Gag clause attestation deadline approaching

Overview

As the end of the year is approaching, it is time for employer-sponsored health plans to complete a mandatory compliance task: the Gag Clause Prohibition Compliance Attestation (“GCPCA”), required by the Consolidated Appropriations Act of 2021 (“CAA”).

The annual attestation is due by December 31, 2025.

Action Items

The key to a smooth attestation is knowing the plan type and coordinating with service providers (insurers/TPAs/other issuers).

1. Fully insured health plans

For fully insured plans, both the health plan (employer/sponsor) and the insurance company (issuer) are technically responsible for the attestation.

• Action: In practice, the Centers for Medicare & Medicaid Services considers the requirement satisfied if the insurance company submits the attestation on the plan’s behalf.
• Best practice: Confirm in writing with the insurance company that they are submitting the attestation for the plan and maintain the written agreement in the plan’s compliance files. No further action may be required from the employer if the insurance company attests.

2. Self-funded health plans

For self-funded plans (including level-funded), the plan sponsor (employer) is ultimately liable for ensuring the attestation is submitted.

• Action: The plan may choose to submit the attestation or delegate the task to the third-party administrator (“TPA”) or other service provider (pharmacy benefit manager (“PBM”), behavioral health vendor).
• Crucial step: If the plan chooses to delegate, the plan must have a written agreement stating the service provider will submit the attestation. Although the service provider may complete the submission, the legal responsibility remains with the plan sponsor. If the TPA misses the deadline, the plan sponsor is still responsible.
• Best practice: Determine the plan’s delegation strategy and obtain written confirmation now. If the TPA will not file, the plan must be prepared to submit the attestation directly through the CMS web portal.

3. Review plan contracts

Regardless of the plan type, plan sponsors should ensure that current contracts—and any downstream agreements the TPA/PBM enters—do not contain prohibited gag clauses. If the plan is aware of a noncompliant provision that a service provider refuses to remove, the plan must still submit the attestation and use the “Additional Information” text box to self-report the issue.

Key takeaway

The December 31, 2025 deadline for the CAA Gag Clause Attestation is a firm obligation. The complexity lies not just in the filing, but in the underlying requirement to ensure the plan’s service agreements do not restrict data access.

The Baldwin Group is prepared to assist plans with confirmation of who is responsible for the submission and get the necessary confirmation for plan records. Proactive verification is the best defense against non-compliance and potential enforcement action.

Summary

What is a “gag clause” and why the obligations?

A “gag clause” is a contractual provision that prevents a health plan or insurance company from sharing certain information related to healthcare price and quality.

The CAA includes a transparency rule that prohibits plans and insurance companies from entering contracts with providers, TPAs, PBMs, or other service providers (including downstream agreements) that restrict the plan or issuer from:

1. Providing provider-specific cost or quality-of-care information to participants, the plan sponsor, and others.
2. Electronically accessing de-identified claims and encounter data (such as allowed amounts, provider names, and service codes).
3. Sharing the above information with a HIPAA business associate.

This rule is designed to ensure plan sponsors and participants can access the data they need to make informed decisions and manage costs, without being restricted by service provider contracts.

The GCPCA is a formal, annual certification submitted to the Departments of Labor, Health and Human Services, and the Treasury (“the Departments”) confirming that the health plan has been and is in compliance with this prohibition.

Who needs to file?

The attestation applies to most group health plans, including:

• Fully insured medical plans;
• Self-funded (including level-funded) medical plans; and,
• ERISA plans, church plans, and governmental plans.

Note: Plans that only offer “excepted benefits” (such as stand-alone vision or dental) or account-based plans (such as Health Reimbursement Arrangements (HRAs) and Health Flexible Spending Accounts (FSAs) are generally not required to attest.

Additional Information & Related Resources

• Gag Clause Attestation Responsible Entity Decision Tree
• Gag Clause Attestation Guide for Employers
• How to Complete the Gag Clause Attestation – An Illustrated Step-by-Step Employer Guide
• The Employer’s Gag Clause Contract Review Checklist

For questions regarding this Alert or any other related compliance issues, please contact your Baldwin Group client experience team.