Codify — Article

HB2450 requires PBMs to deliver detailed drug-spend reports to group health plans

Mandates semiannual, machine-readable disclosure from pharmacy benefit managers to plans and participant-facing summaries, with civil penalties and HIPAA-aligned privacy limits.

The Brief

HB2450, the Prescription Drug Transparency and Affordability Act, directs Congress’s health, labor, and tax regimes to force pharmacy benefit managers (PBMs) and related entities to provide detailed, machine-readable billing and rebate information to group health plans and, on request, to participants. The bill creates parallel obligations in the Public Health Service Act, ERISA, and the Internal Revenue Code so insured and self-funded employer plans receive near–claims-level data on drugs, dispensing channels, rebates, fees, and net spending.

The measure matters because it shifts the informational advantage away from PBMs and rebate-aggregating intermediaries toward plan sponsors, fiduciaries, regulators and enrollees. It requires standard formats, sets privacy guardrails tied to HIPAA, allows large-plan opt-in for expanded reporting, and attaches stiff daily and per-item civil penalties to noncompliance — changing how benefits teams, PBMs, pharmacies, and drug makers will manage contracting and data flows.

At a Glance

What It Does

The bill requires entities that provide pharmacy benefit management services to submit semiannual (or quarterly at a plan’s request) machine-readable reports to group health plans and insurers, covering claims counts, contracted compensation, rebates and fees, out-of-pocket patient spending, net prices, therapeutic-class aggregates, formulary placements, and affiliated-pharmacy pricing. It imposes matching provisions in ERISA and the Internal Revenue Code so both insured and self-funded plans are covered.

Who It Affects

PBMs and any affiliated group purchasing organizations, insurers and third‑party administrators, self-funded employer plan sponsors and health insurance issuers, pharmacies that are affiliated with PBMs, and drug manufacturers whose copay assistance and rebate flows will be disclosed in aggregate form. Benefit fiduciaries, compliance officers, and participant services teams will also be directly affected.

Why It Matters

By converting previously proprietary rebate, fee, and dispensing‑channel information into standardized, auditable data for plans and regulators, the bill enables new contract scrutiny, comparators for network and formulary decisions, and participant-level transparency. That increases compliance and reporting costs but also creates negotiating leverage for plan sponsors and oversight capacity for federal agencies.

More articles like this one.

A weekly email with all the latest developments on this topic.

Unsubscribe anytime.

What This Bill Actually Does

HB2450 creates a cross‑statutory reporting regime that forces PBMs and their business partners to give group health plans the data needed to see how much is being paid, where savings are retained, and how benefit design steers utilization. For plan years beginning 30 months after enactment, any contract entered into or renewed on or after that effective date must include terms that prevent third parties from blocking the flow of reporting data to plans.

The core requirement is a semiannual report — quarterly if a plan requests it — delivered in plain language and a machine‑readable format.

The reports are detailed. For each drug (identified by National Drug Code) the PBM must show contracted compensation from the plan to the PBM and to dispensing pharmacies, the difference between those amounts, dispensing channel (retail, mail, specialty), brand/generic status, acquisition costs (WAC for brands, AWP for generics as specified), counts of claims, dosage units and days’ supply, net price to the plan after rebates and fees, total plan net spending, participant out‑of‑pocket totals, and the amounts the PBM expects to receive tied to that drug or utilization.

Reports must also include therapeutic‑class level aggregates (gross/net spending, average net costs per 30/90‑day supply, formulary tiers and utilization management) and a top‑50 drugs analysis when spending thresholds are met. If a PBM operates or affiliates with pharmacies, the PBM must disclose affiliated‑pharmacy pricing, medians and interquartile ranges compared with other network pharmacies, percentage of fills, and benefit‑design incentives that drive use of affiliated channels.Plans must make an aggregate summary document available to participants and provide claims‑level information on request for the enrollee’s own fills.

The bill ties privacy protections to HIPAA rules, limits report distribution to plan business associates, and directs the Secretary to issue a standard filing format and additional regulations within 18 months. Enforcement is centralized: HHS (and the agencies that oversee ERISA and tax law via parallel provisions) can impose civil monetary penalties — $10,000 per day for failures to disclose and up to $100,000 per knowingly false data item — with limited waiver authority for good‑faith efforts.

The Secretary also may define a limited report form for plans sponsored by supply‑chain participants (manufacturers, wholesalers) to reduce the risk of anti‑competitive disclosures.

The Five Things You Need to Know

1

Effective date: reporting obligations apply to plan years beginning 30 months after enactment and to contracts entered into or renewed on or after that effective date.

2

Reporting frequency and format: PBMs must produce machine‑readable reports at least every 6 months, or quarterly if the plan requests and pays the same conditions/costs as the semiannual report.

3

Data scope: reports require claims‑level fields (NDC, contracted compensation to PBM and to pharmacy, dispensing channel, WAC/AWP per dosage unit, counts of claims/dosage units/days supply, participant out‑of‑pocket totals, rebates/fees to plans and to PBMs, net price per treatment), plus therapeutic‑class aggregates and a top‑50 drugs analysis when thresholds apply.

4

Penalties: failure to disclose triggers a civil penalty of $10,000 per day; knowingly providing false information carries fines of up to $100,000 per false item; the Secretary may waive penalties for good‑faith efforts.

5

Agency deadlines and carveouts: the Secretary must issue a standard reporting format and other implementing regulations within 18 months, and may define a limited reporting form for plans sponsored by manufacturers, wholesalers, or other direct supply‑chain participants to prevent anti‑competitive harm.

Section-by-Section Breakdown

Every bill we cover gets an analysis of its key sections. Expand all ↓

Section 2799A–11 (Public Health Service Act)

Mandatory PBM reporting to group health plans and participant summaries

This provision establishes the central reporting duty for PBMs that serve group health plans or health insurance issuers. It spells out the reporting cadence (semiannual baseline; quarterly at plan request), the machine‑readable, plain‑language requirement, and the exhaustive list of data fields PBMs must provide — from NDC and contracted compensation to dispensing channel breakdowns and affiliate pharmacy pricing comparisons. Practically, plans will receive both near‑claims‑level data for analysis and an aggregate summary intended for participant consumption. The section also creates the opt‑in path for specified large employer plans to require the full set of data from insurers serving their workforces.

Section 726 (ERISA amendment)

Parallel obligations for self‑funded plans and fiduciary access

ERISA receives a mirror requirement so self‑insured employer plans — which escape some PHSA reporting regimes — are explicitly covered. The ERISA text ties the reporting duty to plan administrator obligations and adds explicit access and disclosure limits consistent with HIPAA. Because ERISA governs fiduciary conduct, this text creates a compliance touchpoint for plan sponsors and fiduciaries: failure to secure required disclosures from PBMs may expose plan administrators to regulatory enforcement and to the statutory civil penalties incorporated in the bill.

Section 9826 (Internal Revenue Code)

Tax code alignment for plan‑level reporting and applicability to plan‑related entities

The Internal Revenue Code amendment brings the same PBM reporting rules into the federal tax context, which ensures tax‑qualified plans are within scope and allows the Treasury to treat certain PBM obligations as plan‑related tax compliance requirements. It also contains an exception cross‑reference so the existing rules that exempt some plans from other reporting do not create an avoidance path for these PBM disclosures.

2 more sections
Enforcement provisions (PHSA, ERISA, IRC)

Civil monetary penalties, false‑information fines, and waiver authority

All three statutes incorporate enforcement mechanics: a $10,000 per‑day penalty for continuing failures to produce required reports or to provide participant requested claim information, and a separate up‑to‑$100,000 penalty per item for knowingly false disclosures. The text channels administrative procedures akin to Social Security Act penalty processes for collection and adjudication and preserves agency waiver authority where entities show good‑faith compliance efforts. Importantly, the bill also asserts a clear rule of construction that federal agencies retain access to reports regardless of any private contract language attempting to limit that access.

Privacy, format, and regulatory implementation

HIPAA‑aligned privacy limits, standard machine‑readable format, and limited‑report carveouts

The Secretary must issue an 18‑month rulemaking that defines a standard, machine‑readable format and other implementing regs; until then, reports must still be plain language and machine‑readable. Privacy safeguards require reports to conform to HIPAA privacy regulations and to be limited to summary health information except where claim‑level data are lawfully requested by a participant for their own claims. The Secretary can also prescribe a limited report form for plans sponsored or affiliated with drug manufacturers, wholesalers, or other direct supply‑chain actors to reduce anti‑competitive disclosure risks.

At scale

This bill is one of many.

Codify tracks hundreds of bills on Healthcare across all five countries.

Explore Healthcare in Codify Search →

Who Benefits and Who Bears the Cost

Every bill creates winners and losers. Here's who stands to gain and who bears the cost.

Who Benefits

  • Large employers and plan sponsors — Gain access to detailed rebate, fee, and net‑price data that can be used to audit PBM contracts, renegotiate terms, redesign formularies, and demonstrate fiduciary diligence.
  • Participants and beneficiaries — Receive an aggregate summary and the right to request claims‑level information about their own prescriptions, improving price transparency and enabling better out‑of‑pocket planning.
  • Federal regulators and oversight offices (HHS, DOL, Treasury) — Obtain mandated data flows and explicit statutory access to reports, enhancing capacity to investigate pricing practices, conflicts of interest, and possible anti‑competitive behavior.

Who Bears the Cost

  • Pharmacy benefit managers and affiliated intermediaries — Face substantial new reporting costs, data‑management investments, and disclosure of commercially sensitive compensation streams; they also bear exposure to daily fines for noncompliance.
  • Health insurance issuers, third‑party administrators, and plan administrators — Must update contracting, data‑sharing provisions, and privacy safeguards; self‑insured sponsors will need to ingest and analyze high‑volume datasets and potentially pay for more frequent reporting at a plan’s request.
  • Federal agencies and enforcement units — HHS, DOL, and Treasury must build or expand analytics, audit, and compliance teams to process reports, pursue enforcement actions, and issue the 18‑month implementing regulations required by the statute.

Key Issues

The Core Tension

The bill balances two legitimate objectives — giving plan sponsors and enrollees the information needed to control drug spending and protecting patient privacy and commercially sensitive contracting data — but those objectives pull in opposite directions: meaningful transparency requires disclosure of rebate and net‑price mechanics that PBMs and manufacturers consider proprietary, while keeping those mechanics confidential preserves competitive posture and negotiated discounts. Choosing how far to push disclosure is a trade‑off between enforceable oversight and the risk of undermining negotiated pricing structures or creating new privacy and competition problems.

The bill forces a large transfer of previously proprietary PBM data to plans and agencies, but it leaves important operational questions unresolved. ‘Remuneration’ and ‘contracted compensation’ are delegated to future rulemaking and a five‑year reevaluation; how those definitions are written will materially affect what PBMs must disclose (for example, treatment of administrative fees, spread pricing components, or manufacturer assistance flows). The requirement that reports be both ‘plain language’ and machine‑readable creates potential tension: file formats that satisfy analytics teams (normalized NDC, standardized numeric fields) may not read as plain language to participants, so plan sponsors will need to operate dual outputs and education materials.

Privacy and competitive harm are other fault lines. The bill relies on HIPAA and summary‑information limits, but it also mandates granular commercial data (e.g., PBM rebates and affiliated‑pharmacy net acquisition costs).

That combination may invite litigation over whether certain commercial pricing data are “protected health information” or otherwise confidential, and the statute’s carveout allowing a limited report form for plans sponsored by supply‑chain participants acknowledges but does not resolve the risk that full disclosure could be used by rival manufacturers or wholesalers to compete or collude. Finally, enforcement depends on federal agencies issuing an 18‑month standard and then actually resourcing monitoring and penalties; a delayed rulemaking or under‑resourced enforcement could leave plans with paper rights but little practical remedy.

Try it yourself.

Ask a question in plain English, or pick a topic below. Results in seconds.