The Consolidated Appropriations Act (CAA) introduced new requirements for health plans to ensure greater transparency in healthcare costs and quality. Among these is the Gag Clause Prohibition Compliance Attestation (GCPCA), which prohibits contractual terms that restrict a plan’s ability to access and share certain information with participants, beneficiaries, enrollees, and plan sponsors. The first attestation was due by December 31, 2023, and subsequent attestations are due annually by December 31 of each year. This means the next deadline is December 31, 2025.
What is a “Gag Clause”?
A gag clause is a contractual term that directly or indirectly restricts a health plan or insurer from making specific data and information available to another party. These prohibitions apply to agreements with healthcare providers, networks or associations of providers, third-party administrators (TPAs), and other service providers. Specifically, these clauses are prohibited from restricting a plan from:
- Providing provider-specific cost or quality of care information.
- Providing electronic access to de-identified claims and encounter information, consistent with HIPAA, GINA, and the ADA.
- Sharing information with business associates as permitted by applicable privacy regulations.
- Sharing financial information, service codes, or other data related to claims.
Who is Responsible for Attesting?
Both group health plans and health insurance issuers are required to submit an attestation of compliance. However, the process differs depending on the type of plan:
- Fully Insured Plans. The health insurance issuer is responsible for submitting the attestation. If the issuer submits the attestation on behalf of the plan, the plan is considered to have satisfied the requirement. Employers with fully insured plans should confirm with their carrier that they will be submitting the attestation.
- Self-Insured Plans. The legal responsibility to submit the attestation remains with the self-insured plan (the employer). Employers can enter into a written agreement with their TPA to submit the attestation on their behalf. However, employers are advised to ensure their TPA is willing to do so and to get written confirmation.
Next Steps for Employers
The attestation is submitted electronically via the Medicare & Medicaid Services (CMS) website and is shared with the Departments of Labor, Health and Human Services, and the Treasury. Failure to submit the attestation by the deadline can result in enforcement action. To ensure compliance, employers should:
- Identify Your Responsibility: Determine if your plan is fully insured or self-insured and clarify who is responsible for the attestation submission.
- Communicate with Carriers/TPAs: If you have a fully insured plan, confirm with your carrier that they will be submitting the attestation. If you have a self-insured plan, confirm that your TPA will be submitting it on your behalf and that you have a written agreement in place.
- Review Plan Documents: Examine your agreements with health plan service providers to ensure they do not contain any prohibited gag clauses.
- Stay Informed: Self-insured employers should review CMS’ frequently asked questions, instructions for submission and other resources to ensure they understand their compliance obligations.
- Submit Attestation if Necessary: If your TPA or carrier is not submitting on your behalf, be prepared to submit the attestation yourself through the CMS web portal.
