Gag Clause Prohibition Compliance Attestation FAQs
The Consolidated Appropriations Act, 2021 (CAA) is intended to promote transparency in health care. One provision of the CAA prohibits “gag clauses” in agreements between health insurers/group health plans and health care providers or other third parties. The ban on gag clauses was effective on December 27, 2020. The CAA also requires health insurers and group health plans to attest to their compliance with the gag clause prohibition.
Although the annual attestation must be submitted by December 31, attestations may be made at any time during the year. The next gag clause prohibition compliance attestation (GCPCA) must be completed by December 31, 2024 by completing a webform on the CMS website.
Please review the FAQs below to assist in determining your obligation to complete a GCPCA.
What is a gag clause?
A gag clause is a contractual provision that directly or indirectly restricts specific data that a group health plan or health insurer can make available to certain other parties. Specifically, contracts cannot restrict a plan or insurer from:
• disclosing provider-specific cost or quality-of-care data, through a consumer engagement tool or similar means, to referring physicians, the plan sponsor, participants, or eligible individuals
• electronically accessing de-identified claims information (in accordance with HIPAA, ADA, GINA)
• sharing the above information with or directing that it be shared with a HIPAA business associate
What types of entities might want a gag clause provision in their contracts?
Entities that might want a gag clause provision to protect information they deem to be proprietary include:
• health care providers
• provider networks
• third party administrators
• pharmacy benefit managers
My company sponsors a group health plan. Do I have to complete the GCPCA?
It depends. Any group health plan sponsor may complete their own GCPCA once they have confirmed that the plan, the health insurer, and all third-party service providers have certified compliance with the gag clause prohibition. These entities will generally provide a certificate or statement of compliance.
A health insurer may submit the GCPCA on behalf of a fully insured group health plan, and many insurance carriers have indicated they will do so. The health insurer is required to list all of the group health plans on whose behalf the attestation is being made. However, we recommend that the plan sponsor of a fully insured group health plan submit a separate GCPCA if the health plan filed a Form 5500 for any plan year to which the attestation relates (generally plan years ending in 2024 for the upcoming attestation) so that the plan information in the attestation matches the information on the Form 5500 filings.
Group health plans that were self-insured at any time in 2024 (including most level-funded plans and plans with stop loss coverage) will generally have to submit their own GCPCA. Before completing the attestation, the plan sponsor should obtain a certificate or statement of compliance from service providers and review contracts to confirm that no gag clauses are in place. A self-insured health plan may enter into a written agreement to have their third-party administrator complete the GCPCA on behalf of the plan, if the TPA is willing to do so. The GCPCA is not required for retiree-only medical plans, HRAs, HCFSAs or ICHRAs.
For written instructions to complete the GCPCA, click here. The attestation process will generally take less than 15 minutes.
Disclaimer: The information provided in this bulletin does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available through this bulletin are for general informational purposes only.
