RxDC Reporting in Light of June 1, 2024 Deadline and Recent PBM Litigation

Under the Consolidated Appropriations Act of 2021 (“CAA”), employer-sponsored group health plans, including medical-only plans, must submit information about their prescription drugs and health care spending.[1] This submission is often referred to as the Prescription Drug Data Collection report, or the RxDC report. The deadline for RxDC reports for 2023 is June 1, 2024. It appears that a penalty of $100 per day for the period of noncompliance could apply for failing to timely file the report.

Given the upcoming deadline and the heightened litigation risk associated with pharmacy benefit managers (“PBMs”), as illustrated by a recent putative class action lawsuit brought against Johnson & Johnson,[2] this post briefly describes the lawsuit and the RxDC requirements and provides action steps for group health plans to consider. RxDC reporting is no small task, and plan sponsors would be well advised to craft an approach specific to their needs and capabilities to mitigate compliance and litigation risks.

The Johnson & Johnson lawsuit. The complaint alleges that Johnson & Johnson and its pension and benefits committee breached their fiduciary duty under the Employee Retirement Income Security Act of 1974, as amended (“ERISA”) by imprudently selecting the PBM for the Johnson & Johnson plans, agreeing to pay unreasonable prices, and failing to properly oversee the PBM. The plaintiff compared certain generic-specialty drug prices for the Johnson & Johnson plans with the average acquisition cost for pharmacies in the National Average Drug Acquisition Cost database and asserts that across 42 drugs, Johnson & Johnson PBM prices reflect, on average, a markup of 498%. For example, the complaint alleges that:

• The average acquisition cost for abiraterone acetate, a drug used to treat prostate cancer, is $0.92 per 250mg tablet or $82.80 for a 90-unit prescription, but the plans pay $5,375.26 for each 90-unit abiraterone acetate prescription. This reflects a 6,391.86% markup.
• The average acquisition cost for abacavir-lamivudine, an HIV antiviral drug, is $2.01 per tablet or $180.90 for a 90-unit prescription, but the plans pay $1,629.40 for each 90-unit abacavir-lamivudine prescription. This reflects an 800.72% markup.[3]

The exercise that the plaintiff went through to draft the complaint is comparable to the preparation of the RxDC report: both involve a comprehensive review of prescription drug prices that can serve as a basis for judgments about how competitively the PBM prices the drugs. Unlike the plaintiff, who was denied access to the plans‘ negotiated drug prices and had to use the PBM’s publicly available information, plan fiduciaries can ask to review the plan drug pricing data at any time (within the bounds of their agreement with the PBM). Thus, while it is not clear there exists a fiduciary obligation to obtain the lowest possible price on all drugs available through a plan—and such a standard may seem impossibly demanding—the RxDC reporting may provide a good starting point for plan sponsors and fiduciaries to assess and steer clear of litigation risks related to PBMs.

RxDC requirements. Broadly described, the CAA requires employer-sponsored group health plans to submit the following information through the Health Insurance Oversight System portal:

• spending on prescription drugs and health care services;
• the prescription drugs that account for the most spending;
• the drugs that are prescribed most frequently;
• prescription drug rebates from drug manufacturers; and
• premiums and cost-sharing that participants pay.

Who bears the risk of noncompliance with RxDC reporting? The interim final regulations provide that:

• Fully insured group health plans may satisfy the RxDC requirements by entering into a written agreement with the insurance company to report on their behalf. If the insurance company does not report the required information, the insurance company violates the reporting requirements.
• Both self-funded and fully insured group health plans may also satisfy the RxDC requirements by contracting with a PBM, a third-party administrator (“TPA”), or other third party, to report on their behalf. If the third party does not report the required information, the plan is liable for violating the reporting requirements.

In other words, while the RxDC reporting duties can be contracted away, self-funded plans cannot contract away the liability arising from noncompliance with RxDC reporting requirements, and fully insured plans can contract away such liability only if the contract is with the insurance company.

RxDC reporting instructions. The instructions, updated in January 2024, confirm that a third-party vendor can submit information on behalf of plans and that group health plans can use multiple vendors to submit their data. For example, a self-funded group health plan may contract with a TPA to submit the spending-by-category data file (the “D2 file”) and separately contract with a PBM to submit the Top 50 Most Costly Drugs file.

The instructions also list changes for this round of reporting. Key changes for RxDC reports due June 1 include:

• Data in D1, the premium and life-year file, and the information about the prescription drug benefits in D3 to D8 files, must be aggregated at levels at least as granular as the aggregation level used by the reporting entity that submits the data in the D2 file. For example, if the D2 file is submitted at the plan level, then files D1 and D3-D8 also must be submitted at the plan level. However, this restriction does not prevent a plan sponsor from submitting data at the plan level on the D3-D8 files and relying on a different reporting entity (e.g., a TPA or insurance company) to submit the medical benefit D1 and D2 files in the aggregate. Similarly, if a plan uses a TPA or insurer to submit an aggregate D2 file, the plan can rely on aggregate vendor files, or submit D3-D8 files at the plan level. While the change adds a layer of complexity, plan sponsors have the flexibility to design the RxDC reporting process to fit their needs.
• For the calculation of the average monthly premium, employers should divide the annual premium amounts by 12. Previously, the average premium was calculated on a per-member-per-month basis. The change should simplify this aspect of reporting.

Although generally helpful, the updated instructions, unlike past guidance, do not provide good faith relief for this round of RxDC reporting and do not extend the deadline beyond June 1, 2024.

What should group health plans do? Group health plans should consider the following steps:

• Ensure timely and accurate submission of the RxDC reporting by June 1, 2024.
• Become familiar with the regulations, instructions, and other RxDC resources on the Centers for Medicare and Medicaid Services website. The plan can contract away the task of preparing and submitting the RxDC report but not the liability (except for fully insured plans that contract with the insurance companies for RxDC report preparation and submission).
• If your plan is fully-insured:

• Ensure the plan has a legally enforceable contract for the insurance company to perform the RxDC reporting.
• Carefully review and negotiate the indemnification provisions for RxDC reporting in the contract with the insurance company.

• If your plan is self-funded:

• Request and review the processes and procedures for RxDC reporting during a Request for Proposal stage for the plan’s TPA, PBM, or other vendors.
• When negotiating service agreements with the plan’s TPA, PBM, or other vendors, carefully review and consider terms relating to responsibility for preparing RxDC reporting and include terms for timely provision of the report upon request by the plan sponsor.
• Evaluate whether the plan could and should tackle reporting plan-level RxDC pharmacy files on its own. The advantage is that the plan could glean valuable insights from the data, learn more about the PBM’s pricing structure, including prescription drug rebates, and better assess litigation risks.
• As permitted under the updated RxDC reporting instructions, give thought to submitting the pharmacy data at the plan level and relying on a TPA or insurance company to submit the medical benefit information, in the aggregate. This approach would enable the plan to self-report the pharmacy benefits while relying on a TPA or an insurance company to submit the information for the medical benefits.

• If the plan prefers the self-reporting approach, RxDC reporting could be used strategically as a tool for the plan fiduciaries to evaluate PBM prices.
• If the plan prefers to outsource RxDC reporting, plan fiduciaries still would be well advised to ask for the report, scrutinize the data, and identify and question any concerning trends.

RxDC reporting is here to stay. While complex and burdensome, it can serve as a valuable tool for plans to better understand their relationship with PBMs and reduce the risk of litigation.

Should you have any questions regarding RxDC reporting or PBM litigation, please contact a member of our Employee Benefits & Executive Compensation Group.