Section 201 of the Consolidated Appropriations Act,2021 (CAA-21) requires Plans and Issuers to attest each year by December 31st that they do not have any agreements with prohibited “gag clauses.” In preparation, employers should start confirming whether their health plan providers and service agreements contain any prohibited gag clauses, document any requests to remove prohibited gag clauses that exist, and verify whether the online attestation will be completed by a third party or by the employer.
Applies To:
All-sized employers with fully insured and self-funded medical plans.
Who is Exempt:
- Plans consisting of only excepted benefits.
- Health reimbursement arrangements (HRAs) and individual coverage HRAs (ICHRAs) are not required to attest as these plans do not typically need to enter into agreement with medical providers. Instead, these arrangements are usually integrated with other medical coverage that is required to submit an attestation (e.g., HRAs integrated with group health plan and ICHRAs with individual medical coverage).
Otherwise, all group health plans regardless of size, funding strategy or grandfathered status must submit the required attestation (or arrange to have the attestation performed on their behalf).
Go Deeper:
What is a gag clause and what is prohibited?
The CAA-21 prohibits group health plans and insurance carriers from entering into agreements with providers, insurance carriers, third-party administrators (TPAs), or other service providers whose agreements include language that would constitute a “gag clause,” specifically:
- restrictions on the disclosure of provider-specific cost or quality of care information or data to referring providers, the employer plan sponsor, participants, beneficiaries, or enrollees, or individuals eligible to become participants, beneficiaries, or enrollees of the plan or coverage;
- restrictions on electronic access to de-identified claims and encounter information or data for each participant, beneficiary, or enrollee upon request and consistent with the privacy regulations promulgated pursuant to section 246(c) of HIPAA, GINA, and the ADA; and
- restrictions on sharing information or data described in (1) and (2), or directing that such information or data be shared, with a business associate, as defined in 45 CFR 160.103, consistent with applicable privacy regulations.
For example, if a contract between a TPA and a group health plan states that the plan will pay providers at rates designated as “Point of Service Rates,” but the TPA considers those rates proprietary and therefore includes language in the contract stating that the plan may not disclose the rates to participants, that language prohibiting disclosure is considered a prohibited gag clause, thus not allowed.
As another example, if a contract between a TPA and a plan says that the employer’s access to provider-specific cost and quality of care information is only at the discretion of the TPA, that contractual provision would be considered a prohibited gag clause.
Self-insured employer plan sponsors and fully insured carriers must ensure that their agreements with health care providers, networks or associations of providers, or other service providers offering access to a network of providers do not contain these, or other provisions, that violate the prohibition on gag clauses. However, a health care provider, network or association of providers, or other service provider may place reasonable restrictions on the public disclosure of this information.
What should occur now, in advance of the attestation deadline?
While many insurers and TPAs proactively notify plan sponsors each year that their contracts do not contain prohibited gag clauses, some do not. If such written assurances or certifications have not been received for 2025, employers and advisors are encouraged to reach out to confirm well in advance of the December 31 attestation deadline. In the case that an insurer, TPA, or other service provider contract includes a gag clause, employers and advisors should document all attempts to request their removal.
In addition, employers and advisors need to confirm with carriers, service providers and TPAs what level of assistance will be provided with the attestation process itself.
- Fully insured group health plans: The plan sponsor and the insurance carrier are both required to submit the GCPCA each year by December 31st. However, a fully insured plan sponsor may shift liability to the carrier through a written agreement.
- Self-funded and level-funded plans may satisfy the requirement to provide a GCPCA by entering into a written agreement under which the plan’s service provider(s) (such as a TPA, including an issuer acting as a TPA) will attest on behalf of the employer plan sponsor. However, even if the plan enters into an agreement with the TPA, the legal requirement to remove any gag clauses and provide an attestation rests on the plan sponsor.
A sample outreach may be worded as follows:
- In accordance with Section 201 of the Consolidated Appropriations Act, 2021, we ask that you please confirm that all provider and service contracts in force for any part of 2025 and going forward do NOT include any prohibited gag clauses. If any gag clauses are included, please confirm they are being immediately removed and the date of removal. Finally, we ask that you please confirm whether the gag clause attestation to CMS is a service you provide and, if so, the steps we need to take, if any. If your organization does not submit the attestation on behalf of our Plan, please let us know as soon as possible so that we can make other arrangements.
The responses confirming compliance with these requirements and who must submit the attestation to CMS should be kept on file in case of an audit or dispute.
Next steps for employers:
Documenting your insurers and TPA’s assurances of the extent to which their provider and service contracts are compliant, as well as any attempts to have gag clauses removed, is an important first step. For attestations not handled by the insurer or TPA, the employer can then move on to the attestation process itself as the end of December approaches.
In an FAQ published in January 2025, the federal government stated plans with known gag clauses must ensure the online attestation is submitted by December 31 but can explain their concerns under the “Additional Information” box in Step 3 of the submission. So documenting efforts to remove gag clauses is key since the attestation is required no matter what.
COMMENTS