Annual Gag Clause Attestation due by December 31, 2025

The annual Gag Clause Prohibition Compliance Attestation (GCPCA) required under a transparency provision in the Consolidated Appropriations Act, 2021 (CAA) must be submitted electronically to the Centers for Medicare & Medicaid Services (CMS) by December 31, 2025. Submission information — including FAQs, instructions, a user manual and an Excel spreadsheet for multiple reporting entities — can be accessed on the CMS website.

Group health plan sponsors and health insurance issuers must annually attest that their agreements with healthcare providers, third-party administrators (TPAs) or other service providers do not include a “gag clause.” To meet this requirement, health insurance issuers as well as fully insured and self-insured group health plans — including ERISA plans, non-federal governmental plans and church plans subject to the Internal Revenue Code — must submit an annual GCPCA, with the exception of the following:

• Plans or issuers offering only excepted benefits
• Issuers offering only short-term, limited-duration insurance
• Medicare and Medicaid plans
• State Children’s Health Insurance Program (CHIP) plans
• The TRICARE program
• The Indian Health Service program
• Basic Health Program plans

Note: It appears that this CAA transparency requirement, like others under the CAA, would not apply to retiree-only plans. For health reimbursement arrangements (HRAs) — including individual coverage HRAs — and other account-based plans, the Departments of Labor, Health and Human Services, and the Treasury are using discretion when it comes to enforcing this requirement until they can exempt these plans through the official rulemaking process.

Going forward

• Employer group health plan sponsors should work to determine which benefits must be included in the GCPCA in addition to their major medical plan (e.g., employee assistance program, retiree medical plan, ancillary benefits). The employer may also want to check with their major medical carrier to see if they will competing the attestation on their behalf or if the group is responsible for submitted directly to CMS for the 12/15/2024 – 12/14/2025 reporting period.
• Before submitting the annual GCPCA no later than December 31, 2025 (covering the period since the last preceding attestation), employer group health plan sponsors should review their vendor agreements to ensure they do not contain gag clauses.
• Self-insured group health plan sponsors may submit the GCPCA themselves or rely on their TPAs to submit it if a written agreement to do so is in place; however, the legal responsibility for submitting the GCPCA remains with the self-insured group health plan. Keep in mind that the information included in the GCPCA relates to the employer plan sponsor and its group health plan (e.g., name, employee identification number, plan name and number, contact information), and a TPA may not have access to all that information.
• Self-insured group health plan sponsors should consider submitting the GCPCA themselves, particularly in situations where the employer has additional carve-out benefits such as prescription drug or behavioral health and it is likely that the TPA will not have the information needed to attest to compliance for those benefits.
• Fully insured group health plan sponsors should be aware that since the GCPCA requirement applies to both the fully insured group health plan and the health insurance issuer, when the issuer of a fully insured group health plan submits a GCPCA on behalf of the plan, the compliance attestation submission requirement will be considered satisfied. In these cases, plan sponsors should confirm that the submission has been completed by the deadline with their carrier.