# The gag clause attestation. What your plan files with CMS every year.

Source: https://ethosbenefits.com/benefits-101/gag-clause-attestation
Type: Benefits 101
Topic: Compliance rules and deadlines
Author: Donovan Ryckis, Founder and CEO
Reviewed by: Patrick Ansara, Partner and Director of Client Operations
Publisher: Ethos Benefits
Published: 2026-10-20
Last updated: 2026-11-03
Cite as: "The gag clause attestation," Ethos Benefits, https://ethosbenefits.com/benefits-101/gag-clause-attestation, updated 2026-11-03.

**Short answer:** A gag clause attestation is a yearly statement most group health plans must file with CMS by December 31, confirming their contracts with insurers, TPAs, networks and other service providers do not block the plan from getting or sharing its own cost, quality and claims data. Your TPA can file it, but the duty stays with your plan.

## What is a gag clause?

A gag clause is a term in a contract that stops your health plan from getting or sharing information about its own costs and care. The Consolidated Appropriations Act, 2021 banned them in agreements between group health plans and the health care providers, provider networks, [TPAs](https://ethosbenefits.com/benefits-101/third-party-administrator) and other service providers that give a plan access to a network.

Under the ban, those contracts cannot restrict your plan from:

1. **Seeing provider-specific cost and quality information,** and sharing it with your employees, their doctors and you as plan sponsor.
2. **Getting de-identified [claims and encounter data](https://ethosbenefits.com/insights/what-happens-behind-the-scenes-with-your-health-insurance)** for your plan, electronically and on request. That includes allowed amounts, provider names and the codes for each service.
3. **Sharing that information with a business associate,** such as an advisor reviewing your plan, consistent with HIPAA's privacy rules.

Providers can still place reasonable limits on making this information public. What they cannot do is keep it from the plan that pays the bills.

## What is the gag clause attestation?

The gag clause attestation is a yearly filing in which your plan confirms to the federal government that its contracts follow the ban. The filing is called the Gag Clause Prohibition Compliance Attestation, or GCPCA, and it is submitted through a CMS webform.

| | Details |
|---|---|
| **Who files** | Fully insured and self-funded group health plans, including ERISA, church and non-federal governmental plans, and health insurers |
| **Who is exempt** | Plans made up only of excepted benefits (such as most standalone dental and vision), and plans made up only of HRAs or other account-based plans |
| **When** | By December 31 every year. The first was due December 31, 2023 |
| **What it covers** | The period since your last attestation |
| **Where** | The CMS GCPCA webform in HIOS |
| **Who can file for you** | Your insurer (fully insured) or your TPA under a written agreement (self-funded). The duty stays with the plan |

## What changed with FAQ Part 69?

On January 14, 2025, the Departments issued [FAQs About Consolidated Appropriations Act, 2021 Implementation Part 69](https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-69). Three points change how you read your contracts:

- **Downstream agreements count.** Your contract with your TPA can be clean and your plan can still be blocked. If the TPA's own agreement with a network owner keeps it from giving you your data, that is a gag clause too. Ask for a term that bars your TPA from downstream arrangements that limit the data you are entitled to.
- **The Departments named specific restrictions.** Limiting a review to a "statistically significant" or "minimum necessary" sample of claims, limiting data access to narrow purposes such as an audit, capping claims reviews at once a year, and restricting which data elements you can see are all impermissible gag clauses.
- **If a vendor won't remove the clause, you still attest.** Use the "Additional Information" box at Step 3 of the webform to identify the provision and the vendor that refused to remove it. Keep your removal requests and the vendor's responses. The Departments also said the DOL may investigate the TPA under ERISA's co-fiduciary rules.

## What should employers do before December 31?

Employers should confirm who is filing, get proof of the filing and check their contracts before December 31.

1. **Find out who is filing.** For a fully insured plan, ask your carrier to confirm in writing that it will attest for your plan. For a self-funded plan, decide whether your TPA files for you, and put that in writing.
2. **Get proof.** Ask for the CMS confirmation for your plan, and keep it with your plan records.
3. **Check your contracts.** Review your TPA, network and other service provider agreements for language that limits your access to claims data, cost data or quality data. New contracts and renewals are the easiest time to fix it.
4. **Test your access.** Ask your TPA for de-identified claims data for your plan. A plan that can attest to having access but can't actually get its data has a problem worth knowing about.
5. **Put it on next year's calendar.** The attestation is due every year, so assign an owner and a date in the fall.

## What are the most common attestation mistakes?

The most common mistakes are assuming someone else filed, filing twice or not at all, and attesting without ever testing data access.

- **Assuming the carrier did it.** Fully insured plans often rely on the insurer to attest, without confirming it happened.
- **Duplicate or missing filings.** The DOL asks TPAs to coordinate with each plan so a plan isn't attested twice, or not at all.
- **Attesting without access.** The attestation confirms your contracts don't block your data. If your plan has never asked for its claims data, the first request is the real test.

## How Ethos helps.

The attestation is one of the federal deadlines tracked for clients in the [Ethos Fiduciary OS](https://ethosbenefits.com/fiduciary-os#decisions) compliance calendar, with an owner, a due date and proof it was done. If you are not sure whether your plan filed, or whether your contracts would pass, a [Strategic Analysis](https://ethosbenefits.com/strategic-analysis) starts with your plan documents and service agreements.

## From the Ethos Benefits team

> So the way I look at the CAA is it's the plan sponsor's most empowering legislation.

Chelsea Ryckis, Founder and President, Ethos Benefits, on The Business of Benefits, Episode 72

## On the podcast

- [Benefits Dirty Dozen, Part 2: Health plan tactics 6 to 1](https://ethosbenefits.com/podcast/benefits-dirty-dozen-part-2), The Business of Benefits, Episode 89
- [Employer Health Coalitions and Smarter Purchasing: With Karen van Caulil](https://ethosbenefits.com/podcast/employer-health-coalitions-karen-van-caulil), The Business of Benefits, Episode 86
- [Benefits Consultant Fees Are Only Part of the Price: Chris Deacon on paying more and getting less](https://ethosbenefits.com/podcast/benefits-consultant-fees-chris-deacon), The Business of Benefits, Episode 68
- [ERISA Fiduciary Duty and Your Health Plan: Conference Episode, Part 1](https://ethosbenefits.com/podcast/erisa-fiduciary-duty-health-plan), The Business of Benefits, Episode 51

## Frequently asked questions

### When is the gag clause attestation due?

By December 31 every year. The first attestation was due December 31, 2023, and each one since covers the period from the previous attestation to the new one. The filing for 2026 is due by December 31, 2026, and employers should confirm who is filing well before then.

### How do you submit the gag clause attestation?

Employers submit it through the Gag Clause Prohibition Compliance Attestation webform that CMS runs in its HIOS system. The filer enters the plan and submitter details and attests for the period since the last filing. CMS publishes submission instructions and an Excel template for entities filing for more than one plan. Keep the confirmation CMS sends with your plan records.

### Does a fully insured plan have to file the gag clause attestation?

Yes, both the plan and the insurer have the obligation. If the insurer files the attestation on the plan's behalf, both are treated as having met it. Confirm in writing each year that your carrier filed and that the filing covers your plan.

### Can our TPA file the attestation for our self-funded plan?

Yes, if you have a written agreement for it. But the legal duty stays with your plan, so if the TPA misses the filing or files it wrong, the plan is the party out of compliance. Ask for the confirmation CMS sends after submission.

### What is the penalty for not filing the gag clause attestation?

The main exposure is a federal excise tax of generally $100 per day for each affected person, which applies when an employer plan fails a group health plan requirement in the Internal Revenue Code. Plans that miss the deadline may also face enforcement action from the Departments, and a TPA that agreed to file can face scrutiny too.

### Do HRAs and dental or vision plans need an attestation?

Not currently. Plans made up only of excepted benefits, such as most standalone dental and vision plans, are exempt. The Departments are also not requiring attestations from plans made up only of HRAs or other account-based plans. Employers still attest for any medical plan they sponsor alongside those benefits.

## Sources

1. [FAQs About Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 57](https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-57), U.S. Department of Labor, HHS and Treasury
2. [FAQs About Consolidated Appropriations Act, 2021 Implementation Part 69](https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-69), U.S. Department of Labor, HHS and Treasury
3. [Gag Clause Prohibition Compliance Attestation](https://www.cms.gov/marketplace/about/oversight/other-insurance-protections/gag-clause-prohibition-compliance-attestation), Centers for Medicare & Medicaid Services
4. [Gag Clause Prohibition Compliance Attestation submission instructions](https://www.cms.gov/files/document/gag-clause-prohibition-compliance-attestation-instructions.pdf), Centers for Medicare & Medicaid Services
5. [GCPCA webform (HIOS)](https://hios.cms.gov/HIOS-GCPCA-UI), Centers for Medicare & Medicaid Services
6. [26 U.S. Code § 4980D, Failure to meet certain group health plan requirements](https://www.law.cornell.edu/uscode/text/26/4980D), Legal Information Institute, Cornell Law School