
The ShiftShapers Podcast · 2026-05-12 · 28 min
Key moments - from our scoring
Substance score
59 / 100
Five dimensions, 20 points each
Carol Taylor, a compliance specialist with 36 years of benefits industry experience and a JM from Liberty University, explains the intricate web of compliance obligations that continue to catch employers off-guard. The conversation centers on RXDC reporting (prescription drug data collection under CAA 2021), which requires employers to submit data on the top 50 drugs and their year-over-year cost changes by June 1st - yet many miss this deadline because carriers haven't publicized the CMS filing process or brokers haven't reminded them. The CAA 2026 dramatically expands PBM disclosure requirements, moving from simple fee transparency to detailed rebate pass-through reporting, spread pricing, pharmacy payments, and manufacturer assistance data, effective August 2028. Self-funded plans face $10,000-per-day penalties for non-disclosure, compared to the typical $100-per-day penalties elsewhere. Taylor also addresses persistent confusion around fiduciary duties, mental health parity enforcement (DOL has paused it but didn't repeal it), ACA employer mandate penalties on 1094/1095 reporting dating back to 2015, and ongoing IDR gaming under the No Surprises Act where providers file 80% of disputes seeking three to nine times market rates. She emphasizes that advisors must conduct compliance audits, understand both federal and state requirements, and avoid becoming functional fiduciaries through consulting arrangements - particularly after four large employers were recently sued over voluntary benefits with brokers named as fiduciary agents.
RXDC (prescription drug data collection) is a CMS reporting requirement under CAA 2021 where employers must submit data on top 50 drugs, cost changes year-over-year, and health spend across nine separate file templates by June 1st, with files uploaded via the CMS HiOS system.
The employer is ultimately responsible for complete filings even though carriers hold most of the responsibility; employers can face $10,000-per-day penalties or higher, and the law places the burden on employers because they are the legal entity responsible.
PBMs must disclose rebates, pharmacy payments, spread pricing, covered drugs, manufacturer payments, wholesale acquisition costs, average wholesale prices, net drug pricing, and total claims data, with self-funded plans receiving detailed reporting and fully insured/smaller groups receiving summary disclosures twice yearly.
Advisors should document in writing that they are not a fiduciary and are only presenting options as subject matter experts; however, employers may countersue advisors in federal court if they took advice, so due diligence and documented SOP disclosures are essential.
Yes; the DOL pause is temporary and enforcement could resume, so self-funded plans must continue to perform comparative analysis reports or face audits, corrective action plans, and excise tax exposure.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode covers genuine compliance requirements (RXDC, CAA 2026 PBM disclosure, MAPEA, No Surprises Act IDR) that many employers and advisors don't understand, with concrete penalty amounts and deadlines provided. However, much of the content is explanatory rather than deeply insightful - the guest mainly clarifies what regulations exist and what they require rather than offering strategic depth, cost-benefit analysis, or novel approaches to managing compliance risk. The advisor-focused sections on fiduciary liability and due diligence are more actionable.
The RXDC is short for prescription. RXDC is data collection. This was a law that was passed actually in 2020, but it was the very tail end of the years.
The non-disclosure provisions under the CAA of 2026 will be $10,000 per day.
The episode rehashes well-known regulatory requirements without fresh interpretation or contrarian framing. Carol Taylor explains compliance rules as they are written, not what's broken about them or how smart operators should think differently. The IDR gaming discussion touches on follow-the-money logic but doesn't uncover novel problems or solutions unique to this conversation. This is competent regulatory recap, not original thinking.
So the CAA of 2026, it expanded what the pharmacy benefit managers or PBMs must report.
There's a PBM disclosure requirement and there's also rebate pass-through requirements.
Carol Taylor is a compliance specialist with 36 years of industry experience and a JD from Liberty University, which is solid practitioner-level expertise. She operates at the advisor/consultant level helping brokers navigate compliance rather than as a C-suite operator or regulator with direct enforcement authority. Her background makes her credible on regulatory mechanics but not a tier-one guest for strategic business impact.
Carol Taylor, compliance specialist at CRC Benefits and a self-proclaimed nerd with a jurismaster's degree from Liberty University and 36 years of incredibly diverse experience in the industry.
in a compliance role, I get questions from brokers all the time.
The episode provides concrete details: RXDC June 1st deadline, CAA 2026 August 2028 effective date, $10,000/day penalties for non-disclosure, the two templates (P2 and D1) required, and specific litigation data (99.9% of IDR claims from providers/facilities, split 80/20). However, many claims lack supporting numbers - e.g., no data on how many employers have missed RXDC, no statistics on actual penalty assessments, no real case studies of compliance failures beyond the general mention of four large voluntary benefits suits.
This reporting deadline is June the first.
The non-disclosure provisions under the CAA of 2026 will be $10,000 per day.
David Saltzman asks competent setup questions and follow-ups (e.g., asking why employers are unaware of RXDC, pressing on fiduciary exposure), but rarely pushes back or challenge Taylor's claims. The conversation is friendly and collaborative - appropriate for an established guest - but lacks the sharpness of someone genuinely interrogating assumptions. When Taylor mentions the IDR gaming, Saltzman simply affirms ("That's what we were talking about") rather than drilling deeper into remedies or strategic responses.
So for people who may not have who may have heard the term, but still don't fully understand it, which is a lot of people, as you and I know, what exactly is RXDC reporting and why was it created?
Scary times. Let's go back to the regs for a little bit for some of the compliance.
Computed from the transcript - who did the talking, and the words that came up most.
Transcribed and scored by The B2B Podcast Index.
What happens when employers discover they were legally responsible for compliance requirements they didn't even know existed, and that they might be facing penalties and can reach $10,000 a day? We'll find out on this episode of Shift Shaper. Change either energizes or paralyzes. The choice is yours.
This is the Shift Shapers Podcast, bringing the employee benefits industry interviews with individuals and companies who are shaping the industry's shift. And now, here's your host, David Saltzman. And to help us better understand the compliance issues we're helping clients deal with, we've invited our dear friend Carol Taylor, compliance specialist at CRC Benefits and a self-proclaimed nerd with a jurismaster's degree from Liberty University and 36 years of incredibly diverse experience in the industry.
Hey, Carol, good to see you again. Good to see you again, David. It's been a while. It has.
Thank you for coming back and doing this with us again. And we appreciate it. You do great explanations. So we're going to test you today.
You ready? Oh, I'm ready. Okay. So for people, let's start at RXDC.
For people who may not have who may have heard the term, but still don't fully understand it, which is a lot of people, as you and I know, what exactly is RXDC reporting and why was it created? So the RXDC is short for prescription. RXDC is data collection. This was a law that was passed actually in 2020, but it was the very tail end of the years.
It's under the Consolidated Appropriations Act or CAA of 2021. And what it was meant to do was to get information, those types of spend. So prescriptions, which prescriptions, which ones are in the top 50, which ones are their cost is changing year over year, and by how much. Also health spend, not just prescription, but it does contain a lot of different things within that.
I guess we're going to ask this question a couple of times, but why did so many employers still seem unaware of it, even several years past implementation? I think there's probably just been a severe disconnect with the messaging out there. One of the issues is that CMS, who's collecting this data, hasn't even produced the report, even though they've been getting this data now for several years. Those reports are not making the news.
And I think that's it's also an issue with employers are just trying to run their companies. So if their broker is not in there reminding them about this stuff or even just picking up the phone or because we're all getting inundated with emails, it's always a good reminder to tell your clients, look, there's all these things that have to be done. And this is one of them. Can an employer count on a TPA to do this for them?
There might be TPAs that will do this for them. However, I don't know of any that will, other than if you're self-funded, you would contract with your own TPA likely to do that filing for you. So where does the ultimate legal responsibility actually sit if the reporting is not done or if it's incomplete? So when Congress passed this law, they actually put in the statutory text that the employer is the entity that's responsible for a complete filing.
Now they did put most of the responsibility on the employer, or excuse me, on the carrier, because the employer does not get that specific claims data. But there's some information that a lot of the carriers, they just don't have the space in their systems. And I think when Congress wrote this law, they thought, surely the carriers have all this data. A lot of the carriers, they don't put in their system how much the employer pays towards the employees' coverage and or if they pay anything towards dependents.
So without that information, the insurance carriers, of course, sending out surveys to the groups saying, hey, we need you to go put this information in. And then they have to take information out of their claim system and basically meld it all together into all of this big, huge reporting, which is done on nine separate files. And these templates are ridiculously long. So let's talk about it.
There are insurance carriers, as you mentioned, that maybe handle some of the reporting workload, but employers can still be exposed if something's missing. What are employers supposed to be doing right now to protect themselves? So the best thing to do is to make sure that the insurance, if they're dealing with an insurance carrier or an administrator, to make sure that everything that was needed, they got and that they're doing all of that filing for them. And if not, or if that employer missed their survey from the carrier, then that employer needs to get onto the CMS higher system now and get their login because that can take up to two weeks.
And this reporting deadline is June the first. So we're coming right up upon it. And with that lag and getting even the login, and employers would just need to upload two files then. They would need to upload the P2, Papa 2, and the D1 or Data or Delta 1 is what that file, that template file is.
Those are all on the CMS website. If you just Google search for the RXDC reporting and H IOS, which is the system that CMS uses, we all call it Hi-OS. You'll be able to get all of those. They have some great manuals out there with pictures, so it walks you through the entire process.
Or hire a compliance firm to help you do it. Or that. Yes. Because HiOS is not the easiest, most user-friendly system in the universe.
It's not, but for the RXDC reporting, it's actually not terrible because the information is going into these templates. The big thing to remember on those is you can't use any punctuation in those, even in the file name, because it will reject for even having a period, comma, an apostrophe. It'll reject it. So always make sure that you're leaving out all those lovely little punctuation things.
No commas, even if they're Oxford commas, you can't use those. Let's move up to that. To CAA 2026. It's funny, people always say the CAA, okay, which CAA?
They're consolidated appropriation acts almost every year. Yes. And so let's let's move up to the most recent one in the CAA 26. It appears to dramatically expand PBM disclosure requirements.
What changed? So the CAA of 2026, it expanded what the pharmacy benefit managers or PBMs must report. And some of this is actually already in place, but some of it's going to be expanded out. So there's a number of provisions in the law that agents and brokers, along with their clients, should know about regarding their PBMs.
There's also another little complicating matter in here, in that there's also some proposed rules that are out there. So there's a few competing things out there. The two main components of the CA of 2026, they're going to go into effect in August of 2028. Those two items are that there's a PBM disclosure requirement and there's also rebate pass-through requirements.
So what should brokers and consultants be paying attention to this right now? Why should why is that important? So not only do brokers have to and consultants have to do their fee disclosures if they're earning in excess of $1,000 per year annually. And that's not just on medical, that also includes dental envision.
But any and every component, if you've got a self-funded client, every component needs to be listed on there. So your third-party administrator, if they have case managers, and this all stems back to the CAA of 2021. So brokers themselves need to do this, but the CAA of 2026 actually expanded that out to make sure that PBMs were specifically listed. And that as of February 3rd of 2026, which was actually when this was signed into law or enacted, that's when it took effect for the PBMs.
So they did a little bit of an that expansion where all health plan service providers must disclose. And so they made sure that PBMs were in that, because we hear a lot out in the market about it in the broker community, about PBMs, and there there should be all that news out there on them, as well as the pharmaceutical manufacturers, because they both are causing price increases. So a lot of advisors hear that term PBM transparency, which you came close to saying but didn't quite say.
But they think it sounds abstract. What kinds of kind of information is actually going to be disclosed under these new rules? So first, this is only going to be affecting self-funded plans as far as this fee disclosure requirement. And it's also expanding it out to the 100 plus employee market where employers of that size can or can opt into the full disclosure.
Otherwise, they would just get a summary disclosure. And that's going to be on fully insured groups, self-funded groups, any funding arrangement that's out there. And then also groups of all sizes. So even your small groups, as long as they're a single employer plan.
So no multi-employer, so no unions, no collective bargaining agreement plans, none of those are subject to this. But single employer plans would be entitled to get a summary disclosure, as would the participants and the beneficiaries. And this reporting is going to need to be received no less than twice per year, but can be request requested to be at least quarterly. So what this reporting is, you know, basically going to get a lot of those numbers out to even the planned participants and beneficiaries.
So I would ring some some warning bells there. We've seen a lot of lawsuits, of course. And this is potentially going to cause more of those. Brokers are in jeopardy, too.
It's not like the JJ suit where anybody who read that pretty much knew that the brokers who were named were going to get tossed out immediately. Now it's a different ballgame, isn't it? Yes, absolutely. And it's they're also extending out this reporting on the PBMs.
So it's not just what's the comp, it's much more dramatic. Rebates, pharmacy payments, spread pricing, all of the above. Yes, plus PBM payments to the pharmacies. So that's gonna fall under fees or potentially excessive fees because those are typically done by contract.
It's gonna need to be the listing of the covered drugs and compensation paid by the plan to the PBM. It's also gonna look at the difference between those categories of compensation. So not only that, but of course, as you mentioned, drug pricing, which is gonna include the wholesale acquisition cost, the average wholesale price, and the net price per cost of treatment, the total net spending, total number of claims and amounts paid out of pocket by the participants themselves.
So it's a huge expansion of what needs to be in there and also any manufacturer payments. So I think that will be interesting in the mix to see, okay, how much are the manufacturers helping with their assistance programs? So we've been talking about transparency in earnest since 2021, and it's just now starting to happen, at least in the PBM space. A couple other questions.
I just want to make sure that we're really clear. Is there a difference between you touched on this earlier, is there a difference between fully insured and self-funded plans? Yes. So self-funded plans would be getting a detailed reporting, and that's specifically required under the law.
For groups of a hundred plus, they can opt into that detailed reporting. But if they don't, basically they don't demand it. They would then just get a summary reporting, which would also be for, and that's going to be for fully and fully insured, self-funded, level funded, any other combination out there, however you want to call the funding arrangement, even captives, anything with that PBM in there. But the smaller groups would be getting the summary only.
They don't have the option to get the details. So we touched on this a bit ago. We've started seeing lawsuits from plan participants over excessive plan costs. How much additional fiduciary exposure does this create for employers?
So we're used to seeing that $100 per day, quote unquote, penalty that we see with so many items, such as not getting Cobra notices out in time or certain other per day penalties for things. The non-disclosure provisions under the CAA of 2026 will be $10,000 per day. Out of the yeah, which, yeah, that's a major out. You go a couple of days.
Now, this is something where this is going on the PBM. It's not on the employer. It is on the PBM to get this out. So I think it was basically the carrot and the stick, and this is where the stick lands.
Or RIFS has been hanging around since 75, but no, it's amazing that we still find employers who don't really understand that they're acting as planned fiduciaries. Do you see that a lot? Well, yes. Every day with all of the different things that they're supposed to do.
Like we, of course, fiduciaries, this goes way, way back in history. And it's basically, and when you look at corporate structures, you're even though, yes, we were agents out there in the field, but under the corporate and under the legal terminology, an agent is basically somebody that's acting on behalf of another person, where you're using somebody as a subject matter expert, and they're dealing with other subject matter experts because you're not, you, Mr. Business Owner, aren't the subject matter expert in this field.
So this goes way, way back, actually. Just cover this in a doctorate course on the history of fiduciary. So it was fascinating reading some of that history and knowing that this is where we have this, and it's all embedded in Orissa, and it's been around since, as you mentioned, back into the 70s. So it's over 50 years old, and employers still don't understand that when they make a decision for any benefits or anybody else in that company, they're not only held liable corporately, so as the company, but individually liable as well.
So if you make a bad decision that's not in the best interest of a planned beneficiary, you could easily land yourself in trouble. One of the things that I know has come up recently is that a number of organizations are starting to come up with education for advisors about ERISA and about the duties of fiduciary in your legal mind, as if I'm an advisor, because nobody is really an agent anymore. It's a term of art more than it is a term of actual law at this point. But if I'm an advisor, how do I draw that line or where do I draw that line between helping a client and becoming a fiduciary or a functional fiduciary myself?
Part of that you can actually, under the CAA provisions of 2021, where brokers are supposed to be providing their disclosure to their clients, there's actually on some of the templates that are out there, there's a spot where you check. I am not considered a planned fiduciary. There's other spots. If if you're acting more on that consulting type arrangement, that could pull you into that fiduciary type responsibility there.
The it's gonna be based on what exactly are you doing? Because agents are at least a party in interest. Because if they're out there looking at the market on behalf of that client as the corporate agent, being the subject matter expert, you have to also basically protect yourself. So make sure that you're doing all of your due diligence.
You also best practice, have it in writing, that you are not a fiduciary and you're not taking on fiduciary responsibilities. You're just presenting all of the different things out there and providing your subject matter expert, I don't want to say opinion, but based on what you know to that employer, they're the ones that are making the decision. I see a day in the not too distant future, not too distant, where a part of any advisor's SOP is going to be getting a statement like that.
Because while if an employee files the suit, they may not be able to name you directly, but you can sure shoot and believe that if a company executive took advice from an advisor, they're going to countersue the advisor. And this is federal court. This isn't like small claims court. This is big bucks.
And this has actually happened. So back just a few months ago, there were four very large employers that were sued over their voluntary benefits offerings. And the main claim under that, they put the brokers in there as fiduciary agents, which, you know, if they're not out doing their due diligence and doing their job, that very well could be the case. Then again, there's also the problems of when you switch from, you know, one carrier to another, are they giving you bonuses, first-year commissions all over again because you're moving all of those policies over?
Are they front-loading the comp? There's all kinds of issues there. And with those four cases filed underneath Orissa and Department of Labor oversight, that's gonna be huge to watch these cases as they go forward. So the courts could throw out that the agents are not the fiduciary because they're not really the one making the decision unless they didn't do their job.
But at the very, very least, I think that the courts are gonna find that they're a party at interest and therefore have at least some level of liability within that. So it's always best to review that to make sure that you're not running afoul of any of those laws. Scary times. Let's go back to the regs for a little bit for some of the compliance.
It's hard to imagine this far down the road, but we're also seeing increased ACA employer mandate penalties, especially involving 1094 and 1095 reporting. You would think that this would be a matter of ancient history, relatively speaking. Why is this happening now? I wish I had an answer for that.
So, in a compliance role, I get questions from brokers all the time. And there are some times when you just wonder, okay, the question comes out from them, how long has this been required? And I have to honestly answer, 2015. You kind of wonder, okay, have they been hiding in a cave?
Because this is something that it's made all the news. It this is not something that it's not going away. As some did think that when the individual penalty went away, that also affected the employers. But that part of the law was never, even the individual penalty technically was not repealed.
It was only the penalty was zeroed out. Congress could bring it back at any time. So it's, I think it's another one of those disconnect spots where they did this, therefore you can't assume that, not with statutes. So let's talk about one of the things that may be the most challenging and confusing in the compliance universe, and that's mental health parity enforcement.
There's been a lot of yakking that the DOL may pause mental health parity enforcement. What does it actually mean in practice? Does it mean that employers can now safely ignore the MAPIA comparative analysis requirements? No.
The DOL has actually come out with their penalty or their enforcement priorities. And they have basically stated that they are putting a pause on enforcement for the Mental Health Parity and Addiction Equity Act or MAPEA, as because we live in acronym and alphabet soup world here. But that pause is temporary. So they're looking again at some of that reporting that has been in place now for several years.
And this is for every plan out there. Now, if you're fully insured, those fully insured carriers are the ones that have to do this. If you're level funded and using a carrier, they're likely following those same claim protocols, how they process everything, how they look at everything, which means That the those employers should really be getting that from still that carrier. But those self-funded plans out there, they have still got to be doing this report because the DOL could tomorrow say, okay, we're now back to enforcing.
And if you have not done your job as a fiduciary and gone and done this comparative analysis report and where it's defendable, then that's still a failure and can trigger an audit, corrective action plans, as well as excise tax exposure. So always a good thing, even though they may be pausing the enforcement, you still need to do the right thing. It's still a requirement. So just do it.
As we wrap up here, let's touch a little bit on the No Surprises Act, because we've had a guest on talking about how that's an opportunity for folks to create billing hassles and a lucrative opportunity for some folks who want to play those games. What's happening in independent dispute resolution right now? Is that getting ironed out or is that still a problem? It's actually still a problem.
So there's been, number one, a bunch of lawsuits on that process. I do know that from going up to DC every year for the last number of years. Yeah. It's been a while.
Let's just say back to the late O's. The aughts, as the British call them. A number of times going up to DC, tracing through the halls. There was a lot of states that had already passed balanced billing laws or no surprise laws at the state level.
And they'd all used a different mechanism for ironing out those differences. Florida, for an example, it's what they would pay an in-network provider, what they would pay, they would have paid Medicare, or what they would have paid under Medicaid. Those are your three options. So there's not this, our services are worth more because who we are.
That does not come into play when you're dealing with some of the state laws. But the federal, they basically were forcing this arbitration, for lack of a better term, in this IDR process. And because of that, we're seeing a lot of abuses happening there. And it's also somewhat of an issue because, of course, we're seeing claims, we're seeing premiums go up, we're seeing claim amounts go up.
And there's a few providers out there that are actually basically, for lack of a better term, they're gaming the system. That's what we were talking about. Yeah. With that, they're creating problems for these plans.
And those costs are getting passed along to the consumers. And it's sad that what's driving this is uh, I want to say it was 80% providers, 20% facilities out of 99.9%. So out of all of the IDR process or hey, we want more money, 99.
9% of the time, it is being filed by a provider or facility. Providers 80%, facilities 20%.1% is being filed by an insurance carrier. It's not the carriers that are the problem.
When you look at this, where there's basically four private equity-backed providers, and some of these IDR middlemen that are because some of those settlements, that middlemen gets more money, then that's what's causing them to be able to get three to nine times the market rate. It's like they teach you in law school, right? Look at who benefits. Yes.
Yeah, it's always follow the money. Anything related to DC or any state capital, city councils, wherever. Doesn't matter. Always follow the money.
So wrapping up here, when you step back and look at all of these compliance developments together, what should benefits advisors be telling their employer clients right now that maybe they're not here in any place else? It would definitely be best to make sure that you run through some type of audit checklist to make sure that an employer has all of the items that they need to know in a concise document. Make sure that you're reminding them when some of these deadlines are happening.
So like a 1094, 1095, those date all the way back to January 3st in some cases. And of course, then you've also got state laws on top of it. So if you're selling to a company, it's your responsibility as an agent to know the laws in that state. So definitely something that you have to look at both federal and state laws and make sure that all of these filings are getting done because when we start seeing some of these fines coming in, each of them are separate.
So if you're breaking something under the ACA and ERISA, you get fined under the ACA and ERISA separately. Those numbers can add up very quickly. And it's something that employers just need to be very careful and make sure that they're working with an agent that's doing their due diligence and making sure that they're helping them stay in compliance with all the different laws. And advisors should check their EL coverage.
Absolutely, because those don't cover everything. One of the best things there is to look at an agency policy, because with those, you can typically get things added in there. So if you do HR consulting, you can add that into an agency policy where most individual policies out there don't cover some of these other things. Great advice, as always, Carol Taylor, compliance specialist at CRC Benefits.
Carol, thanks so much for helping to square some of this away for us. I appreciate it. We'll chat again soon. I'll bet we will.
The Shift Shapers Podcast is a production of Shift Shaper strategies and may not be reproduced or quoted in whole or in part without our express written permission. Copyright 2020, all rights reserved.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.