Pharmacy benefit regulation has moved faster in the last few years than almost any other area of healthcare compliance, and much of the movement has been at state level. For payors and pharmacy benefit managers, the practical effect is that a compliance program built around federal requirements alone is now materially incomplete.
What follows is where we see the pressure concentrating in pharmacy payor compliance, and what a defensible program addresses.
The state layer is now the harder one
Most states license or register pharmacy benefit managers, and many regulate specific practices: reimbursement below acquisition cost, maximum allowable cost list methodology and appeal rights, spread pricing, retroactive fee recovery, network adequacy, and steering to affiliated pharmacies.
The preemption question that governs how far these laws reach is unsettled in an important way. In Rutledge v. Pharmaceutical Care Management Association (2020) the Supreme Court held that ERISA did not preempt an Arkansas statute regulating PBM reimbursement rates. In PCMA v. Mulready (2023) the Tenth Circuit held that ERISA and Medicare Part D did preempt several provisions of an Oklahoma PBM law, including network restrictions.
Those two outcomes are reconcilable, but only at a level of detail that makes a general rule unhelpful. Rate regulation has generally survived; regulation that dictates plan structure or benefit design has fared worse. For a payor operating in multiple states, the practical implication is that preemption analysis has to be done provision by provision rather than assumed.
Federal requirements that continue to generate exposure
Medicare Part D. CMS requirements on formulary administration, coverage determinations, appeals timeliness and network access are audited, and findings carry real consequence. The treatment of pharmacy price concessions at point of sale changed the economics of pharmacy contracting and remains an area where documentation is tested.
Anti-Kickback Statute. Rebate arrangements, administrative fees, formulary placement and pharmacy network participation all sit close enough to the statute that the safe harbor analysis needs to be documented rather than assumed. This is one of the areas where a defensible file is worth more than a correct outcome reached informally.
False Claims Act. Government pharmacy program claims carry FCA exposure, and a significant share of enforcement arrives through relators who are current or former employees. That is a reason to make internal escalation work, not merely to have a policy that describes it.
Transparency and reporting. Federal and state transparency requirements have expanded, with different filings, deadlines and definitions. These are administratively burdensome rather than conceptually hard, which is precisely why they get missed.
What a defensible pharmacy payor compliance program looks like
Written policies that reflect actual practice
Policies are only useful where they describe what the organization does. A policy that describes an aspirational process becomes evidence against the organization in an audit, because the gap between the document and the operation is exactly what an auditor is looking for. Where practice and policy diverge, change one of them deliberately.
A named compliance owner with authority
Designating a compliance officer matters less for the title than for two things it should carry: independent access to the board or its equivalent, and the ability to stop something. A compliance function that reports only through the business it oversees has a structural problem no amount of process will fix.
Auditing that tests outcomes, not documents
Annual audits are a reasonable baseline, more often where the operation is complex or newly integrated. The distinction that matters is between confirming a policy exists and sampling actual transactions to see what happened. Reimbursement disputes, MAC appeals and coverage determination timeliness are all testable against records rather than against process descriptions.
Issues escalated and closed
Most matters that become expensive were visible internally first. Investigate promptly, document the finding and the remediation, correct the underlying cause, and close the loop with whoever raised it. An issue reported internally and left unanswered is the most common route to the same issue being reported externally.
Counsel involved at the right point
Pharmacy benefit regulation is fragmented, actively litigated, and moving. Standing arrangements built on a settled reading of the law are worth revisiting periodically, particularly network and reimbursement terms in states that have legislated recently.
Talk to us
We advise payors, pharmacy services organizations and health technology companies on regulatory compliance, contracting and third-party risk. If you are reviewing your program or working through a specific arrangement, contact us or book a discovery call.
The information provided on this website is for general informational purposes only and should not be considered legal advice. No attorney-client relationship is created by accessing or using this website. Please consult with a qualified attorney before making any legal decisions. Global Link Law is not liable for any reliance on the information provided. Prior results do not guarantee a similar outcome.
