The PBM Business Model May Be Reaching a Policy Tipping Point

For years, most of the PBM debate focused on individual practices. Pharmacy reimbursement was one fight. Rebates were another. Then there was spread pricing, steering, pharmacy networks and transparency.

Those issues are all still being debated, but something has changed. We are starting to see pressure on several parts of the PBM business model at the same time.

Congress has already changed some of the federal rules around PBM compensation and transparency. States are going further. PBMs and health plans are challenging some of those state laws under ERISA, and the courts are beginning to tell us where the boundaries are.

That is why a new decision from the U.S. Court of Appeals for the Seventh Circuit matters.

On its own, the case is another important decision involving PBM regulation and ERISA. Put it next to what is happening in Illinois, Tennessee and Washington, and a bigger issue starts to come into view.

We may be moving beyond a debate over individual PBM practices and toward a larger fight over the economics of the PBM business model itself.

Rutledge Left the Door Open

The Supreme Court's 2020 decision in Rutledge v. Pharmaceutical Care Management Association gave states important room to regulate what PBMs pay pharmacies. The Court concluded that Arkansas's reimbursement law amounted to cost regulation and did not dictate how an ERISA plan had to structure its benefits.

That did not mean states could regulate PBMs however they wanted.

In Mulready v. Pharmaceutical Care Management Association, the Tenth Circuit found that ERISA preempted portions of an Oklahoma law affecting pharmacy network design. That gave PBMs a stronger argument when state regulation moves beyond price and begins affecting how an ERISA plan operates its pharmacy network.

Importantly, Mulready did not overrule Rutledge, nor could it. Rutledge remains the controlling Supreme Court precedent. Instead, Mulready helped define where courts may draw the line between state regulation of PBM costs and state laws that affect the structure or administration of an ERISA plan.

The fight since then has been over where that line should be drawn.

On August 26, the Seventh Circuit added another piece.

The court upheld an Arkansas rule allowing the state to require additional dispensing fees when pharmacy reimbursement is not considered fair and reasonable. A self-funded health and welfare plan argued that ERISA preempted the rule.

The court disagreed.

The dispensing fee, according to the court, was still cost regulation of the kind permitted under Rutledge. The fact that it could make prescription benefits more expensive did not mean Arkansas was dictating how the plan had to be structured.

The court also upheld an Arkansas reporting requirement tied to pharmacy compensation, although that part of the decision came with an important caveat.

Congress recently created new federal ERISA reporting requirements covering some of the same pharmacy compensation information Arkansas is collecting. Those federal requirements have not yet taken effect. The Seventh Circuit therefore did not decide whether the new federal rules will eventually preempt Arkansas's reporting requirement, expressly leaving that question for another day.

That detail is easy to overlook, but it says a lot about where PBM regulation is heading. Congress, the states and the courts are no longer operating on separate tracks. What Congress does can change the ERISA analysis courts apply to state laws, while those court decisions can determine how much room states have to continue regulating PBMs.

States Are Already Moving Further

Illinois is testing those boundaries now.

Its Prescription Drug Affordability Act addresses spread pricing, steering and transparency, among other PBM practices. PCMA has challenged portions of the law, arguing that Illinois has crossed the line when its requirements affect ERISA plans and their pharmacy networks.

Tennessee has gone further.

Its FAIR Rx Act does not simply regulate reimbursement or require more disclosure. It challenges vertical integration by restricting companies that own PBMs from also owning or operating pharmacies in the state.

That law is also being challenged.

This is where the PBM debate begins to look different. The largest PBMs today are part of much larger healthcare companies that can include insurance, pharmacy benefits, specialty pharmacy, retail pharmacy and healthcare services under the same corporate organization. Once policymakers begin questioning not only how PBMs operate, but whether some of those businesses should remain under common ownership, the debate moves beyond PBM compliance and into the structure and economics of the business itself.

Congress Is Applying Pressure From the Other Direction

Washington matters here too.

Congress has already enacted reforms affecting PBM compensation, rebates and transparency. Additional federal proposals would go further.

None of this dismantles the PBM model. States are not uniformly moving in the same direction either, and Mulready demonstrated that ERISA places real limits on state authority.

Still, look at the areas being challenged at the same time: reimbursement, spread pricing, rebates and compensation, transparency, steering, pharmacy networks and vertical ownership.

None of these changes on its own is likely to remake the PBM business model. The concern is what happens when several of them start happening at the same time.

PBMs are going to be regulated. That question has largely been settled. What matters now is whether all of this pressure begins to change the economics of the business itself.

Follow the Money

This is where the issue becomes relevant well beyond PBMs and pharmacies.

The economics of pharmacy benefits do not exist in a vacuum. Money moves among manufacturers, PBMs, health plans, employers, pharmacies and patients, and the large vertically integrated healthcare companies operating across several of those businesses have spent years building around that flow. If the rules governing that system change, the money does not simply disappear. It moves.

Higher pharmacy reimbursement could move more value toward pharmacies. Changes to rebates and PBM compensation could affect what employers and health plans retain and how they negotiate contracts. Restrictions on steering could change the economics of affiliated specialty and retail pharmacies, while restrictions on ownership could raise a much larger question about the value of vertical integration in the first place.

The point is not that all of these changes will happen, or that the PBM model is about to disappear. There are still major legal questions to be resolved. Mulready showed that ERISA places real limits on what states can do, and some of the more aggressive state laws may not survive.

What is changing is the nature of the risk. A reimbursement mandate or a new transparency requirement can be treated as another regulatory development. The calculation starts to look different when policymakers are changing reimbursement, compensation and transparency while also challenging network design, steering and even ownership.

At that point, the issue begins to look less like a collection of compliance problems and more like business model risk.

The Seventh Circuit did not decide where all of this ends. What it did confirm is that Rutledge continues to leave states with room to regulate PBM costs. Illinois and Tennessee are now testing how much further that authority can reach, while Congress is changing parts of the federal framework at the same time.

For PBMs, pharmacies, health plans and employers, the outcome will matter operationally. For executives and investors looking at the broader healthcare market, there is another question worth following: if policy changes where value is captured in the pharmacy benefit system, who captures it next?

That may ultimately be the bigger story.

FDA Extends Certain DSCSA Exemptions for Small Pharmacies: What the Additional Year Means

The Food and Drug Administration has given qualifying small pharmacies another year to implement certain enhanced drug distribution security requirements under the Drug Supply Chain Security Act.

On August 6, 2026, FDA announced that small dispensers, along with their trading partners where applicable, will receive exemptions from certain requirements through November 27, 2027. The prior exemption period was scheduled to end on November 27, 2026.

For independent and community pharmacies still working through technology, data exchange, staffing, and trading partner challenges, the additional year is meaningful. It is not, however, a suspension of DSCSA compliance.

The exemption applies only to specific enhanced drug distribution security requirements. Other DSCSA responsibilities remain in effect, and FDA is continuing to urge small dispensers to make progress toward full implementation.

Which Pharmacies Qualify?

For purposes of the new exemptions, FDA considers a dispenser to be a small dispenser if the company that owns the dispenser has 25 or fewer full time employees who are licensed pharmacists or qualified pharmacy technicians as of November 27, 2026.

This means the analysis is based on the company that owns the pharmacy, not necessarily the employee count at one individual pharmacy location. Organizations operating multiple locations should therefore examine their ownership structure and total number of qualifying employees before concluding that the exemption applies.

Qualifying small dispensers do not need to submit an application or notify FDA to use the exemption. A pharmacy should still document its eligibility internally and be prepared to explain the basis for relying on it.

What Has Been Extended?

The exemptions apply to certain enhanced security requirements involving interoperable, electronic, package level product tracing.

During the exemption period, qualifying small dispensers and, where applicable, their trading partners may continue using existing methods for certain activities that would otherwise require fully interoperable electronic systems. These include aspects of:

• Exchanging transaction information and transaction statements electronically

• Including package level product identifiers in transaction information

• Conducting product verification at the package level

• Responding to government requests for transaction information during recalls or investigations

• Gathering transaction information back through the supply chain

• Processing certain saleable returns

The exemption also covers specific product identifier verification requirements when a qualifying pharmacy investigates suspect or illegitimate products. It does not eliminate the pharmacy’s other investigation and verification responsibilities.

What the Exemption Does Not Cover

The extension should not be treated as a general waiver from DSCSA.

Pharmacies must still purchase prescription drugs from authorized trading partners. They must maintain applicable transaction records, identify and investigate suspect products, quarantine products when appropriate, and notify FDA and relevant trading partners when illegitimate products are discovered.

Pharmacies must also maintain policies and procedures that allow employees to recognize and respond to products that may be counterfeit, diverted, stolen, adulterated, or otherwise unfit for distribution.

The additional year changes the timeline for certain enhanced electronic requirements. It does not erase the underlying obligation to protect the integrity of the drug supply chain.

Why FDA Granted More Time

FDA granted the additional exemption while an independent assessment examines whether small dispensers can feasibly implement interoperable, electronic tracing at the package level.

That assessment will evaluate the technology and software available to small pharmacies, including whether existing systems are accessible, functional, and economically feasible. FDA is encouraging small dispensers to complete its assessment survey by September 22, 2026. A small dispenser may designate another organization, such as a consultant, to complete the survey on its behalf.

The survey gives independent pharmacies an opportunity to document the practical difficulties they encounter, including system costs, integration problems, staffing limitations, data quality issues, and dependencies on wholesalers or technology vendors.

How Pharmacies Should Use the Additional Year

The safest approach is to treat the extension as an implementation period, not a waiting period.

A pharmacy relying on the exemption should first document why it qualifies. That documentation should identify the ownership entity, the relevant employee count, and the methodology used to determine which employees are included.

The pharmacy should then evaluate its current DSCSA capabilities. This includes confirming whether it can receive and retrieve transaction information, identify its authorized trading partners, investigate suspect products, quarantine inventory, respond to information requests, and preserve the required records.

Pharmacies should also speak with their wholesalers, buying groups, and technology providers. A pharmacy may qualify for an exemption while one or more of its trading partners operate under different requirements. Understanding how each party will transmit, receive, store, and retrieve information can help prevent purchasing disruptions and inventory delays.

Written policies should reflect what the pharmacy is actually doing today. Employees responsible for purchasing, receiving, returns, inventory management, and product investigations should understand those procedures and know when a problem must be escalated.

Finally, pharmacies should keep records of their implementation efforts. Contracts, vendor communications, training records, system testing, written procedures, corrective actions, and internal assessments can help demonstrate that the pharmacy used the exemption period responsibly.

The Legal and Operational Risk Has Not Disappeared

DSCSA compliance is not solely a technology project. It involves vendor contracts, licensing, purchasing controls, record retention, employee training, product investigations, and relationships with trading partners.

A pharmacy that waits until the exemption is about to expire may discover that its software cannot communicate effectively with a wholesaler, its transaction data cannot be retrieved promptly, or its written policies no longer reflect its operations. Those problems can affect more than regulatory compliance. They can interrupt purchasing, delay returns, create audit exposure, and ultimately affect patient access.

FDA’s extension gives qualifying small pharmacies valuable time to address those risks. The best use of that time is to build a compliance program that is both operationally workable and legally defensible.

Lanton, Lanton & Sosa Law PLLC advises pharmacies, healthcare organizations, and other regulated businesses on compliance, contracting, audits, licensing, reimbursement, and operational risk. Organizations evaluating the DSCSA exemption should assess both their eligibility and the steps necessary to reach full compliance before the exemption ends.

This article is provided for general informational purposes and does not constitute legal advice.

New York State Bar Association (NYSBA) Journal Publishes Ron Lanton III Article on Global Healthcare Reform and Life Sciences Strategy

Lanton, Lanton & Sosa Law PLLC is pleased to share that Ron Lanton III’s article, “The Global Healthcare Divorce: How US and EU Reforms Are Reshaping the Structure of Life Sciences Companies,” was published in the Summer 2026 issue of the New York State Bar Association Journal.

The article examines how healthcare reform in the United States and European Union is beginning to affect more than compliance. These changes are also shaping life sciences strategy, company structure, market access, exclusivity, reimbursement planning, and capital decisions.

For healthcare and life sciences companies, the larger takeaway is that regulatory change is becoming a business planning issue. Companies operating across markets need to understand how policy developments may affect contracts, commercialization strategy, investor expectations, and long-term growth.

At Lanton, Lanton & Sosa Law PLLC, we work with healthcare organizations, life sciences companies, pharmacies, physician groups, and health-adjacent businesses on the legal, regulatory, and strategic issues that affect growth in highly regulated markets.

The article begins on page 51 of the Summer 2026 NYSBA Journal seen at https://nysba.org/wp-content/uploads/2026/06/jrnl_summer2026-6-23-26-FINAL-WEB.pdf

AI Medical Advice Is Moving Faster Than Healthcare Risk Management

Artificial intelligence is quickly becoming part of the healthcare experience. Patients are using AI tools to ask questions, interpret symptoms, manage medications, and decide whether they need to seek care. Some of these tools are being introduced through formal healthcare partnerships. Others are consumer-facing platforms that were never designed to operate as part of the healthcare system.

The problem is that patients are not always seeing the difference between a tool that gives general information and a tool that sounds like it is giving medical guidance. This is where real risks comes in.

The recent lawsuit in Pennsylvania involving Character.AI is a reminder that healthcare risk is no longer limited to hospitals, physicians, pharmacies, or traditional medical technology companies. When patients rely on AI-generated information to make decisions about their health, the legal and regulatory questions become much more complicated.

Who is responsible if the information is wrong? Was the platform providing general information, or did it cross into something closer to medical advice? Did the user understand the limits of the tool? Was there any process for escalation, disclosure, clinical review, or human oversight?

These questions matter because AI is not entering healthcare through one clean channel. It is coming through consumer applications, state partnerships, provider workflows, payer systems, pharmacy tools, and patient-facing platforms. Some uses may be administrative. Others may influence clinical decision-making in ways that are not obvious at the beginning.

That creates a different kind of risk environment for healthcare organizations.

The issue is not whether AI should be used in healthcare. It will be used and increasingly so. The more important question is whether healthcare organizations have the governance structure to understand how it is being used, who is relying on it, and where the legal risk sits.

For providers, pharmacies, health systems, digital health companies, and other healthcare organizations, AI review cannot sit only with the technology team. It needs to involve legal, compliance, clinical, operational, and risk management leadership before the tool is placed in front of patients or built into a workflow.

That review should start with practical questions. What is the tool actually doing? Is it generating general information, making recommendations, triaging care, renewing medications, or influencing a provider’s decision? Who reviews the output? What disclosures are being made to patients? How are errors identified? What happens when the AI reaches the limit of what it should answer?

The answers to those questions may determine whether an organization is using AI as a helpful support tool or unintentionally creating a new source of professional, regulatory, and operational exposure.

Healthcare has always depended on trust. AI does not remove that obligation. It simply changes where the trust is being placed.

As AI becomes more visible in healthcare, the organizations that move carefully will not be the ones avoiding innovation. They will be the ones that understand that innovation needs structure around it.