Overview

Gag Clause Prohibition

The Consolidated Appropriations Act, 2021 (CAA) amended the Employee Retirement Income Security Act (ERISA), the Public Health Services Act (PHSA), and the Internal Revenue Code to prohibit group health plans and health insurance carriers (referred to as “issuers” in the rules) from entering into agreements with providers, TPAs, PBMs or other service providers that include language that would constitute a “gag clause” (i.e., contract provisions that restrict specific data and information that a plan can make available to another party). A gag clause is contractual language that contains any of the following:

• restrictions on the disclosure of provider-specific cost or quality of care information or data to referring providers, the plan sponsor, participants, beneficiaries, or enrollees;
• restrictions on electronic access to de-identified claims and encounter information or data for each participant, beneficiary, or enrollee (consistent with the privacy regulations included in the Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), and the Americans with Disabilities Act (ADA); and
• restrictions on sharing information or data described in (1) and (2) with a business associate (as defined by HIPAA privacy regulations).

Limiting access to de-identified claims data to specific purposes (e.g., audit only), limiting the frequency or scope of access (e.g., only annually), requiring data to be viewed only at the vendor’s facility (no electronic transfer), or making data access subject to vendor discretion or approval are all examples of prohibited restrictions. Even indirect restrictions (e.g., by TPAs or PBMs) may qualify as prohibited gag clauses.

The requirements went into effect on December 27, 2020.

The gag clause prohibition requirements apply to virtually all employer-sponsored health plans, but not excepted benefits, retiree-only plans, or account-based plans (e.g., HRAs).

Gag Clause Attestation

Plans and issuers must annually submit an attestation of compliance with these requirements to the Departments of Labor (DOL), Health and Human Services (HHS), and Treasury (collectively, “the Departments”). The first attestation was due by December 31, 2023 (attesting to compliance for 2021 – 2023). Subsequent attestations are due annually by December 31. Agency guidance indicates that service providers (e.g., carriers or TPAs) may attest on behalf of sponsoring employers. If the service provider indicates a willingness to attest on behalf of the plan, the employer can rely on that attestation. However, if any service provider will not attest on the plan’s behalf, the employer will need to reach out to such service providers and ask them to confirm that no gag clauses are present in the contracts they have entered into on behalf of the plan. Employers cannot do much more than ask for this confirmation since employers generally do not play a role in the contracting and may not have access to all contracts entered into on behalf of the plan.

The attestation requirement is a fairly straightforward process, requiring only some plan identifying information, employer contact information, and a checked box and signature to indicate compliance. This is all done via a website portal.

Gag Clause Attestation Resources

• CMS created a webpage with information about how to comply with the gag clause prohibition as well as how to attest to compliance, which you can find here – Gag Clause Prohibition Compliance Attestation | CMS
• The website for submitting the attestation can be found here – Gag Clause Attestation | Welcome!
• Questions or difficulties with the attestation process can be submitted to – CMS_FEPS@cms.hhs.gov (put GCPCA in the subject line).

Which Plans Must Comply?

The gag clause prohibition and attestation requirements apply to all group health plans, but not excepted benefits (e.g., stand-alone dental or vision, health FSA, EAP), retiree-only plans, or account-based plans (e.g., any type of HRA, including individual coverage HRAs (ICHRAs)). Both fully-insured and self-funded plans are subject to the requirements, as well as grandfathered plans, grandmothered plans, ERISA plans, and non-ERISA plans. Therefore, in addition to group medical plans, telehealth programs and direct primary care arrangements are subject to the requirements. However, employee assistance programs (EAPs) and onsite clinics, which typically qualify as excepted benefits, would not be subject to the requirements.

Each group health plan that is subject to the reporting is considered a “responsible entity” required to comply and attest to compliance. If an employer offers multiple group health plans with separate ERISA plan numbers, the employer must attest for each ERISA plan separately (although a spreadsheet listing each plan separately and providing the information specific to each plan will allow the required information to be provided for each separate ERISA plan within a single attestation). On the other hand, if the employer has bundled its group health plans into a single ERISA plan (with a single ERISA plan number) by use of a WRAP document, then a single attestation can be filed on behalf of the employer’s single ERISA plan.

Beyond the carriers and TPAs involved with the group medical plan, there may be additional service providers that need to be considered as part of the attestation to the extent that they are involved in contracting with providers on behalf of the employer’s group health plan. For example, provider contracts with and coordinated by PBMs, behavioral health vendors (e.g., network agreements for mental health providers), telehealth arrangements, direct primary care arrangements, and other medical providers (e.g., access to preferred pricing for certain procedures if using particular providers) are also prohibited from having gag clauses and should be considered by the employer when attesting to compliance. NOTE: 2025 agency FAQs make clear that the gag clause prohibition extends to downstream agreements (i.e., contracts entered into by a TPA, PBM, or network on behalf of a plan). Even if the plan itself is not a direct party to a restrictive clause, the plan could be noncompliant if its vendors’ subcontracts limit data sharing. Plans are expected to include language in direct contracts requiring vendors not to enter into downstream agreements that would violate the prohibition.

When is the Attestation Due?

The first attestation was due by December 31, 2023 to attest to compliance for 2021 – 2023. Subsequent attestations are due annually by December 31st and should cover the period of time since the plan’s last attestation. For example, if the attestation was last completed November 15, 2025 and the attestation is now being completed on November 2, 2026, the plan must attest to compliance for November 16, 2025 – November 2, 2026.

Who Must Complete the Attestation?

Employers rely primarily on their carrier or TPA to contract with medical providers to provide services to group health plan participants. The Departments recognize this and allow employers to rely on their carrier or TPA to submit the attestation on behalf of their employer-sponsored plans. However, the carrier and/or TPA may not be willing to do so, especially if the employer separately contracts with other service providers on behalf of the group health plan (e.g., pharmacy carve-out with a PBM not managed by the carrier or TPA). When that is the case, the employer may have to attest on behalf of its group health plan, at least for some of its service providers.

Each plan must ensure that every contract tied to its group health coverage (carrier, TPA, PBM, behavioral health vendor, telehealth, etc.) is included in some attestation, whether submitted by the employer, carrier, or another service provider.

Plans and issuers are required to file an attestation each year even if certain vendor agreements remain under review or contain potential gag clauses. Such situations should be disclosed in the attestation form’s “Additional Information” section, along with a description of corrective actions taken.

Fully-Insured Group Health Plans

Carriers are required to submit an attestation regarding the group and individual health plans they offer, so the carrier could agree to attest on the employer’s behalf as well. Many carriers will offer to do so, in which case employers may rely on the carrier to submit the required attestation, but it is recommended that the employer seek assurance from the carrier that the attestation is being submitted on their behalf.

In some cases, the carrier will only attest on its own behalf and not on behalf of the employer as plan sponsor. The carrier may have concerns about attesting on the employer’s behalf without knowing whether there are additional contracts with other service providers not coordinated by the carrier. If the carrier is not willing to attest on the employer’s behalf, or if the employer does have separate contracts in place with other service providers (e.g., PBM or telehealth provider), then the employer will need to attest on behalf of the plan.

Self-Funded Group Health Plans

The TPA and other service providers for a group health plan are not directly subject to the gag clause prohibition or attestation requirements, but such service providers are often directly involved in contracting on behalf of the group health plan and administering the plan accordingly. For this reason, the rules specifically permit the service providers to attest to compliance on behalf of the plan if the employer enters into a written agreement under which the plan’s service provider(s) will submit the required attestation. The Departments point out that if a self-funded plan chooses to enter into such an agreement with the plan’s service provider(s), the legal requirement to provide a timely attestation remains with the employer’s plan. It is certainly possible that the plan’s service providers will agree to attest on behalf of the plan, in which case the employers may rely on such attestation. However, for a self-funded plan, it is perhaps more likely that the employer will need to attest on behalf of the plan, at least for some of its service providers.

Attestation Process

Estimated time to complete the attestation: 15-30 minutes if all information needed for the attestation is available.

Step 1: Identify All Service Providers

Employers should make a list of all service providers in connection with their group health plan during the attestation period (i.e., from the date of the last attestation up through the date of the current attestation).

Step 2: Confirm Attestation/Compliance for all Service Providers

Employers should confirm which service providers will attest on behalf of the plan.

• For any that will do so, the employer can rely on their attestation and should keep documentation or their written agreement to handle the attestation in the employer’s files.
• For any service providers that will not attest on behalf of the employer’s plan(s), the employer should review related contracts to confirm there are no prohibited gag clauses. Alternatively, the employer should reach out to the service providers and ask for written confirmation that the contracts they handle on behalf of the group health plan do not contain any prohibited gag clauses. Such documents should be kept in the employer’s files. The employer will then need to go through the attestation steps set forth below.

Step 3: Website Access

Go to https://hios.cms.gov/HIOS-GCPCA-UI

Obtain Unique Authentication Code

• Click on the phrase “Don’t have a code or forgot yours?”
• Enter an email address and click “Get my unique code” (code will be emailed within 10 minutesor less).

Access Attestation Submission Form

Go back to the home submission page to enter the email address and code and login. NOTE: The authentication code will only provide access for 14 days, after which time it would be necessary to obtain a new code (however, previously entered information tied to the email address will be saved).

Step 4: Complete the Attestation Form

From the Gag Clause Prohibition Compliance Attestation (GCPCA) Dashboard, click on “Start a new submission” or “Start a new Gag Clause Prohibition Compliance Attestation.” Both boxes/links will take you to the same place, allowing you to begin the attestation process.

The attestation form is made up of 5 sections, and the form must be completed sequentially. It is necessary to complete a section and then click “Save and continue” before you can advance to the next section. It is possible to stop mid-process and then return and complete the other sections later by clicking either “Save and exit” at the end of the current section or by clicking “Return to GCPCA dashboard” at the top of the screen. The process can be picked up again at any time by logging in and clicking on the “Submission ID” number on the GCPCA Dashboard.

There are two roles in the attestation process, the “Submitter” and the “Attester”, but both roles could be played by the same individual. The Submitter is responsible for initiating the attestation process via CMS’ website and entering in the required information about the Submitter, the Attester, and the group health plan. The Attester is responsible for reviewing the information entered and signing off on the group health plan’s attestation of compliance with the gag clause prohibition rules. The Attester must have the legal authority to sign for the company (e.g., the person who signs off on the Form 5500 or Form 1094-C). An employer could authorize a third-party to act as the Attester on its behalf.

Submitter Responsibilities

Sections 1 – 3 of the form will be completed by the Submitter. This portion of the form asks for information about the Submitter, the Attester, and about the responsible entity (e.g., employer EIN, group health plan number). Section 4 is a summary of the information provided in Sections 1 – 3 for the Submitter to review.

After confirming that the information entered is correct, the Submitter will either notify the Attester to review and complete the attestation in Section 5; or if the Submitter is also the Attester, the Submitter should move on to the final section and complete the attestation in Section 5.

Attester Responsibilities

The Attester should review the information in Section 4 to confirm accuracy, and then Section 5 must be completed by the Attester (which may be the same individual as the Submitter). This section requires a formal attestation that the information entered is correct along with a signature.

Step 5: Confirm Submission

If the attestation is successfully submitted, the Attester should see a screen indicating the submission was successful along with the date and time. There is an option to download a receipt of the successful submission. It is recommended that the employer download the receipt and keep it in the employer’s files.

Screenshots along with further instructions for each of the 5 sections of the form can be found in Appendix A. FAQs can be found in Appendix B. In addition, you may find the CMS instructions and user manual helpful, both of which can be found on CMS’ main information page and within the gag clause attestation portal.