Spread pricing is simple to describe and, for that reason, simple to ban. A pharmacy benefit manager bills a health plan one amount for a prescription, pays the pharmacy less, and keeps the difference. Iowa Medicaid prohibits it. Ohio, Texas, and other states have moved against it too.
The findings of Iowa State Auditor Rob Sand's investigation, released in June and drawing renewed attention this month, describe what happened next. And the mechanism is worth understanding, because it is a case study in why prohibitions written around a specific transaction tend not to hold.
What the auditor found
Sand's office reviewed three PBMs serving Iowa Medicaid managed care organizations from July 1, 2019 through June 30, 2021. The report found the PBMs used an "effective rate" pricing model that allowed them to recalculate prescription drug payments at the end of the year and recover money previously paid to pharmacies.
For one PBM, those year-end reconciliations totaled approximately $100 million in back-end value over three years. Sand's characterization: this is evidence of spread pricing, which is prohibited under Iowa Medicaid because it can inflate costs for taxpayers, reduce the quality of care, and create financial hardships for pharmacies.
The design flaw the ban exposed
Here is why the mechanism matters more than the dollar figure.
A spread-pricing ban targets a relationship inside a single transaction: what the plan pays versus what the pharmacy receives, on the same claim, at the same moment. Compliance is checkable per claim.
An effective-rate model with annual reconciliation breaks that comparison apart in time. The pharmacy is paid at the point of sale at a rate that looks defensible. Months later, the PBM recalculates against a contracted "effective rate" for the year and claws back the difference. Examine any individual claim and there is no visible spread. The gap between what came in and what stayed out appears only when you aggregate a full year of transactions, and only if you can see both sides of the ledger.
Sand described exactly this: PBMs may be using the same end-run as they use in other states to skirt a ban on pricing that exploits taxpayers, burying the banned practice in unavailable and convoluted data across an entire year.
The general lesson generalizes well beyond pharmacy. A prohibition defined by mechanism, do not charge more than you pay on a claim, can be satisfied while the economics are reproduced through a different mechanism at a different timescale. A prohibition defined by outcome, the payer's total cost must not exceed pharmacy reimbursement plus a disclosed fee, is harder to route around, because it does not care how the money moved. Iowa wrote the first kind.
The failure underneath the failure
The most consequential finding is not the $100 million. It is that the number is a floor of unknown height.
Auditors could not determine the precise financial impact because they were denied access to key financial records and pricing data. Sand said repeated requests were met with claims that the records were proprietary. As he put it, despite repeated requests and negotiation, the PBMs still withheld critical financial information, limiting the scope of the review, meaning we couldn't see everything we needed to evaluate whether spread pricing was happening.
A state auditor examining the expenditure of public Medicaid dollars was told the relevant records were commercially confidential, and that was the end of it.
That is the accountability failure sitting beneath the pricing one. A ban is only as strong as the ability to detect violations, and detection here depends on data held by the regulated party, which can decline to produce it. Whether the true figure is $100 million or several times that is genuinely unknown, and unknowable under the current arrangement.
To Sand's credit, the report is candid about its own limits. He noted it was not a full audit, and that if additional procedures had been carried out, more findings may have been reported. That caveat cuts both directions: the harm may be larger than found, and the findings themselves are based on partial data that the PBMs would presumably characterize differently if the full record were public.
Every layer is jammed simultaneously
What makes Iowa a useful case is that three separate accountability mechanisms are failing at once.
The statutory ban is being circumvented through timing. The audit function is blocked by proprietary-data claims. And the legislative response is enjoined: Iowa's PBM reform law is on hold pending a court challenge, with the state asking the Eighth Circuit in February 2026 to reverse or narrow a district court's preliminary injunction, arguing the blocked provisions are valid exercises of state insurance and commercial regulation authority and that the lower court misapplied ERISA preemption.
ERISA preemption is the recurring obstacle for state PBM regulation nationally, and the Eighth Circuit's ruling will matter well beyond Iowa. But the immediate situation is that a state which banned a practice, audited for it, and legislated further against it currently has an unenforceable ban, an incomplete audit, and a blocked statute.
This is not an Iowa problem
The pattern repeats across states, which is the strongest evidence that it is structural rather than local.
Ohio's audit found PBM spread pricing resulted in its Medicaid program being billed $224 million more than the total paid to pharmacies for actual claims over the course of a year. Texas produced similar findings. Senators Grassley and Wyden asked the HHS Inspector General to conduct a federal-level analysis of PBM practices across state Medicaid programs, citing potential vulnerabilities created by opaque drug pricing practices.
Sand's report adds new insight on the shell game tactics specifically, identifying accounting maneuvers that both obscure the flow of money and evade prohibitions on a practice now outlawed in Iowa and elsewhere. That is the contribution: not that PBMs profit, which was known, but the specific technique by which a ban is satisfied in form while defeated in substance.
Who pays
The costs land in two places. Taxpayers fund Medicaid, so inflated drug spending is public money. And pharmacies absorb the clawbacks directly.
Sand emphasized the effect on independent pharmacies in smaller communities, many of which have closed in recent years, forcing people in rural Iowa to drive farther to fill prescriptions. A retroactive clawback is particularly damaging to a small pharmacy because it arrives after the money has been booked, spent, and used to order inventory. A chain absorbs it across thousands of locations. A single-store rural pharmacy operating on thin margins may not.
What would actually fix it
The report's recommendations are specific and follow directly from the findings: prohibit annual reconciliations, require PBMs to provide auditors with complete payment data, and impose stricter enforcement penalties when PBMs are not following the rules.
The second is the load-bearing one. Banning reconciliations addresses the current technique, and a sufficiently motivated intermediary will find another. Mandatory auditor access to complete payment data addresses the underlying condition that makes every technique viable: the regulated entity controls the evidence of its own compliance. The durable lesson is about how to write the rule. Ban a practice and you get a new practice. Guarantee the ability to see the money and you can keep pace with whatever comes next.