What is a gag clause?
A gag clause is a term in a contract that stops your health plan from getting or sharing information about its own costs and care. The Consolidated Appropriations Act, 2021 banned them in agreements between group health plans and the health care providers, provider networks, TPAs and other service providers that give a plan access to a network.
Under the ban, those contracts cannot restrict your plan from:
- Seeing provider-specific cost and quality information, and sharing it with your employees, their doctors and you as plan sponsor.
- Getting de-identified claims and encounter data for your plan, electronically and on request. That includes allowed amounts, provider names and the codes for each service.
- Sharing that information with a business associate, such as an advisor reviewing your plan, consistent with HIPAA’s privacy rules.
Providers can still place reasonable limits on making this information public. What they cannot do is keep it from the plan that pays the bills.
What is the gag clause attestation?
The gag clause attestation is a yearly filing in which your plan confirms to the federal government that its contracts follow the ban. The filing is called the Gag Clause Prohibition Compliance Attestation, or GCPCA, and it is submitted through a CMS webform.
| Details | |
|---|---|
| Who files | Fully insured and self-funded group health plans, including ERISA, church and non-federal governmental plans, and health insurers |
| Who is exempt | Plans made up only of excepted benefits (such as most standalone dental and vision), and plans made up only of HRAs or other account-based plans |
| When | By December 31 every year. The first was due December 31, 2023 |
| What it covers | The period since your last attestation |
| Where | The CMS GCPCA webform in HIOS |
| Who can file for you | Your insurer (fully insured) or your TPA under a written agreement (self-funded). The duty stays with the plan |
What changed with FAQ Part 69?
On January 14, 2025, the Departments issued FAQs About Consolidated Appropriations Act, 2021 Implementation Part 69. Three points change how you read your contracts:
- Downstream agreements count. Your contract with your TPA can be clean and your plan can still be blocked. If the TPA’s own agreement with a network owner keeps it from giving you your data, that is a gag clause too. Ask for a term that bars your TPA from downstream arrangements that limit the data you are entitled to.
- The Departments named specific restrictions. Limiting a review to a “statistically significant” or “minimum necessary” sample of claims, limiting data access to narrow purposes such as an audit, capping claims reviews at once a year, and restricting which data elements you can see are all impermissible gag clauses.
- If a vendor won’t remove the clause, you still attest. Use the “Additional Information” box at Step 3 of the webform to identify the provision and the vendor that refused to remove it. Keep your removal requests and the vendor’s responses. The Departments also said the DOL may investigate the TPA under ERISA’s co-fiduciary rules.
What should employers do before December 31?
Employers should confirm who is filing, get proof of the filing and check their contracts before December 31.
- Find out who is filing. For a fully insured plan, ask your carrier to confirm in writing that it will attest for your plan. For a self-funded plan, decide whether your TPA files for you, and put that in writing.
- Get proof. Ask for the CMS confirmation for your plan, and keep it with your plan records.
- Check your contracts. Review your TPA, network and other service provider agreements for language that limits your access to claims data, cost data or quality data. New contracts and renewals are the easiest time to fix it.
- Test your access. Ask your TPA for de-identified claims data for your plan. A plan that can attest to having access but can’t actually get its data has a problem worth knowing about.
- Put it on next year’s calendar. The attestation is due every year, so assign an owner and a date in the fall.
What are the most common attestation mistakes?
The most common mistakes are assuming someone else filed, filing twice or not at all, and attesting without ever testing data access.
- Assuming the carrier did it. Fully insured plans often rely on the insurer to attest, without confirming it happened.
- Duplicate or missing filings. The DOL asks TPAs to coordinate with each plan so a plan isn’t attested twice, or not at all.
- Attesting without access. The attestation confirms your contracts don’t block your data. If your plan has never asked for its claims data, the first request is the real test.
How Ethos helps.
The attestation is one of the federal deadlines tracked for clients in the Ethos Fiduciary OS compliance calendar, with an owner, a due date and proof it was done. If you are not sure whether your plan filed, or whether your contracts would pass, a Strategic Analysis starts with your plan documents and service agreements.
