The Consolidated Appropriations Act, 2021 (CAA) amended the Employee Retirement Income Security Act (ERISA), the Public Health Services Act (PHSA), and the Internal Revenue Code to prohibit group health plans and health insurance carriers (referred to as “issuers” in the rules) from entering into agreements with providers, TPAs, PBMs or other service providers that include language that would constitute a “gag clause” (i.e., contract provisions that restrict specific data and information that a plan can make available to another party). A gag clause is contractual language that contains any of the following:

• restrictions on the disclosure of provider-specific cost or quality of care information or data to referring providers, the plan sponsor, participants, beneficiaries, or enrollees;
• restrictions on electronic access to de-identified claims and encounter information or data for each participant, beneficiary, or enrollee (consistent with the privacy regulations included in the Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), and the Americans with Disabilities Act (ADA); and
• restrictions on sharing information or data described in (1) and (2) with a business associate (as defined by HIPAA privacy regulations).

Limiting access to de-identified claims data to specific purposes (e.g., audit only), limiting the frequency or scope of access (e.g., only annually), requiring data to be viewed only at the vendor’s facility (no electronic transfer), or making data access subject to vendor discretion or approval are all examples of prohibited restrictions. Even indirect restrictions (e.g., by TPAs or PBMs) may qualify as prohibited gag clauses.

The requirements went into effect on December 27, 2020.

The gag clause prohibition requirements apply to virtually all employer-sponsored health plans, but not excepted benefits (e.g., stand-alone dental or vision, health FSA, EAP), retiree-only plans, or account-based plans (e.g., HRAs).

Gag Clause Attestation

Plans and issuers must annually submit an attestation of compliance with these requirements to the Departments of Labor (DOL), Health and Human Services (HHS), and Treasury (collectively, “the Departments”). The first attestation was due by December 31, 2023 (attesting to compliance for 2021 – 2023). Subsequent attestations are due annually by December 31. Agency guidance indicates that service providers (e.g., carriers or TPAs) may attest for the group health plan on behalf of sponsoring employers, carriers and TPAs have taken a varied approach on this. If the service provider indicates a willingness to attest on behalf of the plan, the employer can rely on that attestation. However, if any of the service providers will not attest on the plan’s behalf, the employer will need to reach out to such service providers and ask them to confirm that no gag clauses are present in the contracts they have entered into with providers on behalf of the plan. The reality is that employers cannot do much more than ask for this confirmation since employers generally do not play a role in the contracting and may not have access to all contracts entered into on behalf of the plan.

The attestation requirement is a fairly straightforward process, requiring only some plan identifying information, employer contact information, and a checked box and signature to indicate compliance. This is all done via a website portal.

Gag Clause Attestation Resources

• CMS created a webpage with information about how to comply with the gag clause prohibition as well as how to attest to compliance, which you can find here – Gag Clause Prohibition Compliance Attestation | CMS
• The website for submitting the attestation can be found here – Gag Clause Attestation | Welcome!
• Questions or difficulties with the attestation process can be submitted to – CMS_FEPS@cms.hhs.gov (put GCPCA in the subject line).