The Government Just Asked PBMs to Define Their Own Accountability Rules

On June 18, the Centers for Medicare & Medicaid Services published a four-page document in the Federal Register asking pharmacy benefit managers to explain themselves. It is called a Request for Information. Federal agencies use RFIs as standard pre-rulemaking tools — the comment period is open to anyone, patients and academics included — but the specific questions CMS is still asking in 2026 are the story.

Federal Register document 2026-12344 is a response to Section 6224 of the Consolidated Appropriations Act, 2026. That provision mandates two things, effective 2028: restrictions on what PBMs and their affiliates can be paid for Medicare Part D services, and new annual data-reporting requirements. CMS has two years to write the rules. The RFI is how it starts building a regulatory record.

Seventeen questions across four pages. Among them: What is a PBM? What is an affiliate? What is a bona fide service fee? What counts as fair market value for a PBM's services?

These are not rhetorical questions. The agency cannot write a compensation restriction until it can define the entity being restricted.

---

Three companies — OptumRx (UnitedHealth Group), Express Scripts (Cigna), and CVS Caremark (CVS Health, which also owns Aetna) — managed approximately 79% of U.S. prescription drug claims as of 2023, covering roughly 270 million people. That figure comes from a KFF analysis published in February 2026, drawing on market data compiled over prior years.

These three entities sit between every drug manufacturer and every pharmacy counter. They negotiate manufacturer rebates, set formularies that determine coverage tiers, reimburse pharmacies, and collect administrative fees from multiple directions. They own the mail-order and specialty pharmacies their own formularies steer patients toward. CVS Caremark's parent owns one of the largest retail pharmacy chains in the country.

PBM trade groups would argue this integration creates efficiency — consolidated data, streamlined logistics, lower administrative overhead. That argument deserves consideration. The question the RFI surfaces is whether an integrated entity collecting fees from every node of a transaction can set those fees at anything that credibly constitutes arm's-length fair market value. CMS is acknowledging the problem inside the document itself. It explicitly asks whether market concentration and vertical integration distort PBM pricing — and then asks the concentrated, integrated industry to answer.

---

The GAO addressed the financial architecture in September 2023. Report GAO-23-105270 found that plan sponsors received $48.6 billion in manufacturer rebates through Medicare Part D in 2021. Three drug classes generated 73% of that total.

The more specific finding: on 79 of the 100 most-rebated drugs in Part D, beneficiaries paid more out of pocket than plan sponsors paid net of rebates. The rebates reduced costs for insurers. They did not reduce costs for patients, because patient cost-sharing is calculated on gross prices before rebates are applied.

It is worth noting that the Inflation Reduction Act's Part D redesign provisions, phasing in through 2024 and 2025, began restructuring cost-sharing in ways that affect this dynamic. The 2021 GAO data predates those changes. Whether the redesign meaningfully closes the gap the GAO identified is a fair question, and one the RFI process might usefully explore. What the GAO found as of 2021, however, was that CMS had the rebate data and was not using it to oversee formularies — citing statutory uncertainty about its authority to intervene in manufacturer-plan negotiations.

That report is now nearly three years old. The RFI published this week is still working out how to define a rebate-adjacent payment.

---

I am not arguing the RFI is bad faith. Section 6224 is real legislation. CMS is doing what agencies do: building a record before drafting rules, and a 2028 implementation date does allow time to get the definitions right and reduce litigation risk. Rushed rules get vacated in court. Thorough rulemaking survives.

What the timeline also does is extend the period during which the current arrangement continues without a federal definition of what any of it means. The FTC has been investigating PBM practices since 2022 without a concluded public enforcement action. Congressional committees have held years of hearings covering the same opacity this RFI is still mapping.

The RFI is four pages. The comment deadline is July 20, 2026. The industry it covers books billions in fees annually against pricing structures that remain undefined in federal regulation.

The 2028 date may produce better rules than a rushed alternative would. It is still worth asking what accumulates in the gap between now and then — and who benefits from the current definitions remaining unsettled while the clock runs.

Start with the contract. In this case, start with the comment record.