GBS Health & Benefits Compliance
Transparency & CAA 2021: Gag Clause Removal & Attestations
The Consolidated Appropriations Act of 2021 (CAA 2021) prohibits the inclusion of any Gag Clauses in contracts between insurers/group health plans and: 1) health care providers, 2) third-party administrators (TPAs), 3) a network or association of providers, or 4) a service provider offering access to a network of providers.
The rule requires insurers/employers that sponsor group health plans to meet two separate but related requirements:
Part 1: Ensure gag clauses are removed from contracts.
Part 2: Submit an online Gag Clause Prohibition Compliance Attestation (GCPCA) each year to attest to compliance with the gag clause prohibition, including identifying any known noncompliant provisions that have not been removed.
Background
The CAA 2021 added a significant number of new provisions and compliance obligations with the intent to promote more transparency in health coverage markets throughout the country. These provisions, along with the separate but related Transparency in Coverage Final Rules (TiCFR) are commonly referred to, collectively, as the Transparency Rules.
One transparency provision within the CAA 2021 prohibits Gag Clauses in contracts between insurers/group health plans and certain service providers. The provision also requires employers that sponsor group health plans (and insurers) to annually submit by December 31 a Gag Clause Prohibition Compliance Attestation (GCPCA) confirming compliance with the gag clause prohibition. If a plan or issuer is aware of a noncompliant provision that has not been removed, the plan or issuer is still required to submit the attestation and identify the noncompliant provision in the GCPCA submission.
Part 1: No Gag Clauses in Contracts
The CAA 2021 prohibits Gag Clauses in contracts between insurers/group health plans and their service providers. It applies to employers of any size that sponsor insured, self or level funded group health plans. The rule was self-implementing (meaning no regulations) so it was immediately effective as of the date the CAA was signed into law on December 27, 2020.
What is a Service Provider?
A service provider under this rule is defined as:
- a health care provider
- a network or association of providers
- another service provider offering access to a network of providers
- a third-party administrator (TPA)
What is a Gag Clause?
Generally, a gag clause is an agreement in a contract that prohibits the disclosure of certain information.
A gag clause in this context is a term in a contract that directly or indirectly restricts specific data and information that an insurer or an employer that sponsors a group health plan can access or make available to another party.
Specifically, when an insurer or employer that sponsors a group health plan enters into a contract with a service provider, the contract MAY NOT RESTRICT an insurer or group health plan from:
- Providing provider-specific cost or quality-of-care information or data to referring providers, the plan sponsor, participants, beneficiaries or enrollees, including individuals eligible to become participants, beneficiaries or enrollees of the plan or coverage
- Electronically accessing de-identified claims and encounter information or data for each participant, beneficiary or enrollee as long as it is consistent with applicable privacy rules such as Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), and the Americans with Disabilities Act (ADA)
- Sharing such information (or directing that such information be shared with a business associate), as long the sharing process is consistent with applicable privacy rules.
An example of a prohibited gag clause would be a paragraph in a contract between a TPA and an employer-sponsored group health plan that states access to provider-specific cost and quality-of-care information is only at the discretion of the TPA.
Application
An employer typically has a direct contract with an insurer and/or TPA/PBM/BHM. Downstream or indirect contracts is a reference to agreements the employer’s insurer or TPA/PBM/BHM enters into with a health care provider, a network or association of providers, or some other service provider offering access to a network of providers.
In January 2025, HHS, DOL and the Treasury (Departments) issued frequently asked questions (FAQs) on the implementation of several federal transparency requirements, including the prohibition on gag clauses and the issue of downstream contracts. The FAQs clarify that, to comply with the gag clause prohibition, the Departments expect that, in their direct contracts with TPAs or other service providers, group health plans will include provisions that also prohibit the TPA or other service provider from entering into any downstream contracts that restrict the plan from accessing or sharing relevant information or data.
A possible solution to address this clarification (including any downstream contracts), and in lieu of a full review of its direct contracts, an employer could consider amending its direct contracts with language similar to the following:
Nothing in this Agreement shall be construed to restrict, directly or indirectly, including through downstream contracts or related arrangements, [XXXX] from accessing, using, or disclosing information to the extent permitted under section 9824 of the Internal Revenue Code, section 724 of the Employee Retirement Income Security Act, and section 2799A-9 of the Public Health Service Act.
Entities/coverage not required to submit a GCPCA:
The following entities and types of coverage are not required to submit a Gag Clause Prohibition Compliance Attestation (GCPCA):
- Issuers offering only short-term, limited-duration insurance
- Medicare and Medicaid plans
- State Children’s Health Insurance Program, or CHIP, plans
- Plans under “Basic Health Program”
- HRAs and other account-based plans
- CMS says HRAs are generally group health plans, but the Departments are exercising enforcement discretion and are not requiring GCPCA submissions for HRAs and other account-based health plans.
- Self-employed individuals (groups of one)
- Retiree-only group health plans
- Issuers with no provider or service agreements in the United States
- Plans or issuers offering only excepted benefits
- Examples include but are not limited to – limited-scope dental/vision benefits, long-term care benefits, nursing/home health care benefits, coverage for a specified disease or illness, hospital indemnity or other fixed indemnity insurance, Accident-only coverage, disability income insurance, coverage for certain on-site medical clinics
Employer Steps to Remove Gag Clauses from Contracts
Identify and make a list of all applicable service providers.
Review all direct contracts for gag clauses with each service provider and make changes as necessary.
- If a service provider sends a general statement about gag clauses, review to determine whether the statement addresses your direct contract, any downstream contracts, or both.
- If the statement addresses their downstream contracts only, you still need to review your direct contract with them.
- Note that even if the provider sends a statement that also addresses your direct contract, simply relying on that statement without independently confirming does not meet your fiduciary duty to oversee and monitor.
- When reviewing direct contracts, some explicit, direct violations will not be difficult to identify in a contract, but provisions that have the effect of restricting the disclosure of information or data may not be as obvious. For example, watch for provisions that would restrict provider-specific cost or quality information sharing with plan members, claims data sharing, or individual claims pricing. Also look for and remove provisions relating to downstream contracts that would restrict the plan from accessing or sharing relevant information or data.
- An alternative to reviewing your direct contracts would be adding a provision to the existing contract with verbiage similar to the following:
- Nothing in this Agreement shall be construed to restrict, directly or indirectly, including through downstream contracts or related arrangements, [XXXX] from accessing, using, or disclosing information to the extent permitted under section 9824 of the Internal Revenue Code, section 724 of the Employee Retirement Income Security Act, and section 2799A-9 of the Public Health Service Act
- Create and maintain an internal Gag Clause compliance file that includes any applicable communications as well as your steps and efforts to comply.
Part 2: No Gag Clause “Attestations”
In addition to prohibiting gag clauses in contracts, the CAA 2021 adds a second requirement for insurers and employers that sponsor group health plans.
By no later than December 31 each year, insurers and group health plans must submit a Gag Clause Prohibition Compliance Attestation (GCPCA) attesting to compliance with the gag clause prohibition.
- Note that if a plan or issuer is aware of a prohibited gag clause or other noncompliant provision that has not been removed, it must still submit the GCPCA and identify the issue in the “Additional Information” section of the submission.
The process for satisfying the GCPCA requirement depends on whether the employer sponsors an insured plan or a self-funded/level-funded plan. The following sections explain how the requirement generally applies in each situation.
Insured Plans
Both the insurer and the employer that sponsors a group health plan must comply with the attestation rule, but if the plan is fully insured, there is no need for two separate attestations.
The Departments will consider the employer-sponsored plan to have satisfied the attestation requirement if the insurer submits the GCPCA on behalf of the plan. Employers should confirm that the insurer’s submission covers the employer-sponsored plan, not only the insurer’s own compliance obligation.
Because the employer remains responsible for compliance, employers that sponsor insured plans should confirm in writing that the insurer actually and timely submitted the attestation on behalf of the plan. The employers could also create and maintain a Gag Clause file to keep track of these confirmations and other related communications.
Self/Level Funded Plans
Employers that sponsor self-funded or level-funded group health plans must either submit the GCPCA themselves or enter into a written agreement with the TPA/PBM/BHM to submit it on behalf of the plan.
Even if the TPA/PBM/BHM agrees in writing to submit the attestation on behalf of the plan, the legal obligation to comply remains with the employer that sponsors the plan. If the TPA/PBM/BHM fails to submit the attestation, the employer remains responsible.
Employers should therefore follow up and confirm in writing the attestation was filed. And, regardless of who files, employers should maintain a Gag Clause file with filing confirmations and related communications.
Employer Steps to Comply with No Gag Clause Attestations
Complete the steps listed in Part 1 (above).
- If a prohibited gag clause or other noncompliant provision is identified and cannot be removed before the filing deadline, consult legal counsel and include appropriate information in the GCPCA “Additional Information” section when filing attestations. Filing with this disclosure satisfies the GCPCA submission requirement, but the underlying provision may still be subject to enforcement.
Watch for, carefully review, and respond timely to communications from your service providers that address whether they will/will not assist with filing attestations.
- If communication states the service provider will file on your behalf, make sure to follow instructions and respond timely.
- If communication states the service provider will NOT file on your behalf, you must file the attestation yourself.
- If no communications on this topic are received, proactively reach out to service providers to clarify.
For sponsors of an insured group health plan, the insurer will likely file the attestation. Make sure to follow up and confirm the attestation is actually filed and keep all confirmations and communications in your gag clause file.
Plan sponsors of a self/level funded plan are allowed to enter into a written agreement with the TPA/PBM/BHM to attest on behalf of the plan. If this happens, ensure there is a written agreement and confirm the attestation was actually filed.
- Employers should not assume another party will submit the GCPCA on behalf of the plan. Unless an insurer or service provider has agreed in writing to submit the GCPCA on behalf of the plan, the employer should be prepared to submit the attestation. Assign someone within your organization to become familiar with HIOS and begin the process early enough to ensure the attestation is timely submitted. For help finding resources to submit attestations through HIOS, see below.
Create and maintain an internal Gag Clause compliance file that includes any applicable communications as well as your steps and efforts to comply.
Submitting Attestations through HIOS
Attestations must be submitted electronically via the U.S. Department of Health and Human Services (HHS) HIOS online portal. HIOS is the acronym for the Health Insurance Oversight System. It is a web-based application used by the Center for Consumer Information and Insurance Oversight (CCIIO), within CMS, to collect health insurance data and information.
Assign yourself or an appropriate individual within your organization, in advance of the deadline, to become familiar with and understand how to move around within the HIOS system as well as successfully complete and submit an attestation.
To that end, please see these important instructions to get started as well as links to HIOS helpful resources.
Instructions for HIOS
- Go to https://hios.cms.gov/HIOS-GCPCA-UI and click on “don’t have a code or forgot yours.”
- Once you have a code, go back to https://hios.cms.gov/HIOS-GCPCA-UI and insert the code and access the system.
- Once in the system, open this link https://www.cms.gov/files/document/hios-gcpca-usermanual-020000.pdf on another screen. This link will open a document from CMS that contains written step by step instructions as well as helpful screen shots illustrating each step you will encounter within the online system. If you’d like, you can skip to page 11 of this document and start with section entitled “6 – Get Started with your GCPCA submission.”
- For more information, including an overview and more detail about the rules and submitting the attestation, you can reference Annual Submission Instructions at https://www.cms.gov/files/document/gag-clause-prohibition-compliance-attestation-instructions.pdf.
- IMPORTANT TIP: Note that within these instructions, there are two different paths for attesting, Option A and Option B. Please ensure you are using the appropriate option. (continued on next page)
- —Option A: An employer that sponsors a single group health plan that offers more than one benefit package within the group health plan (such as a Health Maintenance Organization (HMO) and a Preferred Provider Organization (PPO)) is a single plan/Responsible Party and may submit a single attestation under Option A, and even if one or more coverage types are fully insured and the others are self-funded. Instructions for Option A begin on page 10 of the Annual Submission Instructions.
- —Option B: If an employer sponsors more than one group health plan (and, in the case of plans subject to ERISA, has more than one ERISA plan number), each such plan is a Responsible Entity and each plan must attest using Option B. Instructions for Option B begin on page 15 of the Annual Submission Instructions.
- IMPORTANT TIP: Note that within these instructions, there are two different paths for attesting, Option A and Option B. Please ensure you are using the appropriate option. (continued on next page)
June 2026
This document is not intended to be exhaustive, nor should any information be construed as tax or legal advice.
