Insurance regulators and examiners (“Insurance Regulators”) are increasing their efforts to scrutinize pharmacy benefit managers (“PBMs”), including conducting examinations of their business operations and initiating enforcement actions against PBMs for allegations of violations of state insurance laws. Many health insurers utilize PBMs by contracting with affiliated or third party PBMs for a host of services, including creating formularies, negotiating rebates or discounts with drug manufacturers, processing claims, and reviewing drug utilization. Insurance Regulators are stepping up their efforts to understand how these PBMs operate and how they may impact health insurance consumers.

The Rutledge Decision and Increased State Insurance Regulation

Since the December 10, 2020 U.S. Supreme Court decision Rutledge v Pharmaceutical Care Management Association, 2020 WL 7250098 (U.S. 2020), in which the Court upheld an Arkansas law that required PBMs to pay pharmacies no less than their acquisition costs for prescription drugs, states have increasingly exercised their ability to regulate PBMs. The Court unanimously held that the Employee Retirement Income Security Act (“ERISA”) did not preempt Arkansas's law regulating PBMs. The Court concluded that “ERISA does not pre-empt a state law that merely increases costs, however, even if plans decide to limit benefits or charge plan members higher rates as a result.” Id. at 9.

In 2018, the National Association of Insurance Commissioners (“NAIC”) Pharmacy Benefit Manager Regulatory Issues (B) Subgroup (the “PBM Subgroup”) was established to consider the development of a new Model Act regulating PBMs. In October 2020, the PBM Subgroup adopted a new Pharmacy Benefit Manager Licensure and Regulation Model Act (the “Draft Model Act”).^[1] The Draft Model Act provides for PBM licensing and examination by Insurance Regulators. Additionally, the Draft Model Act contemplates incorporating the state’s existing market conduct exam laws as an alternative to a specific examination provision within the PBM Insurance Law.

In the last several years, because, in part, the Rutledge case was a big win for state regulation, there has been a significant increase in new state laws regulating PBMs, as well as a demonstrated effort by Insurance Regulators to examine and otherwise regulate PBMs. Most states have enacted laws requiring PBMs to obtain registration or licensure.^[2] Some states have enacted specific PBM registration requirements under the insurance code, some states have clarified that PBMs are required to obtain third party administrator licenses, and others have enacted specific PBM regulation. The trend in the new state laws is to require more robust PBM reporting, prohibitions on spread pricing, and increased transparency for consumers.

Examination and Cooperation

State insurance regulation of PBMs includes not only registration or licensure, but also examination authority of a PBM’s operations. While PBMs have been subject to state insurance laws for some time, there is an increasing trend of Insurance Regulators conducting investigations and examinations of PBMs. Typically, the insurance code provisions regulating PBMs, as well as the provisions governing market conduct examinations, provide statutory authority for Insurance Regulators to examine a PBM’s books and records and to request the production of information from the PBM in the context of the ongoing exam. Failure to comply with these provisions may result in fines, revocation or suspension of the PBM’s registration and the possible imprisonment of individuals.

In those states that have enacted laws regulating PBMs, Insurance Regulators generally have broad statutory authority to examine the PBM’s operations. For example, state statutes often permit Insurance Regulators to:

• Examine the PBM’s business affairs;
• Have access to the PBM’s books and records at the PBM’s offices at reasonable times;
• Administer oaths and interview the PBM’s designees, representatives, officers or senior managers listed on the registration;
• Make a report to the Insurance Director and allege any substantive violations of applicable law;
• Deliver the report to the PBM and provide the PBM with an opportunity to request a hearing to object to the report;
• Conduct administrative hearings; and
• Subpoena books, records and testimony.

See e.g., Ariz. Rev. Stat. § 20-3333 (F)(2); 215 ILCS 5/513b1 et seq. (Illinois Pharmacy Benefit Manager Law); 215 ILCS 5/132 (the Illinois Market Conduct Law); Iowa Admin. Code r. 191-59.10; Kan. Stat. § 40-3823; N.Y. Ins. Law § 2906 (g); N.C. Gen. Stat. § 58-56A-10 (f); and S.C. Code Ann. § 38-71-2250.

Insurance Regulators also may require PBMs to cooperate in the context of an investigation preliminary to a proceeding to issue a corrective order. See e.g., 215 ILCS 5/186.2. Cooperation includes:

• Promptly responding in writing to regulatory inquires;
• Providing access to books and records and other information in the PBM’s possession, custody or control;
• Refraining from obstructing or interfering with regulators’ examinations and investigation; and
• Refraining from violating any regulatory order.

Id. Generally, the cooperation requirements apply to any “officer, manager, director, trustee, owner, employee, or agent of any insurer, or any other person with authority over or in charge of any segment of the company's affairs.” Id. It is important that PBMs and their management be aware of these laws and the related consequences of non-compliance.

Enforcement and Regulatory Orders

Insurance Regulators also are increasingly seeking enforcement actions against or otherwise issuing examination reports with allegations of statutory violations resulting in consent or corrective orders to PBMs. Typically, these final examination reports and related administrative orders are subject to public disclosure. See e.g., 215 ILCS 5/132(4). By contrast, the work papers and other information provided to Insurance Regulators during the course of an examination or investigation typically is given confidential treatment. See e.g., Ala. Code § 27-45A-4; Ariz. Rev. Stat. § 20-3333; Kan. Stat. Ann. § 40-3823; and, VA Code Ann. § 38.2-3468. Failure to comply with the PBM and market conduct laws may result in fines, as well as suspension or revocation of the PBM’s registration, generally after notice and hearing. See e.g., 215 ILCS 5/513b4; 215 ILCS 5/132(5). Failure to comply with the Market Conduct Exam Law may result in a fine and may include anyone who “aids and abets” any violation. See e.g., 215 ILCS 5/132(5). Additionally, anyone who fails to cooperate, interferes with the investigation, or violates any order or law is subject to fines and penalties. See e.g., Ariz. Rev. Stat. § 20-3333 (F)(2); Colo. Rev. Stat. § 10-16-122.1 (eff. 2024); 215 ILCS 5/186.2; N.Y. Ins. Law § 2907; N.C. Gen. Stat. § 58-56A-10 (c); and, W. Va. Code St. R. § 114-99-8.

It is important to understand the extent of the Insurance Regulators’ authority over PBMs, which could place PBMs in jeopardy of non-compliance and related fines, penalties and even loss of their registration or licenses to operate in the state. Individuals also may be at risk if they are intentionally engaging in non-compliance under these laws.

^{[1] The Draft Model Act has not yet been adopted by the full NAIC membership.}

^{[2] Ala. Code § 27-45A-4; Alaska Stat. § 21.27.901; Ariz. Rev. Stat. § 20-3333 (Eff. 1/1/25); AR Rule and Regulation 118 § 5; Cal. Health Safety Code § 1385.005; Conn. Gen. Stat. § 38a-479bbb; Del. Code Ann. tit. 18, § 3353A; Fla. Stat. Ann. § 624.490; GA Code Ann. § 33-64-2; Haw. Rev. Stat. § 431S-3; Idaho Code 41-349 (2); ILCS 5/ 513b2; Ind. Code § 27-1-24.5-18; Iowa Code § 510B.2; Kan. Stat. Ann. § 40-3823; KY Rev. Stat. § 304.9-053; La. Rev. Stat. Ann. § 22:1657; ME Rev. Stat. Ann. tit. 24-A § 4348; MD Code Ann. Ins. § 15–1604; Mich. Comp. Laws §§ 550.902 (t) and 550.910; Minn. Stat § 62W.03; Miss. Code. Ann. § 73-21-157; Mo. Rev. Stat. § 376.393 (2); Mont. Code Ann. § 33-2-2403; Neb. Rev. Stat. § 44-4605; NH Rev. Stat. § 402-N:2; N.M. Stat. Ann. § 59A-61-3; N.Y. Ins. Law § 2903; N.C. Gen. Stat. § 58-56A-2; N.D. Cent. Code § 26.1-27.1-02; Ohio Rev. Code Ann. §§ 3559.01(B) and 3959.05; Okla. Stat. tit. 59, § 358; OR Rev. Stat. § 735.532; 40 P.S § 4521; R.I. Gen. Laws §§ 27-20.7-12 and 27-29.1-7; S.C. Code Ann. § 38-71-2210; SD Codified Laws § 58-29E-2 (Eff. 7/1/23); TN Ins. Code § 56-7-3113; TX Ins. Code § 4151.001(1) and § 4151.051; UT Code Ann. § 31A-46-201; VT Stat. Ann. tit. 28, § 9421; VA Code Ann. § 38.2-3466; Wash. Rev. Code §§ 48.200.020 (4)(b) and 48.200.030 (1); W.Va. Code § 33-51-8; Wisc. Stat § 633.13; and Wyo. Stat. Ann. § 26-52-101.}