Status check: PBM delinking under the 2026 appropriations law does not bite until 2028

The Consolidated Appropriations Act, 2026 (CAA 2026), signed by President Trump on February 3, 2026, restructures how pharmacy benefit managers (PBMs) are paid under Medicare Part D and how they operate in employer-sponsored plans governed by ERISA ^[2]. But most of its provisions do not take effect until plan years beginning on or after August 3, 2028, with some pieces starting January 1, 2029, for calendar-year plans ^[1][2]. That means the rebate-driven system that shaped this year's high-profile GLP-1 formulary moves, including CVS Caremark's exclusion of Zepbound and its later reversal, remains the operating framework through 2027 ^[2].

The law's core change is "delinking." In Medicare Part D, PBMs will be limited to collecting flat, fair-market-value "bona fide service fees" for actual services, and these fees cannot be tied to a drug's price or to how much of it gets prescribed ^[1][2]. Right now, PBM revenue is often connected, directly or indirectly, to list prices or the size of rebates a manufacturer offers, which critics say has encouraged favoring higher-priced drugs when the rebate is large enough ^[1]. Under CAA 2026, PBMs must also pass through 100% of manufacturer rebates and price concessions, and ERISA-governed employer plans face the same full pass-through requirement, along with new transparency mandates, even though the law does not explicitly delink employer-plan service fees from drug prices the way it does for Part D ^[1][2].

Alongside the compensation changes, PBMs will owe far more disclosure. They must give large ERISA, tax-code, and Public Health Service Act plans reports every three to six months listing claims, compensation paid to plans and pharmacies, formulary tier placement rationale for drugs costing more than $10,000 in gross spending, and use of tools like prior authorization or step therapy ^[1]. Plans also gain expanded annual audit rights, including the ability to hire their own auditor to review PBM contracts and pricing data ^[1]. The Centers for Medicare & Medicaid Services also received close to $190 million in new funding to enforce the law, including authority to arbitrate PBM-pharmacy disputes and audit fee structures ^[2].

Industry groups note that PBMs already pass through an estimated 99.6% of rebates to Part D plans and more than 90% to employers on a voluntary basis, though disclosure practices vary by PBM and by contract ^[2]. Some analysts caution that as rebate revenue shrinks under the new rules, PBMs may respond by tightening formularies and intensifying prior authorization and step therapy requirements to control net drug spending, even as they potentially favor generics and biosimilars where the cost advantage is clear ^[1].

Why it matters for patients

For people currently taking or considering semaglutide (Ozempic, Wegovy, Rybelsus) or tirzepatide (Mounjaro, Zepbound), this law does not change coverage decisions being made today or in the near term. The rebate arrangements that can make one GLP-1 drug preferred on a formulary over another, the same dynamic behind this year's Caremark exclusion and reversal, continue unchanged through 2027 ^[2]. Patients navigating prior authorization, step therapy, or a sudden formulary switch should not expect this law to alter those processes before 2028 at the earliest ^[1][2].

Once delinking and full rebate pass-through take effect, some analysts expect formularies to shift toward net cost and clinical value rather than rebate size, which could affect which GLP-1 products are preferred ^[1]. But the same analysis warns this could also mean stricter utilization management as PBMs look for other ways to control spending ^[1]. It is not yet known exactly how coverage of GLP-1 drugs specifically will look once the law is fully in force.

What happens next

Most CAA 2026 provisions become effective for plan years starting on or after August 3, 2028, with certain requirements phasing in by January 1, 2029, for calendar-year plans ^[1][2]. Before then, the Department of Labor and CMS are drafting implementing rules that will determine how delinking, pass-through, and reporting requirements actually apply in practice, and those rules are not yet final ^[2].