The CAA and Price Transparency: The Compliance Obligations Most Employers Are Ignoring

The Consolidated Appropriations Act of 2021 created the most significant new compliance obligations for self-funded plan sponsors since the ACA. Broker compensation disclosure, prescription drug cost reporting, price comparison tools, mental health parity documentation, and surprise billing protections all apply to self-funded plans. Most small employers sponsoring level funded plans have not implemented these requirements. The penalties are real. Enforcement is ramping up. The compliance gap is widest among the smallest plan sponsors, precisely the employers least equipped to manage regulatory complexity. The CAA obligations represent a structural compliance burden that the level funded industry has not adequately addressed.

Broker and Consultant Compensation Disclosure

#

Section 202 of Division BB requires group health plans to obtain compensation disclosure from brokers and consultants.

The statutory requirement is specific. Group health plans must require brokers and consultants providing services to the plan to disclose all direct and indirect compensation they expect to receive in connection with their services. Direct compensation includes commissions, fees, and payments from the plan or plan sponsor. Indirect compensation includes overrides, bonuses, production incentives, and any other compensation from carriers, TPAs, PBMs, or other service providers related to the plan. The disclosure must identify each service provider, describe the services provided, and itemize the compensation by source.

The scope is broad. Brokerage services, consulting, benefit design recommendations, plan administration referrals, wellness program implementation, pharmacy benefit consulting, and any other services to the plan are covered. The definition captures most relationships between brokers, consultants, and level funded plan sponsors.

The compliance deadline was December 27, 2021 for plan years beginning on or after that date. Plans that have renewed since that date should have received broker and consultant compensation disclosures. Most have not, or have received incomplete disclosures that do not meet the statutory requirements.

The compliance gap is substantial. Many brokers provide some form of compensation disclosure. Fewer provide the complete disclosure the statute requires. The distinction matters. A broker who discloses their commission from the plan sponsor but not their override from the stop loss carrier has not met the statutory requirement. A broker who discloses a general statement that they receive compensation from service providers but does not itemize specific sources has not met the statutory requirement.

Enforcement sits with the plan fiduciary. The employer as fiduciary is responsible for obtaining the disclosure. Failure to obtain it is a fiduciary compliance issue. DOL enforcement activity on this provision is early-stage but increasing. The penalty structure involves ERISA fiduciary breach liability for failure to monitor service provider compensation. An employer who cannot produce broker compensation disclosures when DOL asks has a fiduciary compliance problem.

Prescription Drug Cost Reporting

#

Section 204 of Division BB requires group health plans to submit annual reports on prescription drug costs to the federal agencies.

The requirement is data-intensive. The prescription drug data collection report, known as the RxDC report, must contain information about the 50 most costly drugs by total annual spending, the 50 drugs with the highest year-over-year increase in per-unit cost, total spending on prescription drugs by the plan, total annual spending on drugs by the plan by therapeutic class, the average monthly cost of prescription drug coverage per participant, the percentage of prescription drug costs reimbursed by the plan rather than by members, premium impact of rebates, fees, and administrative costs, and other data elements specified in the reporting instructions.

The reporting mechanics involve multiple parties. The plan sponsor is ultimately responsible for ensuring the report is submitted. The TPA typically collects and aggregates claims data. The PBM provides pharmacy claims data and rebate information. The data must be assembled, formatted according to agency specifications, and submitted through the designated portal. Some TPAs and PBMs have automated this process. Others have not, leaving plan sponsors with a compliance gap they may not know exists.

The filing deadline is June 1 of each year, covering data from the prior calendar year. For plan years that do not align with the calendar year, the instructions specify how to report partial year data. Plans that have not filed required RxDC reports are in violation. The agencies (HHS, DOL, and Treasury) have enforcement authority.

The compliance gap among small level funded plans is large. Many small plan sponsors have not submitted RxDC reports. Some are unaware the requirement exists. Others rely on the TPA to file and have not verified that filing occurred. The TPA may not have the complete pharmacy data from the PBM, particularly rebate information that PBMs have historically treated as proprietary.

The No Surprises Act

#

Title I of Division BB created the No Surprises Act, which took effect January 1, 2022.

The core protections prohibit balance billing for emergency services at out-of-network facilities, prohibit balance billing for non-emergency services at in-network facilities when provided by out-of-network providers (anesthesiologists, radiologists, pathologists, and other ancillary providers who may be out of network at an in-network facility), require good faith cost estimates for uninsured or self-pay individuals, and create an independent dispute resolution process for payment disputes between plans and out-of-network providers.

The application to self-funded plans is direct. The No Surprises Act applies to group health plans, including self-funded plans. ERISA preemption does not shield self-funded plans from these federal requirements. The TPA administers the surprise billing protections operationally: holding the member harmless from balance bills, paying providers at the qualifying payment amount or negotiating through the IDR process, and processing claims according to the Act’s requirements.

The plan sponsor bears ultimate compliance responsibility. If the TPA fails to hold members harmless from improper balance bills, the plan is in violation. If the TPA fails to participate in the IDR process when required, the plan is in violation. The employer as fiduciary must ensure that the TPA is administering the surprise billing protections correctly.

The enforcement pathway includes both federal and state action. CMS and DOL enforce at the federal level. The statute delegates enforcement authority to state attorneys general and state insurance commissioners. This creates a pathway for state regulators to affect self-funded plans that does not depend on overcoming ERISA preemption for state insurance law. The state is enforcing federal law under delegated authority.

Price Comparison Tools

#

Section 114 of Division BB requires group health plans to make price comparison tools available to participants.

The requirement mandates that plans provide a tool allowing members to compare the amount of cost-sharing they would be responsible for paying for items and services by provider. The tool must be available by telephone and on an internet website. It must provide cost-sharing estimates that account for the member’s specific plan design, accrued deductibles, and out-of-pocket maximums.

The compliance deadline phased in from 2023 to 2024. The initial requirements covered 500 shoppable services. The requirement expanded to cover all items and services for plan years beginning on or after January 1, 2024.

The compliance gap among small level funded plans is near-total. Most small self-funded plans do not have price comparison tools meeting the statutory requirements. The TPA may have a provider search function, but that is not the same as a personalized cost-sharing estimator that accounts for the member’s specific plan status. Building such tools requires integration of claims data, eligibility data, provider contract data, and real-time benefit accumulator information. Few TPAs serving the small group market have made this investment.

Enforcement has been limited to date, but the requirement exists. A plan that cannot demonstrate an available price comparison tool meeting the statutory requirements is in violation.

The Compliance Gap and Its Consequences

#

The distance between what the CAA requires and what most small employers have done is substantial across all four domains.

Broker disclosure is partially compliant at best for most small plans. The broker may have provided something. Whether it meets statutory requirements is another question. Most employers have not reviewed what they received against the statutory requirements because they do not know what the requirements are.

RxDC reporting compliance is low among small self-funded plans. Many have not filed. Some filed incomplete reports. Others filed through a TPA that aggregated multiple plans without providing plan-specific data as required.

No Surprises Act administration is largely delegated to TPAs, and TPAs generally handle the operational requirements. But plan-level documentation of policies, member communication requirements, and compliance monitoring may be incomplete.

Price comparison tools meeting statutory requirements are rare among small self-funded plans. The requirement exists. Compliance does not.

The reasons for the gap are structural. Small employers rely on their TPA and broker for compliance guidance. If neither raises the requirement, the employer does not know about it. The CAA requirements took effect in 2022 and after. Industry adoption lags legislative timelines, particularly for small groups where compliance infrastructure is thin. Penalties for non-compliance have been theoretical rather than realized for most small plans. The deterrent effect is limited without enforcement examples that employers see.

The consequences arrive when enforcement arrives. A DOL audit or investigation requests CAA compliance documentation. The plan sponsor who cannot produce broker compensation disclosures, RxDC reports, or price comparison tool access documentation faces fiduciary breach exposure. The penalties are plan-level. The employer as fiduciary is liable, not the TPA or broker. The compliance risk sits with the party least equipped to manage it.

The structural problem is that CAA compliance requires capabilities most small level funded plans do not have. Obtaining complete broker compensation disclosure requires the fiduciary sophistication to demand it. Ensuring RxDC reporting requires data integration across multiple vendors. Providing price comparison tools requires technology investment. The small employer who chose level funded partly for simplicity discovers that the regulatory environment has become more complex, and the TPA may not be providing the compliance support needed to meet it.

What Plan Sponsors Should Have

#

A compliant level funded plan sponsor should have documentation of broker and consultant compensation disclosure that itemizes direct and indirect compensation from all sources, evidence that RxDC reports have been filed for each required reporting period, confirmation that the TPA administers No Surprises Act protections including member harmless provisions and IDR participation, evidence of a price comparison tool meeting statutory requirements available to members, and fiduciary process documentation showing that the plan sponsor reviewed the TPA’s compliance capabilities when selecting the TPA and monitors ongoing compliance.

Most small level funded plan sponsors do not have this documentation. The gap between what exists and what should exist is the compliance exposure. The employer who sponsors a level funded plan without CAA compliance is not saving money on administration. They are borrowing against future enforcement risk.