Locke Lord QuickStudy: NY DFS Expands Regulation of ‎Pharmacy Benefit Managers While ERISA ‎Preemption Remains ‎Uncertain

In the final days of October, the New York Department of Financial Services (“DFS) published new regulations regarding assessing, licensing, and recordkeeping for pharmacy benefit managers (“PBM”) while revising existing regulations pertaining to PBMs. DFS also released guidance^[1] on the license application process. In its response to public comments, DFS asserted its actions are neither preempted by the Employee Retirement Income Security Act (“ERISA”) nor does regulation by the Centers for Medicare and Medicaid Services (“CMS”) fully occupy the field.

PBMs operating in New York State must be licensed by DFS by January 1, 2024. In recognition of the short amount of time available for PBMs to become licensed before the January 1 deadline, PBMs that submit a full application on or before December 31, 2023, including the nonrefundable $24,000 application fee, will be considered compliant. The applicant’s license will be deemed retroactively effective until the license is issued or five (5) days after the application is rejected.

The new provisions significantly increase documentary and informational materials PBMs must submit to DFS, such as contracts, financials, governance, and ownership structure. Companies applying for licensure must also certify their compliance with DFS’s cybersecurity regulation (Part 500).

Background

On December 31, 2021, Governor Hochul signed SB 3762 adding new provisions to the New York Insurance Law and Public Health Law^[2] asserting regulatory authority over PBMs and imposing registration and licensing requirements per regulations to be developed by DFS.^[3] In 2022,^[4] DFS amended Part 450 (Regulation 219) regarding the Pharmacy Benefits Bureau within DFS while also promulgating a new Part 451 (Insurance Regulation 221) imposing upon PBMs operating in New York State registration and annual report filings;^[5] while also issuing industry guidance^[6] on the registration and annual report requirements.^[7] In March 2023, DFS amended Section 451.3 on an emergency basis extending the effective date for mandated filing requirements^[8] until January 1, 2024, in line with the current consolidated rulemaking.^[9]

In recent years, all 50 states have taken some action pertaining to PBMs. Currently, a majority of states require registration and/or licensing. Much of this activity followed the Supreme Court’s 2020 ruling in Rutledge v. Pharmaceutical Care Management Association.^[10] Additional action in more states is anticipated alongside likely challenges in federal court.

ERISA Preemption

As part of the final adoption of the consolidated rulemaking, DFS addressed public comments received on the proposed rulemaking. Multiple commenters asserted federal preemption under ERISA or on the grounds that CMS has fully occupied the field, especially as pertains to Medicare Part D plans. DFS rejected these claims citing “current case law and the position of the federal government.”^[11] Presumably, DFS is referencing the United States Supreme Court’s December 2020 ruling in Rutledge v. Pharmaceutical Care Management Association,^[12] finding that ERISA did not preempt an Arkansas state law that regulated reimbursement rates paid by PBMs to pharmacies for drugs covered by prescription drug plans. Justice Sotomayor, writing for a unanimous^[13] court, explained that “ERISA does not pre-empt state rate regulations that merely increase costs or alter incentives for ERISA plans without forcing plans to adopt any particular scheme of substantive coverage.” Since the Rutledge decision, two federal appeals courts have also weighed in. The Eighth Circuit^[14] upheld PBM regulation by North Dakota while the Tenth Circuit^[15] ruled that ERISA preempts states seeking to regulate pricing and network structures as attempting to regulate central matters of plan administration.^[16]

It should be noted that DFS did strike a proposed requirement relating to Medicare Part D plans that a commenter claimed violated CMS requirements and the non-interference clause. While DFS removed this provision from the final regulation, it stated that it “may revisit this requirement at a later date.” The boundaries of ERISA preemption in this space remain uncertain.

New Regulations

The consolidated rulemaking adopted a second amendment to the preexisting Part 450 (Insurance Regulation 219),^[17] adding new definitions applicable to all related regulations concerning PBMs, while adding new Parts 453 (Insurance Regulation 223), 454 (Insurance Regulation 224), and 455 (Insurance Regulation 225), pertaining to assessments, licensure, and record keeping respectively.

Part 453 (Insurance Regulation 223)

This new regulation imposes on PBMs assessment processes comparable to those currently in force with other DFS licensees in the banking, insurance, and virtual currency industries.

Part 454 (Insurance Regulation 224)

This new regulation confirms that PBMs are covered entities under Part 500 (cybersecurity) and must certify compliance annually upon application for licensure. However, the bulk of Regulation 224 pertains to licensure requirements above and beyond the previous registration requirements under Regulation 221. The application fee is $24,000 for a three (3) year period. The application requires PBMs to provide (i) officers, directors, and ownership information, including a detailed organization chart “continuing up to parent companies that own 10% or more of the pharmacy benefit manager and down to subsidiary companies until no party owns 10% or more of the subsidiary company,” (ii) total number of adjudicated claims, as well as (iii) lists of all health plans, manufacturers, pharmacies, pharmacy services administrative organizations (“PSAO”), rebate aggregators, switch companies, and wholesalers^[18] with which the PBM contracts. PBMs are obligated to notify DFS, in writing, within 30 days, “of a change in any of the information or documents required to be disclosed on the pharmacy benefit manager’s license application.”

Part 455 (Insurance Regulation 225)

This new regulation imposes record keeping requirements, including a mandate to establish and maintain a records retention plan, including “safeguards established to prevent alteration of the records.” Such plan shall be provided to the Superintendent upon request and the PBM shall certify the accuracy of any records provided in accordance with the record retention plan. This regulation further establishes retention periods for select documents:

1. Two (2) years following the date a request for documents by a health plan is received per Part 452 (Insurance Regulation 222); 
   
   
2. Five (5) years for audited financial statements; and  
   
   
3. At least one (1) year following a denial of appeal by a pharmacy or PSAO per Public Health Law Section 280-a(4)(e).

PBMs have fifteen (15) business days to produce any of the above documents to DFS upon written request – extensions “will only be provided upon a showing of good cause.”

Conclusion

All states have taken some action in the PBM space, dozens require PBMs to register or license with relevant state authorities, while additional states also regulate pharmacy reimbursement rates and network adequacy. Many states appear to have been emboldened following the Supreme Court’s ruling in Rutledge. It remains to be seen how far that ruling cuts as federal appeals courts have since issued mixed rulings. As states continue to pass legislation and issue regulations, litigants can be expected to continue to seek relief in federal courts. The Supreme Court may need to step back into the fray sooner rather than later.