Gag Clause Attestation: What Employers Must Submit Before December 31

The gag clause attestation is one of the shortest filings on your compliance calendar and one of the most revealing. It takes minutes to submit, and it forces you to answer a question most employers have never been asked out loud: do you actually control your own health plan data, or does someone else?

Every year since 2023, group health plans have had to tell the federal government, in writing, that their contracts do not block them from seeing what their own health care costs. That filing is the gag clause attestation, and the next one is due by December 31.

Most compliance filings ask you to report something you already know. This one asks you to certify something you may have never verified, and after federal guidance issued in January 2025, the standard for a violation got broader. If you sponsor a self-funded plan, stop treating the gag clause attestation as a box to check. Treat it as a contract audit with your signature attached.

What the Gag Clause Attestation Actually Is

The Consolidated Appropriations Act, 2021 did something quietly radical. It made it illegal for a health plan to sign a contract that stops the plan from seeing or sharing its own cost and quality information.

Before that law, this was normal. A third party administrator or network owner would hand an employer a contract barring it from disclosing negotiated rates, sharing quality data, or pulling its own de-identified claims. Employers signed. Most had no idea what they were giving up.

The gag clause prohibition took effect on December 27, 2020. Since then, plans and issuers cannot agree to contract terms that restrict them from:

• Sharing provider-specific cost or quality of care information with participants, beneficiaries, plan sponsors, or referring providers
• Accessing de-identified claims and encounter information electronically on request, consistent with HIPAA, GINA, and the ADA
• Sharing that information with a business associate, such as an independent claims auditor or an analytics partner

The gag clause attestation is the enforcement mechanism. Once a year you tell the federal government that your contracts comply. No form to mail, no fee to pay. Just a webform, a signature, and the assumption that you looked before you signed.

The Three Laws Behind One Requirement

The rule lives in three parallel statutes, which is why it reaches nearly every kind of plan: Internal Revenue Code section 9824, ERISA section 724, and Public Health Service Act section 2799A-9. Labor, Health and Human Services, and the Treasury enforce it jointly, and CMS collects the filings. The gag clause attestation process was laid out in FAQs Part 57, released in February 2023.

What Counts as a Gag Clause in a Real Contract

Almost nobody labels a section “Gag Clause.” The restrictions show up as ordinary contract language, which is exactly why the gag clause attestation trips up sponsors who never read past the fee schedule. Watch for terms that:

• Make negotiated rates confidential and prohibit disclosure to plan participants
• Limit audits to once per plan year or to a statistically significant sample of claims
• Require you to review claims data on the vendor’s premises rather than receive a file
• Restrict which data elements you can see, or strip provider identifiers from claim records
• Give the vendor sole discretion over whether you may share de-identified data

If that sounds like your administrative services agreement, you are not unusual. You are typical. That is the problem this law was written to surface.

Who Has to Submit a Gag Clause Attestation

The reach is wide. If you offer major medical coverage, you are almost certainly in scope. The gag clause attestation applies to fully insured plans and their issuers, self-funded and level-funded plans, grandfathered plans, non-federal governmental plans, church plans subject to the Code, and issuers of individual and student coverage. Size does not matter. A 40-life employer and a 4,000-life employer carry the same obligation.

Plans That Do Not Have to Attest

A narrow set of arrangements sits outside the requirement. You do not need to file for plans providing only excepted benefits, such as standalone dental, standalone vision, accident-only, or disability coverage. Short-term limited-duration insurance is out, as are Medicare, Medicaid, CHIP, and Basic Health Program coverage. The Departments have also said they will not pursue the gag clause attestation against plans consisting solely of health reimbursement arrangements, including ICHRAs.

One caution. If you offer an ICHRA alongside a traditional group medical plan, the group medical plan still needs a gag clause attestation. The exemption covers plans made up only of HRAs, not employers who happen to sponsor one.

The December 31 Deadline and the Window It Covers

The gag clause attestation is due by December 31 each calendar year. There is no extension process, no good-cause exception, and no published grace period.

The period you certify runs from the day after your last attestation through the day you submit the current one. First-time filers cover everything from December 27, 2020, or the plan’s effective date if later. The clock follows the calendar year, not your plan year, so a plan running July to June still files its gag clause attestation by December 31.

What FAQ Part 69 Changed for the Gag Clause Attestation

On January 14, 2025, the Departments issued FAQs About Consolidated Appropriations Act, 2021 Implementation Part 69. It is the most consequential guidance since the attestation began. Three shifts matter most.

Downstream Agreements Are Now Squarely in Scope

You might have a clean contract with your TPA and still be out of compliance. If your TPA signs a downstream agreement with a network owner that blocks it from handing you your data, the restriction flows through to you. That is an indirect gag clause, and it violates the prohibition just as a direct one would.

The fix is a contract term barring your TPA from entering any downstream arrangement that limits the data you are entitled to receive. Most agreements lack that language today, and adding it is the highest-value change most sponsors can make this year.

The List of Prohibited Restrictions Got Specific

The Departments named practices they consider impermissible. Restricting review to a minimum necessary or statistically significant subset of claims is out. Capping audits at once per year is out. Limiting which data elements you can see is out. So is requiring on-site review at the vendor’s office, or letting the vendor decide whether you may share de-identified data. The list is not exhaustive.

What to Do When Your Vendor Will Not Remove the Clause

The guidance acknowledged the leverage problem directly. Many employers cannot force a national administrator to rewrite standard language. The answer was not an exemption. It was disclosure.

You still submit the gag clause attestation. In the Additional Information field at Step 3, you identify the prohibited provision, name the vendor that refused to remove it, describe how that vendor interprets the clause, and document your removal requests. The Departments will consider good faith efforts in enforcement. They did not promise immunity, and they confirmed the DOL may investigate a TPA for co-fiduciary liability where impermissible gag clauses exist.

How to Submit the Gag Clause Attestation Step by Step

The gag clause attestation is straightforward once the review work is done. Before you open the webform, gather the legal name and nine-digit EIN of each responsible entity, the ERISA plan number where applicable, an address and point of contact, submitter and attester details, and any disclosure language you need to include. Filing for many entities? CMS provides an Excel template, and the field-by-field detail sits in the CMS attestation instructions.

The submission runs in five steps through the HIOS GCPCA portal:

1. Submitter information. Who is entering the filing, with entity type and contact details.
2. Attester information. Who is certifying compliance. This should be someone with authority to bind the plan.
3. Responsible entity details. Entity name, EIN, plan number, address, and scope of agreements covered. The Additional Information field lives here.
4. Review. Confirm every field. There is no editing after submission.
5. Attest and sign. The attester signs electronically and submits.

Save the confirmation. CMS does not mail a receipt, and that page is your proof of a timely gag clause attestation if the plan is examined. Current filing resources sit on the CMS attestation page.

Fully Insured or Self-Funded: Who Carries the Risk

Funding arrangement	Who files	What you should do
Fully insured	The carrier files for the plan, satisfying the requirement for both parties	Get written confirmation each year
Self-funded or level-funded	The plan is responsible. A TPA may file only under a written agreement	Confirm the agreement exists, confirm the filing happened, keep proof
Carved-out vendors	Each service provider may file for the agreements it administers	Map every vendor so nothing goes unfiled

Here is the sentence self-funded employers need to sit with. If your TPA agrees to file and then does not, the plan violates the requirement, not the TPA. Delegation moves the work, not the liability. With roughly 67 percent of covered workers in self-funded plans, rising to 80 percent at firms with 200 or more employees, most of the market carries this directly.

What Happens If You Skip the Gag Clause Attestation

No line in the statute says late filing costs a set amount. That absence has made some sponsors comfortable. It should not.

The requirement sits in Chapter 100 of the Internal Revenue Code, where group health plan failures carry an excise tax of $100 per day per affected individual under section 4980D, self-reported on IRS Form 8928. Run that on a 300-employee plan and the exposure is not a rounding error. The more realistic risk is what a missing gag clause attestation signals. The Departments know exactly who has filed, and a plan that never has is visible.

The Fiduciary Case for Taking This Seriously

Strip away the compliance framing and the gag clause attestation asks one thing: can you see what your plan is paying?

That is a fiduciary question. Under ERISA you must act prudently and in the exclusive interest of participants when you spend plan assets. You cannot judge whether a price is reasonable if your contract prevents you from seeing it, and you cannot benchmark a network you are not allowed to know the rates for.

Courts are still working through what this means. The claims in Lewandowski v. Johnson & Johnson, tracked by Georgetown Law, were dismissed on standing grounds and are on appeal. The outcome is unsettled. The direction is not. Participants are asking what employers knew about pricing, and “our contract did not let us look” is a hard answer to give under oath. Our fiduciary framework shows how data access, vendor contracts, and documented decisions fit together.

Your Gag Clause Attestation Checklist

1. Inventory every agreement. TPA, network access, PBM, behavioral health, stop-loss, and any point solution touching claims.
2. Read the data and confidentiality sections. Look for audit limits, sample-size caps, on-site review requirements, and discretionary sharing terms.
3. Ask about downstream language in writing. Have each vendor confirm whether any downstream deal restricts what they can pass to you.
4. Send dated removal requests for anything prohibited, and keep the responses. This is your good faith record.
5. Confirm who is filing. Carrier confirmation if fully insured, written TPA agreement plus proof of filing if self-funded.
6. Draft your disclosure now if a clause is staying in: the provision, the vendor, the conduct, the requests, the steps taken.
7. File, save the confirmation, and calendar next year before you close the file.
8. Feed the findings into renewal. Anything you could not remove becomes a negotiating point, or a reason to find a different partner.

Gag Clause Attestation FAQs

When is the gag clause attestation due?

By December 31 each calendar year. The deadline follows the calendar, not your plan year, and CMS has published no extension or grace period.

Who files for a fully insured plan?

The carrier files on the plan’s behalf, which satisfies the requirement for both parties. Ask for written confirmation each year and keep it with your plan records rather than assuming it happened.

If my TPA files for my self-funded plan, am I covered?

Only under a written agreement, and only if the TPA actually files. If it agrees to submit and then misses the gag clause attestation, the plan is the party in violation. Verify it every year.

Do standalone dental and vision plans need a gag clause attestation?

No. Plans providing only excepted benefits, including standalone dental, standalone vision, accident-only, and disability coverage, are outside the requirement.

What if my vendor refuses to remove a prohibited clause?

File anyway. Use the Additional Information field at Step 3 to name the vendor, describe the provision, and document your removal requests. The Departments weigh good faith efforts, and not filing is a violation on its own.

Is there a specific penalty for missing the deadline?

The statute sets no late-filing fee. The underlying failure can trigger the Code’s excise tax of $100 per day per affected individual, and a missing filing invites broader scrutiny of your plan.

How long does the filing take?

The webform takes 15 to 30 minutes with your entity data in hand. The contract review that should come first takes far longer, which is why October or November is the right time to start.

Do we file separately for each plan?

You attest by responsible entity, and one submission can cover several entities using the CMS Excel template.

Turn the Filing Into Leverage

Most employers treat the gag clause attestation as an annual nuisance. The ones who get something out of it treat it as the one moment each year when the federal government hands them a reason to demand answers.

Think about what the review produces: a map of who touches your claims data, written confirmation of what each vendor will share, a dated record of what you asked for, and a list of terms to fix at renewal. That is the foundation of every serious cost strategy, from claims auditing to direct contracting to a real PBM review. None of it works without data access, and access is exactly what this law protects.

The status quo has always depended on employers not asking. Between now and December 31, pull the contracts, ask the hard questions, document what you find, and file your gag clause attestation with confidence, because you looked. If the review turns up language you cannot interpret, our health benefits services team works through exactly these agreements with employers who are done accepting terms they did not write.

This article is for general informational purposes and is not legal or tax advice. Employers should consult qualified counsel about their specific plan documents and vendor agreements.