The passage of the Consolidated Appropriations Act of 2021 (CAA) re-introduced the idea of gag clauses and, more specifically, Gag Clause Prohibition Compliance Attestations (GCPCAs) into our compliance sphere. Group health plans and health insurance carriers are prohibited from entering into agreements that contain gag clauses with health care providers, TPAs, and other downstream vendors that have access to healthcare providers or networks of providers. The GCPCA is an attestation that must be submitted to the Departments of Labor, Health and Human Services (HHS) and Treasury (the Departments) indicating compliance with the Internal Revenue Code section 9824, Employee Retirement Income Security Act (ERISA) section 724, and Public Health Service (PHS) Act section 2799A-9(a)(1). The attestation must be submitted no later than December 31st of each year, covering the period between the previous attestation and the date of the new attestation.
Fully insured and self-funded group health plans, ERISA plans, non-Federal governmental plans, and church plans all must adhere to the gag clause prohibition. Even grandfathered health plans have to join in the fun!
As employers, brokers, and advisors work through their fourth quarter compliance checklists, we cannot forget to include submission of GCPCAs as a necessary “to-do.” It should surprise no one that this year, there are important changes to take notice of before the submission process begins. Let’s dive into those changes.
First, as a reminder, prohibited gag clauses are those that:
This year, as in previous years, group health plans must attest that their contracts with service providers and TPAs do not include gag clauses. For the first time, however, this attestation also implies that there are no gag clauses in the downstream agreements insurers and TPAs have with any other third parties, such as with the owner of a network. This is because plans are now expected to include language in the contracts they have with their insurers and TPAs requiring those vendors not to enter into downstream agreements that would violate the prohibition.
If a plan sponsor discovers a prohibited gag clause in a contract with a service provider and the service provider doesn’t cooperate in removing the prohibited gag clause, there’s also a new requirement that they report the prohibited gag clause in their attestation. In this year’s attestation, plan sponsors can essentially report any other vendor or carrier who refuses to remove a gag clause if the plan sponsor has taken steps to ensure their own compliance, including requesting the gag clause be eliminated.
Attesters report prohibited gag clauses vendors refuse to remove in CMS’ GCPCA webform, specifically in Step 3’s “Additional Information” box. The information must include the name of the service provider, the provision in question, any conduct demonstrating the service provider’s use of the gag clause, information about the plan’s request for removal, and any other steps taken to come into compliance.
So, what steps should employers take to comply with this year’s attestation requirements?
Plan sponsors should first determine what their attestation responsibility might be based on whether their plan is fully insured or self-funded. The usual procedure for fully insured plans is that the carriers will submit the attestation. This satisfies both their own responsibility and that of the plan. The plan should confirm in writing that the carrier will be submitting the attestation on their behalf. If the carrier won’t attest for the group, the employer will need to do so themselves.
For self-funded plans, including level funded groups, the responsibility for submitting the GCPCA lies solely with the employer. These groups can contract with their TPA or other service provider in a written agreement to have that entity attest on their behalf. Similar to the case with fully insured plans, if the TPA or other service provider won’t attest, the employer will need to take care of it.
Employers that need to submit the attestation themselves should:
If you or any of your clients need assistance with submitting a gag clause compliance attestation, you can click here for more information about Lumelight’s gag clause attestation service.
We’re excited to share that the Comply With Us blog will be moving to Lumelight Insights , where you’ll continue to find the same trusted compliance and regulatory updates now with even more industry analysis and thought leadership. The Comply With Us blog will officially sunset in early 2026, so be sure to visit and subscribe to Lumelight Insights to stay connected and up to date.
