Annual Gag Clause Attestation due by December 31, 2025

The annual Gag Clause Prohibition Compliance Attestation (GCPCA) required under a transparency provision in the Consolidated Appropriations Act, 2021 (CAA) must be submitted electronically to the Centers for Medicare & Medicaid Services (CMS) by December 31, 2025. Submission information — including FAQs, instructions, a user manual and an Excel spreadsheet for multiple reporting entities — can be accessed on the CMS website.

Group health plan sponsors and health insurance issuers must annually attest that their agreements with healthcare providers, third-party administrators (TPAs) or other service providers do not include a “gag clause.” To meet this requirement, health insurance issuers as well as fully insured and self-insured group health plans — including ERISA plans, non-federal governmental plans and church plans subject to the Internal Revenue Code — must submit an annual GCPCA, with the exception of the following:

• Plans or issuers offering only excepted benefits
• Issuers offering only short-term, limited-duration insurance
• Medicare and Medicaid plans
• State Children’s Health Insurance Program (CHIP) plans
• The TRICARE program
• The Indian Health Service program
• Basic Health Program plans

Note: It appears that this CAA transparency requirement, like others under the CAA, would not apply to retiree-only plans. For health reimbursement arrangements (HRAs) — including individual coverage HRAs — and other account-based plans, the Departments of Labor, Health and Human Services, and the Treasury are using discretion when it comes to enforcing this requirement until they can exempt these plans through the official rulemaking process.

Going forward

• Employer group health plan sponsors should work to determine which benefits must be included in the GCPCA in addition to their major medical plan (e.g., employee assistance program, retiree medical plan, ancillary benefits). The employer may also want to check with their major medical carrier to see if they will competing the attestation on their behalf or if the group is responsible for submitted directly to CMS for the 12/15/2024 – 12/14/2025 reporting period.
• Before submitting the annual GCPCA no later than December 31, 2025 (covering the period since the last preceding attestation), employer group health plan sponsors should review their vendor agreements to ensure they do not contain gag clauses.
• Self-insured group health plan sponsors may submit the GCPCA themselves or rely on their TPAs to submit it if a written agreement to do so is in place; however, the legal responsibility for submitting the GCPCA remains with the self-insured group health plan. Keep in mind that the information included in the GCPCA relates to the employer plan sponsor and its group health plan (e.g., name, employee identification number, plan name and number, contact information), and a TPA may not have access to all that information.
• Self-insured group health plan sponsors should consider submitting the GCPCA themselves, particularly in situations where the employer has additional carve-out benefits such as prescription drug or behavioral health and it is likely that the TPA will not have the information needed to attest to compliance for those benefits.
• Fully insured group health plan sponsors should be aware that since the GCPCA requirement applies to both the fully insured group health plan and the health insurance issuer, when the issuer of a fully insured group health plan submits a GCPCA on behalf of the plan, the compliance attestation submission requirement will be considered satisfied. In these cases, plan sponsors should confirm that the submission has been completed by the deadline with their carrier.

Do Employer Have to File a Gag Clause Attestation Every Year?

In simplest terms- yes.

The Gag Clause Prohibition Clause Attestation (GCPCA) submission must be made annually. The GCPCA attests to a health plan’s (or insurer’s) compliance with the prohibition against “gag clauses” in any agreements with providers, provider networks, or entities offering provider network access. (A gag clause is any contractual term directly or indirectly restricting the plan or insurer from disclosing specified data and information, such as cost or quality of care data.) A group health plan with more than one benefit package may submit a single attestation even if some coverage types are insured and others are self-insured. For employers that sponsor multiple group health plans, a separate attestation is required for each plan.

An attestation must be made by December 31 each calendar year. Submissions are made through CMS’s Health Insurance Oversight System (HIOS) and are accepted throughout the year. After the initial attestation that was due Dec 31, 2023, each subsequent attestation covers the period from the date of the prior attestation through the date of the subsequent attestation. For example, if a plan submitted its first GCPCA on November 30, 2023, and submits its second GCPCA on November 15, 2024, the second GCPCA’s “attestation period” would be December 1, 2023, to November 15, 2024, and the “attestation year” would be 2024.

You should make sure that the attestation is filed annually (and of course that the plan complies with the underlying prohibition), either by confirming if your medical carrier is filing on your behalf or if you (the employer) will need to file.