arrangement. Here are the highlights of the proposed rule:

Plans the proposed rule applies to. The proposed rule only extend the required disclosures to self-insured ERISA group health plans (including level-funded plans). Fully insured group health plans are specifically excluded—those plans, along with non-ERISA government and church plans, will need to rely upon any state-required PBM disclosures in their state of situs.
Covered service providers (who must disclose). The proposed rule applies to covered service providers (e.g., a PBM, affiliate, agent, or subcontractor) that expect to receive $1,000 or more in direct or indirect compensation for PBM services. If the required disclosures are not provided, then the compensation for PBM services would not be considered reasonable under the ERISA prohibited transaction rules. PBM services is broadly defined and includes (among other things): acting as a negotiator or aggregator of rebates, discounts, and other price concessions; establishing or maintaining prescription drug formularies; establishing or maintaining pharmacy networks; performing utilization review; adjudicating appeals and grievances; recordkeeping; and regulatory compliance activities.
Required disclosures. Disclosures by covered service providers to self-insured ERISA plans would include initial and semiannual disclosures. The initial disclosure would be required before entering into, extending, or renewing a contract or agreement for PBM services. Once the agreement is in place, follow-up disclosures would be required every six months, generally covering the same information as the initial disclosure, the actual compensation received, and an explanation where the actual compensation materially exceeds the corresponding initial compensation disclosure estimate. Covered service providers would also be required to provide plan fiduciaries (upon written request) with any information needed for ERISA plan reporting or disclosure. Categories of information subject to disclosure would include (among other things):
- A description of each PBM service. This includes any advice, recommendations, or referrals on PBM services provided to the plan.
- Direct compensation payable by the plan sponsor, such as administrative fees.
- Other compensation the service provider expects to receive including identification of the payer.
- A description of payments from drug manufactures (i.e., rebates), including whether the amounts were retained by the PBM or passed through to the plan or plan sponsor.
- Spread compensation received (i.e., the difference between what the plan pays for a drug and what the pharmacy is reimbursed for that drug).
- A description of any inflation or price protection agreements the PBM has with a drug manufacturer or other party connected to the dispensation of drugs under the arrangement.
- A description of any formulary placement incentives and arrangements that the PBM has with any drug manufacturer.
- Drug pricing methodology (i.e., a description of the net cost to the plan for each drug on the formulary, for each pharmacy channel, expressed as a monetary amount).
- A statement that the PBM is providing services as a fiduciary, if applicable, as well as any activity or policy that may create a conflict of interest.
- A statement that the plan has a right to conduct an audit and the procedures for requesting an audit.
Audit rights. The proposed rule provides audit rights to self-insured ERISA plans, permitting the plan to audit the service provider for accuracy of the disclosure. The plan fiduciary can select their own auditor but must pay the cost of the auditor. The service provider is responsible for the cost of providing the information requested for the audit and must provide the auditor any information that is owned or held by an affiliate, agent, or subcontractor of the service provider.
Plan sponsor considerations. Self-insured ERISA plans should review their internal process for selecting plan service providers, ensure they discuss the new disclosure obligations in their contract/renewal negotiations with their PBM, and be ready to digest the disclosed information and engage in a prudent process of selecting and monitoring their PBM.

Separately, on February 3, Congress enacted additional PBM legislation establishing detailed disclosure requirements for contracts between group health plans (including both self-insured and fully insured plans) or insurers and PBMs, for plan years beginning on or after August 3, 2028. This new legislation is discussed below.

PBM transparency provisions included in CAA 2026.

On February 3, Congress enacted the Consolidated Appropriations Act 2026 (CAA 2026), which includes provisions requiring PBMs and TPAs to provide compensation disclosures to group health plans. Unlike the proposed DOL regulations discussed above that apply only to self-funded ERISA plans, the provisions under CAA 2026 apply to both fully insured and self-funded plans. More specifically, the disclosure obligations will apply to all group health plans, while the rebate pass-through requirement applies only to ERISA plans. Here are the major provisions of CAA 2026 (that will apply for plan years beginning on or after August 3, 2028):

Disclosure obligations related to PBM services. CAA 2026 will require all contracts between group health plans (both self-insured and fully insured plans, and both ERISA and non-ERISA plans) and applicable entities to include specific disclosure provisions on drug costs and compensation. Applicable entities (which is broadly defined to include affiliates of group health plans, insurers, and PBMs) must disclose all direct and indirect compensation, which includes drug-level disclosures about top-spending drugs, costs, rebates, fees, discounts, pharmacy reimbursements, benefit design, broker and consultant payments, and affiliate relationships. PBMs must provide the required disclosures on a semiannual basis (or quarterly, if required). PBMs are required to provide summary disclosures to all group health plans. Then more detailed information must be provided to certain employers and plans—large (100+ employees) self-insured plans automatically received the more detailed information, and large insured plans can opt-in to the additional reporting. Plans are also entitled to explanations linking formulary decisions to rebates and discounts.
Participant disclosure. As mentioned above, PBMs will provide summary reports that are meant to be disclosed by the group health plan to participants. Group health plans must provide the disclosure to plan participants each plan year—this can be done through the SPD or through individual disclosure. Future guidance will provide further detail.
Rebate pass-through mandate. For ERISA plans, CAA 2026 requires PBMs to pass-through 100% of prescription drug rebates, fees, alternative discounts, and other remuneration from any applicable entity related to the utilization or drug spend, to all group health plans. These provisions also provide plans audit rights. Future regulations will be issued detailing the timing and manner of the audit.
Plan sponsor considerations. With this transparency will come a heightened level of obligation on plan sponsors and plan fiduciaries—who are required to engage in a thoughtful, prudent process when selecting and monitoring a plan service provider and determining whether the fees are reasonable. And with these new disclosures in hand, fiduciaries will be expected to compare PBM services and fees to their competitors and choose the best PBM for the plan at a reasonable cost.

FTC PBM settlement agreement with Express Scripts.

On February 4, the Federal Trade Commission (FTC) announced a settlement with the PBM Express Scripts. As background, the FTC brought a lawsuit against Express Scripts (and other PBMs) in 2024 alleging that Express Scripts artificially inflated the list price of insulin drugs by using anticompetitive and unfair rebating practices, and impaired patients’ access to lower list price products, ultimately shifting the cost of high insulin list prices to vulnerable patients. More specifically, they alleged Express Scripts engaged in unfair methods of competition by favoring high-list-price drugs, extracting opaque rebates, inflating patient cost sharing, and using spread pricing and affiliate arrangements. The binding settlement changes go beyond transparency and could restructure PBM economics and their business model. The FTC’s approach in this settlement removes incentives to profit from higher cost drugs to push Express Scripts (and potentially other PBMs) toward a fee-for-service model. This settlement applies only to Express Scripts, but it could be a template for future settlements in the FTC’s ongoing case against the other PBMs (especially in light of the new PBM proposed rule and legislation discussed above). If this does lead towards a fee-for service model for PBMs, administrative fees may increase, but total drug spend for group health plans could decrease due to the structure of the settlement. The settlement imposes the following changes on Express Scripts, which generally apply to all drugs managed by Express Scripts (not just insulin):

Nondiscrimination for lower-price drugs. Express Scripts may not structure formularies to favor higher-list-price drugs when lower-price equivalents are available.
Out-of-pocket costs tied to net cost. Member cost sharing may not exceed the drug’s net unit cost.
Manufacturer compensation restrictions. Manufacturer payments may not be based, directly or indirectly, on list price or related benchmarks.
Rebate restructuring. Point-of-sale rebates must be made available to members, and rebate guarantees to plan sponsors are prohibited.
Elimination of spread pricing. Express Scripts may not retain the difference between what it charges plans and pays pharmacies.
Expanded transparency. Automated reporting with claim-level detail, data sufficient to meet federal transparency laws, and full disclosure of broker and consultant compensation is required.

New USPS postmark rule change impacts plan participant notices and disclosures.

The USPS has released a final rule titled “Postmarks and Postal Possession” that clarifies the date on an official USPS postmark reflects the moment the piece of mail is first possessed by an automated USPS sorting facility, not the moment the piece of mail was dropped off or received by the USPS.

Prior to the change, the date an individual provided a piece of mail to the USPS, whether through a USPS collection box receptacle (blue box) or via a USPS mail carrier or clerk, was the date it was processed and postmarked by the USPS.
In the final rule, the USPS provided notification of changes to their systems where the USPS will drastically reduce the number of processing centers across the US. This means that the closest processing center may be in the closest major city or even another state that may lead to a days-long lag between the date mail is given to the USPS and the date the mail receives a postmark.
Group benefit plans are required to provide various notices and disclosures to plan participants (e.g., SPDs, annual notices, and COBRA notices) within certain timeframes. While electronic disclosure is common, disclosure by mail is also used (in particular for COBRA notices). Under the mailbox rule, the date of an item’s postmark is deemed its delivery date.
Now, when a group health plan sends disclosures by mail, they can no longer assume the date of mailing is the same date as the postmark (as there may be a delay under this new postmark rule between when the disclosure is mailed and when it is received and postmarked by the closest processing center). That is, if the postmark date is after a statutory deadline, regulators may treat a notice or disclosure as late, even if the item was mailed or dropped off with the USPS before the deadline.
Practical considerations. In practice, for example, a COBRA administrator may postmark notices provided on behalf of their client’s plans with metering machines that provide the postmark without it being re-processed through the USPS. For employers that hire a TPA to administer a notice requirement, they should ensure that the plan timely notifies the vendor of the event to enable them to meet the disclosure deadline. However, smaller vendors might not utilize metering machines, and in that event, it becomes critical that an employer build in a process to notify TPAs immediately of an event to enable the TPA to proceed with the timely notification. When a plan sponsor is themself mailing certain notices, they may consider obtaining a postmark at their USPS drop-off location (that can be obtained at the clerk desk). Otherwise, the plan sponsor should plan on mailing notices a few days in advance of the deadline to ensure a postmark before the deadline.

Launch of TrumpRx announced.

On February 5, the White House issued a fact sheet announcing the launch of TrumpRx. Through this direct-to-consumer (DTC) drug purchasing platform, individuals will be able to access discounts on certain medicines in the country, paying prices in line with the lowest paid by other developed nations (known as the most-favored-nation, or MFN, price). The discounts currently advertised on the webpage are only available to those purchasing medications without using insurance. It also explicitly states that the discounted pricing is only available for “cash-paying” patients. The webpage for each TrumpRx drug notes that patients with insurance should check what their copay would be if using insurance, as it may be lower than the TrumpRx price.

Updated model CHIP Notice released.

The DOL has released a new model employer CHIP Notice (available HERE) with information current as of January 31, 2026 and expiration date of March 31, 2026. As a reminder, group health plans that maintain a plan with participants who reside in a state that provides premium assistance under Medicaid or CHIP have an annual notice requirement to notify employees of the potential opportunities for premium assistance. The model CHIP notice is updated periodically to reflect changes in the states that offer premium assistance and changes to the relevant state contact information. If the model notice is not updated before March 31, 2026 plans may continue to use this most recent version until an update is provided.

HHS 2027 Notice of Benefit and Payment Parameters proposed rule issued.

On February 11, HHS released the Notice of Benefit and Payment Parameters for the 2027 plan year proposed rule (and an associated fact sheet). This is an annual rule implementing (among other things) guidance for insurers offering individual Exchange plans and changes to essential health benefits (EHBs). Here are some highlights of the proposed rule:

HHS proposes to prohibit issuers from including routine non-pediatric dental services as EHBs. Routine non-pediatric dental services include cleanings, diagnostic X-rays, and restorative services like fillings and root canals. If finalized, this would be a reversal of the policy finalized in the 2025 Notice of Benefit and Payment Parameters which removed the prohibition on including routine non-pediatric dental services as EHBs for plan years beginning on or after January 1, 2027.
HHS proposes that beginning with plan year 2027, a state-required benefit would be considered “in addition to EHB” if it is: (a) required by a state action taking place after December 31, 2011; (b) applicable to the small group and individual markets; (c) specific to required care, treatment or services; and (d) not required by state action for purposes of compliance with federal requirements. If finalized, states that have added such “in addition to EHB” benefits would have to defray their cost by making payments to individual enrollees or to the insurer on behalf of enrollees. Also, these “in addition to EHB” benefits would no longer be subject to the requirements applicable to EHBs—including the prohibition on discrimination, the annual limitation on cost-sharing, and the prohibition on annual or lifetime dollar limits. If finalized, this would be a reversal of policy finalized in the 2025 Notice of Benefit and Payment Parameters where HHS had stated that covered benefits in a State’s EHB-benchmark plan are EHBs and do not require defrayal by the State.
HHS proposes to allow issuers to offer catastrophic plans with terms of either one year or multiple consecutive years up to 10 years.
HHS proposes to revise cost-sharing parameters for bronze and catastrophic plans and increase the maximum out-of-pocket limit for catastrophic plans by 30%.
HHS proposes to implement several eligibility changes to codify changes brought about through the OBBB (2025) and to increase verification requirements for certain consumers seeking premium tax credits.

Updated model Notice of Privacy Practices released.

On February 13, HHS updated its model HIPAA Notice of Privacy Practices (NPP) that is available HERE. As a reminder, the NPP must be updated to add provisions on the confidentiality of medical records relating to individuals with substance use disorders (SUD), effective February 16, 2026. And this updated model NPP incorporates language related to these new SUD protections. If, prior to issuance of this model notice, a group health plan updated its sample annual notice packet (that includes the NPP) with the required language related to these SUD protections, no additional action is required. But if a group health plan has not yet updated their NPP with the SUD provision language, you may use the updated model notice. There are two mentions of SUD treatment records in the new model notice, though they mention the same provision—that the records cannot be shared for investigations or legal proceedings against the individual without the individual’s written consent, a court order, or a subpoena. It is important to remember that when adopting a new NPP, or materially revising an existing one, plan sponsors must disclose the revised notice to employees within 60 days of the adoption or material change. So, a plan sponsor that updated their NPP on February 16 should disclose that updated NPP by April 14, 2026.

DOL issues FLSA independent contractor proposed rule.

On February 27, the DOL published a proposed rule that, if finalized, would rescind its 2024 final rule on FLSA worker classification and largely readopt the 2021 rule’s “economic reality” framework (with some modifications). Note that most employee benefit plan rules determine employee status (and who is an eligible employee) under ERISA or the IRC (not the FLSA) in conjunction with the common-law standard. The FLSA standard, on the other hand, governs minimum wage and overtime requirements that apply to employees but not independent contractors. In other words, the definition of an employee under ERISA/IRC is different than and does not line up with the definition of an employee for purposes of the FLSA. For group health plan purposes, a common-law employee is distinguished from a worker who is an independent contractor or an employee of another entity. The test for common-law employee status generally focuses on the right to control the manner and means by which the work product is accomplished and considers the facts and circumstances of the particular situation under a multi-factor test in which no single factor is determinative. It is important to properly classify workers under the appropriate set of rules—particularly for purposes of the ERISA/IRC rules regarding group health plans, cafeteria plans, employer shared responsibility penalties, and to avoid inadvertently creating a MEWA.

State/Local Compliance Update

A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.

Maine

Maine’s PFML benefits begin May 1.

Maine’s paid family and medical leave (PFML) program will begin paying benefits on May 1, 2026. Employers with at least one employee in Maine began making contributions to the PFML fund in January 2025 through employee payroll deductions and employer contributions. On January 20, 2026, Maine announced that the fund was sufficiently solvent and confirmed that benefit distributions will begin on May 1, 2026.

New York

FAQs issued for NYC ESSTA.

On February 22, New York City (NYC) published updated FAQs that provide additional information regarding recent amendments to the NYC Earned Safe and Sick Time Act (ESSTA). NYC also published form notices in light of the amended ESSTA.
- As background, last October, NYC enacted legislation that amended the ESSTA. The key provisions of the amendments (that went into effect on February 22, 2026) include: (a) expanded leave provisions where covered NYC employers must provide employees with an additional 32 hours of unpaid safe and sick time, frontloaded at hire; (b) new permissible uses for safe and sick time, including care for a minor child, attending legal proceedings for subsistence or housing benefits, public disasters, and incidents of workplace violence; and (c) formally codifying prenatal leave requirement where employers must also provide 20 hours of paid prenatal leave per 52-week period, which is concurrent with New York State law.
- The FAQs clarify that:
  - When new employees begin work, the employer must give them 32 immediately available hours of unpaid protected time off followed by another separate leave bank on the first day of the calendar year, as determined by the employer. Employers cannot provide a prorated amount of immediately available hours when an employee is hired partway through a calendar year.
  - If an employer provides an additional 32 hours of paid time off benefits over and above what is required of the employer by the ESSTA, and makes those 32 hours immediately available for use, the employer does not need to create a separate leave bank for the unpaid 32 hours required by the ESSTA amendment.
  - Employers must ensure that pay statements include both the amount of paid and unpaid protected time off used during the pay period and the amount of immediately available hours of unpaid protected time off available for use in the calendar year.
- NYC also published updated versions of the Notice of Employee Rights and the Workers’ Bill of Rights, which employers must distribute to their employees and post in the workplace by March 8, 2026. These updated notices include new information related to the ESSTA amendments.
- NYC also published Rules for Protected Time Off Policies. Employers are required to have a written paid time off policy—and paid prenatal leave policies and sick policies are required to be included in that single document. The policy rules outline information that must be included in an employer’s policy, including, but limited to, an explanation of accrual, front-loading, carryover calculations, and policies and procedures for using protected time off and paid prenatal leave. Employers may want to update their policies and distribute them to employees by March 8, 2026.

Washington

Preventive services bill passed by the Washington legislature.

On February 26, HB 2242 passed the Washington Senate. If signed by Governor Ferguson (which is expected), the new legislation is intended to maintain access to certain preventive services without cost-sharing for Washington fully insured plans.
- As background—currently, preventive services (that are required by the ACA to be covered with no cost-sharing) are based on recommendations from the federal Advisory Committee on Immunization Practices (ACIP), the U.S. Preventive Health Services Task Force (USPSTF), and the Health Resources and Services Administration (HRSA). As we discussed in our September federal compliance update, the federal government recently updated the ACIP guidelines:
  - To change the COVID vaccine recommendation so that adults 65+ get a COVID vaccine based on shared clinical decision making. And for individuals aged 6 months to 64 years old, a vaccine is recommended based on shared clinical decision making, with an added emphasis on providing risk-benefit information. ACIP also voted that individuals that decide to get the vaccine can do so without a prescription.
  - ACIP voted that instead of recommending the MMRV vaccine (which is a combined shot covering measles, mumps, rubella and varicella (chickenpox)) for children under four, they are now recommending MMR by itself, and a varicella/chickenpox shot by itself. ACIP voted to continue covering the combined MMRV vaccine at 100% for children ages four and older if parents prefer.
- HB 2242 changes state law to tie the coverage of vaccines to recommendations from the Washington state Department of Health (instead of ACIP recommendations). The bill sets the coverage standards for other preventive services based on recommendations from the USPSTF and HRSA, effective on June 30, 2025.