THE OTHER REGULATOR
Every 340B headline names four players. The fifth one enforces ERISA.
There are four players in every 340B headline.
Manufacturers.
Covered entities.
Contract pharmacies.
HRSA.Three of them are at war with each other.
The fourth has issued exactly one binding regulation in three decades.There is a fifth player.
The fifth player has the statute, has the authority, has the enforcement record, and has not yet been asked the question.
This article is the question.
IN TODAY’S ARTICLE:
Why the four-player map is missing a regulator, and why that omission is the entire game
The four ERISA hooks that already reach the 340B spread on every commercial claim
The five companies that sit on multiple sides of the same transaction, and the disclosure column that does not appear in any of their 408(b)(2) filings
What the courts have already said, what the cases now in federal court are testing, and what the agency that has not yet acted can do without new law
Glossary at the bottom of today’s article.
THE MAP IS MISSING A REGULATOR
The Quiet $81 Billion laid out the four players in every 340B headline.
Manufacturers.
Covered entities.
Contract pharmacies.
HRSA.
That map is correct. It is also incomplete.
The map describes the upstream half of the program.
The relationship between the manufacturer and the covered entity. The price. The discount. The dispensing arrangement. The audit posture. HRSA enforces that side, with the regulatory ambition of an agency that has issued one binding rule since 1992 and treated everything else as guidance.
The downstream half of the program does not appear on the map.
The downstream half, what happens after the drug leaves the pharmacy and reaches patients with commercial insurance or employer coverage, remains unaddressed on the current map.
The downstream half is what happens after the 340B-acquired drug is dispensed to a patient who is not a Medicaid beneficiary. The patient with commercial insurance. The patient on the self-funded employer plan.
The plan that paid full negotiated rate for a drug acquired at the ceiling price. The spread that was retained by parties affiliated with the entity that adjudicated the claim.
That half of the program has no regulator on the four-player map.
It has a regulator on the actual federal organizational chart.
The regulator is the Department of Labor. The agency inside Labor is the Employee Benefits Security Administration. EBSA. The statute it enforces is the Employee Retirement Income Security Act of 1974. ERISA. The reach of that statute, on the conduct described in the rest of this article, is the entire downstream half of the program.
There is no statutory amendment required to bring it into the picture.
There is one regulatory act required.
The act is asking.
ROUGHLY 65 PERCENT
Roughly 65% of Americans with employer-sponsored coverage are in a self-funded plan.
That figure is the population this article is about.
A self-funded plan is a plan in which the employer assumes the financial risk for claims rather than purchasing insurance from a carrier. The employer hires a third-party administrator to process claims, manage the network, and handle the back office.
The TPA is usually a subsidiary of one of the major insurance carriers.
Aetna.
Anthem.
Blue Cross Blue Shield
Cigna.
United Healthcare.
The same carrier that sells fully-insured products in the same market also sells administrative services to self-funded plans in the same market, often using the same network, the same claims platform, and the same affiliated PBM.
Every self-funded plan in America is governed by ERISA.
Every self-funded plan in America has a fiduciary.
The plan sponsor is a fiduciary.
The trustee is a fiduciary.
The committee that selected the TPA is a fiduciary.
The TPA, when it exercises discretion over plan assets, is a fiduciary, whether the contract calls it one or not.
Every self-funded plan in America has paid for at least some 340B-acquired drugs in the last twelve months.
Almost none of them have received a disclosure that says so.
That is the gap in disclosure and oversight.
That, precisely, is the kind of conduct ERISA already reaches and governs.
THE FOUR HOOKS
ERISA reaches the conduct through four sections. Each section is a separate cause of action.
Section 404. The Duty of Loyalty and Prudence.
Every plan fiduciary discharges duties solely in the interest of plan participants and beneficiaries. The fiduciary acts with the care, skill, prudence, and diligence of a prudent person familiar with such matters.
The plan sponsor is a fiduciary. The TPA is a fiduciary when it exercises discretion. The standard is functional. The contract cannot opt the fiduciary out.
Section 406. Prohibited Transactions.
A fiduciary cannot cause the plan to engage in a transaction that constitutes a transfer of plan assets to a party in interest. A fiduciary cannot deal with plan assets in the fiduciary’s own interest.
When a TPA decides what the plan pays a pharmacy for a 340B-acquired drug, and the spread on that claim flows to the TPA’s affiliated PBM, the transaction has a party in interest, a transfer of plan assets, and a fiduciary’s interest. Three out of three.
Section 408(b)(2). Service Provider Compensation Disclosure.
A service provider must disclose all direct and indirect compensation received in connection with the services. The Consolidated Appropriations Act of 2021 amended this section to extend the obligation explicitly to brokers, consultants, and service providers to group health plans. Effective December 27, 2021.
Indirect compensation includes float. It includes spread. It includes any payment received from any third party in connection with the services.
The PBM’s retention of spread on a 340B-acquired drug, dispensed through a contract pharmacy administered by the PBM, on a claim adjudicated by the PBM, is indirect compensation in connection with the PBM’s services to the plan.
The PBM is required to disclose it.
Section 502. Civil Enforcement.
Plan participants and beneficiaries can sue. The Department of Labor can sue. Recovery includes losses to the plan, equitable relief, and attorney’s fees.
Four sections.
One statute.
One conduct.
One enforcement structure.
The conduct is the retention of compensation that the statute requires to be disclosed.
The disclosure has not been made.
That is the cause of action.
FIVE COMPANIES, ONE PARENT
The contract pharmacy economy is not distributed.
It is concentrated.
The top five companies controlled 76.1% of all 340B contract pharmacy relationships in the United States as of 2025.
Those five are CVS Health, Walgreens, Cigna, UnitedHealth Group, and Walmart.
CVS Health owns CVS Caremark, the country’s largest PBM. CVS Health operates the country’s largest retail pharmacy chain. CVS Health owns Aetna, a major TPA to self-funded employer plans.
CVS Health is therefore on four sides of one transaction whenever a 340B-acquired drug is dispensed to a plan member through a CVS retail pharmacy that holds a contract pharmacy arrangement with a covered entity, on a claim adjudicated by Caremark, paid by a self-funded plan administered by Aetna.
Cigna owns Express Scripts, the second-largest PBM in the country.
Cigna is a TPA.
Cigna is a carrier.
UnitedHealth Group owns OptumRx, the third-largest PBM.
UnitedHealth Group owns United Healthcare, a TPA and a carrier.
UnitedHealth Group also owns specialty and retail pharmacy operations.
Three of the five top contract pharmacy operators are vertically integrated insurance carriers that also adjudicate the claim, also administer the contract pharmacy program, also receive the rebate, also retain the spread, and also act as service provider to the plan that paid for the drug.
Same parent company.
Multiple sides of one transaction.
Each side generates compensation.
Each compensation flows back to the parent.
The Senate HELP Committee documented one slice of the conduct in its April 2025 report. CVS Health charges insured patients dispensing fees as high as $44 per prescription for brand-name drugs. CVS Health charges uninsured patients $5 for the same dispensing service.
The patient with insurance pays nine times more than the patient without.
The plan absorbs the difference.
The disclosure does not name the asymmetry. The disclosure does not name the spread. The disclosure does not name the related-party flow.
The disclosure was not made.
The carriers know which agency reads this work.
Their lobbyists have spent the last six months making sure their disclosures are clean. Yours are not.
WHAT THE COURTS HAVE ALREADY SAID
The carriers spend more money fighting the functional fiduciary question than any other ERISA issue of the last decade.
The reason is mechanical.
If a TPA is a functional fiduciary, the TPA is personally liable. Not the plan. Not the employer. The TPA, with its own balance sheet on the line for losses to the plan, with its own executives subject to ERISA Section 502 personal liability, with its own corporate insurance unable to indemnify against the breach.
The doctrine predates the 340B contract pharmacy economy.
In 2014, the Sixth Circuit decided Hi-Lex Controls, Inc. v. Blue Cross Blue Shield of Michigan. BCBS Michigan administered the Hi-Lex self-funded plan. BCBS Michigan added hidden fees to claims that increased what the plan paid. BCBS Michigan retained the fees and never disclosed them.
The plan sponsor sued.
The Sixth Circuit found that BCBS Michigan was a functional fiduciary because it exercised discretion over plan assets in setting and retaining the hidden fees. The verdict was upheld. BCBS Michigan paid restitution to the plan.
The Hi-Lex fact pattern is the 340B fact pattern.
The TPA exercises discretion over what the plan pays for a pharmacy claim. The TPA’s affiliated PBM retains the spread on the back end. The plan sponsor was not told.
The cases now testing the theory in federal court are Lewandowski v. Johnson & Johnson, filed in the District of New Jersey on February 5, 2024, and Navarro v. Wells Fargo, filed in the District of Minnesota on July 30, 2024.
Both name the plan sponsor’s own fiduciary committee as defendants. Both name the PBM. Both allege ERISA Section 404 breach for failing to monitor pharmacy benefit arrangements. Both allege the plan paid excessive prices for prescription drugs that included undisclosed compensation flows to affiliated parties.
Both cases were dismissed at the trial court level. Both are now on appeal. The Third Circuit will rule on Lewandowski. The Eighth Circuit will rule on Navarro. Two circuits, two opinions, one fiduciary theory.
That is the legal posture pharmaceutical benefit fiduciary breach has been waiting for.
The carriers are not waiting for the opinions.
The carriers are restructuring their disclosures right now.
You are not seeing those restructured disclosures.
THE COLUMN THAT IS MISSING
Pull the 408(b)(2) disclosure your TPA and PBM provided to your plan last year.
The disclosure has columns. Direct compensation. Indirect compensation. Compensation received from third parties. Compensation in the form of float. Compensation in the form of rebates. Compensation in the form of network rental fees.
Find the column that says “compensation received in connection with 340B-acquired drugs dispensed through contract pharmacy arrangements.”
You will not find it.
There is no column.
That is not because the compensation does not exist. It is because the PBM has determined, internally and without your knowledge, that 340B spread is not 408(b)(2)-disclosable compensation.
The PBM did not ask you.
The PBM did not file an interpretation request with EBSA. The PBM made the call alone, applied it across every plan it administers, and bet that no plan sponsor would ever ask the question.
Most plan sponsors have not asked the question because they do not know how.
That is the engineering of the conduct. The disclosure regime in which the conduct need not be disclosed because the disclosure has been pre-decided in the carrier’s favor.
That works only as long as nobody with enforcement authority asks.
THE OTHER REGULATOR
EBSA sits inside the Department of Labor.
It enforces ERISA.
Every section of it.
Every regulated entity under it.
Every self-funded health plan in the United States.
EBSA has the authority to interpret 408(b)(2) and to issue guidance on what constitutes indirect compensation. The agency issued a Field Assistance Bulletin in December 2021 establishing temporary enforcement policy on the new health plan disclosure requirements. The interpretive infrastructure exists. The enforcement machinery exists. The career staff exists.
EBSA has the authority to investigate plan fiduciaries and service providers. Its enforcement program has produced restitution to ERISA plans and participants in the billions of dollars over the last two decades, almost entirely on the retirement plan side.
EBSA has the authority to sue in federal court for ERISA violations. Section 502 gives the Secretary of Labor a private right of action. The agency’s litigation track record is established.
EBSA has the authority to refer criminal cases to the Department of Justice when the conduct rises to that level.
EBSA has the authority to require corrective action and restitution to the plan.
EBSA does not need new statutory authority to act on the conduct described in this article. The statute is ERISA. The amendment is the Consolidated Appropriations Act of 2021. The interpretive question is whether 340B-related compensation flows that have not been disclosed under 408(b)(2) constitute violations of the disclosure obligation.
That is a question EBSA has the authority to answer.
That is a question EBSA has not yet been formally asked.The answer, when it arrives, reaches every PBM, every TPA, and every carrier-affiliated dispensing arrangement in the United States.
The PBMs know this.
The carriers know this.
Their lobbyists are working hard right now to make sure EBSA does not turn the page on which the question has been written.
You can find out what your TPA actually retained, in the form of a discovery request your lawyer files Monday.
Or you can find out two years from now, in the form of a complaint your employees file Friday.
WHAT THIS TRACK COVERS
The Quiet $81 Billion is the primer for the manufacturer-versus-hospital war. Its parts walk through the rebate revolution, the astroturf operation, the Maine stay, and the IRA collision.
This is the primer for a different war.
The war on the downstream half of the program. The war that has not yet been declared in public, but is being prepared in the carriers’ compliance departments, in the plaintiffs’ bar, and in the docket of three federal courts.
This track covers four parts:
Part 1: The Functional Fiduciary Doctrine. Hi-Lex Controls and the question the carriers do not want answered. The Sixth Circuit’s 2014 reasoning applied line-by-line to the 340B fact pattern. The personal liability exposure for TPA executives. The reason the carriers spend more money on this issue than any other ERISA question of the decade.
Part 2: 408(b)(2) After the CAA. What Section 202 of the Consolidated Appropriations Act of 2021 actually changed. What “indirect compensation” actually means in the regulatory text. What the PBMs disclosed and what they did not. The interpretive question EBSA has the authority to answer.
Part 3: The Lewandowski Theory. Lewandowski v. Johnson & Johnson. Navarro v. Wells Fargo. The complaints, the trial-court rulings, the appeals in motion, the precedent that follows. The plan sponsors named as defendants alongside the PBMs.
Part 4: The Plan Sponsor Playbook. The questions a fiduciary asks the TPA, the PBM, the contract pharmacy administrator, and the broker. The contract amendments at renewal. The audit rights. The documentation that goes in the file. The structural alternatives for fiduciaries who want the duty done right the first time.
The four-player map is missing a regulator.
The map can be redrawn.
The system is not broken. It is working exactly as designed.
The design has a statute that reaches it.
The statute has a section number, an enforcement agency, and a private right of action.The plan sponsor has a duty to use them.
Disclosure.
I am the plan sponsor of a self-funded employer health plan. I sit under the same ERISA Section 404 duty every plan sponsor described in this article sits under.
I have asked the TPA, the PBM, and the consultants the questions this article tells you to ask. I have read the 408(b)(2) disclosures my plan was given.
I have looked for the column that does not exist. The conclusions in this piece are the conclusions an operator reaches when the disclosures come back the way mine came back.
The reason I am writing about it is the same reason I asked the questions in the first place.
The duty does not pause.
-Rojas out.
SOURCES
ERISA, 29 U.S.C. §§ 1001 et seq.
ERISA Section 3(21), 29 U.S.C. § 1002(21).
ERISA Section 404, 29 U.S.C. § 1104.
ERISA Section 406, 29 U.S.C. § 1106.
ERISA Section 408(b)(2), 29 U.S.C. § 1108(b)(2).
ERISA Section 502, 29 U.S.C. § 1132.
Consolidated Appropriations Act of 2021, Pub. L. No. 116-260, Section 202.
Hi-Lex Controls, Inc. v. Blue Cross Blue Shield of Michigan, 751 F.3d 740 (6th Cir. 2014).
Tibble v. Edison International, 575 U.S. 523 (2015).
Lewandowski v. Johnson & Johnson, No. 3:24-cv-00671 (D.N.J. filed February 5, 2024). Dismissed without prejudice January 2025; appeal pending in the Third Circuit.
Navarro v. Wells Fargo & Co., No. 0:24-cv-03043 (D. Minn. filed July 30, 2024). Motion to dismiss ruled on March 3, 2026; Notice of Appeal filed April 1, 2026 (Eighth Circuit).
U.S. Department of Labor, EBSA. Field Assistance Bulletin 2021-03: Temporary Enforcement Policy on Service Provider Disclosures Under ERISA Section 408(b)(2). December 30, 2021.
U.S. Senate HELP Committee, Office of Senator Bill Cassidy, Chair. Congress Must Act to Bring Needed Reforms to the 340B Drug Pricing Program. April 24, 2025. (CVS Health $44 / $5 dispensing fee asymmetry.)
Drug Channels Institute. The 340B Contract Pharmacy Market in 2025: Big Chains and PBMs Tighten Their Grip. June 10, 2025. (Top five contract pharmacy concentration at 76.1%.)
HRSA Office of Pharmacy Affairs. 2024 340B Covered Entity Purchases Data. December 2024.
Manus AI. The 340B Drug Pricing Program: A Comprehensive Deep-Dive Report. March 2024.
Kaiser Family Foundation. 2024 Employer Health Benefits Survey. (Self-funded plan prevalence in employer coverage market.)
Dutch, can you explain how 340B which is provided for rural hospitals to subsidizes them gets to the big chain pharmacies?
I always assumed only dispensing from hospital entities themselves was how this program ran.