GBS Health & Benefits Compliance
Transparency & CAA 2021: Gag Clause Removal & Attestations
The Consolidated Appropriations Act of 2021 (CAA) prohibits the inclusion of any Gag Clauses in contracts between insurers/group health plans and: 1) health care providers, 2) third-party administrators (TPAs), 3) a network or association of providers, or 4) a service provider offering access to a network of providers.
The rule requires insurers/employers that sponsor group health plans to meet two separate but related requirements:
Part 1: Ensure gag clauses are removed from contracts.
Part 2: Submit an online attestation each year to confirm no gag clauses exist.
Background
The CAA added a significant number of new provisions and compliance obligations to insurers/group health plans with the intent to promote more transparency in health coverage in markets throughout the country. These provisions, along with the separate but related Transparency in Coverage Final Rules (TiCFR) are commonly referred to, collectively, as the Transparency Rules.
One transparency provision within the CAA prohibits Gag Clauses in contracts between insurers/group health plans and certain service providers. The rule was immediately effective on December 27, 2020, the day the CAA was signed into law. The provision also requires employers that sponsor group health plans (and insurers) to annually “attest” that they did not enter into any contracts with gag clauses. This attestation is formally referred to as the Gag Clause Prohibition Compliance Attestation (GCPCA), and it must be submitted electronically through the CMS (department within HHS) HIOS online portal by December 31 each year.
Part 1: No Gag Clauses in Contracts
The CAA prohibits Gag Clauses in contracts between insurers/group health plans and their service providers. It applies to employers of any size that sponsor insured, self or level funded group health plans. The rule was self-implementing (no regulations) so it was immediately effective as of the date the CAA was signed into law on December 27, 2020.
What is a Service Provider?
A service provider under this rule is defined as:
- a health care provider
- a network or association of providers
- another service provider offering access to a network of providers
- a third-party administrator (TPA)
What is a Gag Clause?
Generally, a gag clause is an agreement in a contract that prohibits the disclosure of certain information.
A gag clause in this context is a term in a contract that directly or indirectly restricts specific data and information that an insurer or an employer that sponsors a group health plan can access or make available to another party.
Specifically, when an insurer or employer that sponsors a group health plan enters into a contract with a service provider, the contract MAY NOT RESTRICT an insurer or group health plan from:
- Providing provider-specific cost or quality-of-care information or data to referring providers, the plan sponsor, participants, beneficiaries or enrollees, including individuals eligible to become participants, beneficiaries or enrollees of the plan or coverage
- Electronically accessing de-identified claims and encounter information or data for each participant, beneficiary or enrollee as long as it is consistent with applicable privacy rules such as Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), and the Americans with Disabilities Act (ADA)
- Sharing such information (or directing that such information be shared with a business associate), as long the sharing process is consistent with applicable privacy rules.
An example of a prohibited gag clause would be a paragraph in a contract between a TPA and an employer-sponsored group health plan that states access to provider-specific cost and quality-of-care information is only at the discretion of the TPA.
Application
An employer typically has a direct contract with an insurer and/or TPA/PBM/BHM. Downstream contracts are agreements the employer’s insurer and/or TPA/PBM/BHM enters into with a health care provider, a network or association of providers, or some other service provider offering access to a network of providers.
FAQs issued by the Departments of Health and Human Services, Labor and the Treasury (Departments) in January 2025 issued frequently asked questions (FAQs) on the implementation of several federal transparency requirements, including the prohibition on gag clauses and the issue of downstream contracts. In sum, to comply with the gag clause prohibition, the Departments expect that, in their direct contracts with TPAs or other service providers, group health plans will include provisions that also prohibit the TPA or other service provider from entering into a downstream contracts that restrict the plan from accessing or sharing relevant information or data.
A possible employer solution, in lieu of reviewing its direct contracts and to address downstream contracts, would be to amend its direct contracts with language similar to the following:
Notwithstanding the foregoing, nothing in this contract shall be read to impose any restrictions, directly or indirectly (including downstream contracts), on xxxx (service provider name) or Plan Sponsor (employer name) with respect to disclosing, accessing or sharing information, as outlined and required under 42 U.S.C. § 300gg-119.
Exclusions
The prohibition against Gag Clauses does not apply to:
- Issuers offering only short-term, limited-duration insurance
- Medicare and Medicaid plans
- State Children’s Health Insurance Program (CHIP) plans
- TRICARE program
- Indian Health Service program
- Plans under “Basic Health Program”
- HRAs and other account-based plans
Employer Steps to Remove Gag Clauses from Contracts
Identify and make a list of all applicable service providers.
Review all direct contracts for gag clauses with each service provider and make changes as necessary.
- If a service provider sends a general statement about gag clauses, review to determine whether the statement addresses your direct contract or whether that statement instead addresses downstream contracts.
- If the statement addresses their downstream contracts only, you still need to review your direct contract with them. Note that even if the provider sends a statement that addresses your direct (rather than downstream) contracts, simply relying on a statement from the service provider does not meet your fiduciary duty to independently confirm this.
- When reviewing direct contracts, some explicit, direct violations will not be difficult to identify in a contract, but provisions that have the effect of restricting the disclosure of information or data may not be as obvious. For example, watch for provisions that would restrict provider-specific cost or quality information sharing with plan members, claims data sharing, or individual claims pricing. Also look for and remove provisions relating to downstream contracts that would restrict the plan from accessing or sharing relevant information or data.
- An alternative to reviewing your direct contracts would be adding a provision to the existing contract with verbiage similar to the following:
- Notwithstanding the foregoing, nothing in this contract shall be read to impose any restrictions, directly or indirectly (including downstream contracts), on xxxx (service provider name) or Plan Sponsor (employer name) with respect to disclosing, accessing or sharing information, as outlined and required under 42 U.S.C. § 300gg-119.
Create and maintain an internal Gag Clause compliance file that includes any applicable communications as well as your steps and efforts to comply.
Part 2: No Gag Clause “Attestations”
In addition to prohibiting gag clauses in contracts, the CAA adds a second requirement for insurers and employers that sponsor group health plans. By no later than December 31 each year, insurers and group health plans must “attest” there are no gag clauses in any contracts with service providers.
Insured Plans
Both the insurer and the employer that sponsors a group health plan must comply with the attestation rule, but if the plan is fully insured, there is no need for two separate attestations. In other words, the Departments will consider the employer to have satisfied the attestation requirements if the insurer attests. Note however that because they are still responsible, employers that sponsor insured plans should confirm the insurer actually (and timely) submits the attestation. The employers should also create and maintain a Gag Clause file to keep track of these confirmations and other related communications.
Self/Level Funded Plans
Employers that sponsor self/level funded group health plans must file the attestation themselves or enter into a written agreement with the TPA/PBM/BHM to file the attestation. Even if the TPA/PBM/BHM agrees to submit the attestation about the contract, the legal obligation to comply remains with the employer that sponsors the plan. In other words, if the TPA/PBM/BHM agrees to file the attestation but fails to do so, that would fall on the employer, not the TPA/PBM/BHM. That means the employer must follow up and confirm the attestation was filed. Whether the employer submits the attestation or enters into an agreement with the TPA/PBM/BHM to submit it, employers should create and maintain a Gag Clause file to keep track of filing confirmations and other related communications.
Employer Steps to Comply with No Gag Clause Attestations
Complete the steps listed in Part 1 (above).
Watch for, carefully review, and respond timely to communications from your service providers that address whether they will/will not assist with filing attestations.
- If communication states the service provider will file on your behalf, make sure to follow instructions and respond timely.
- If communication states the service provider will NOT file on your behalf, you must file the attestation yourself.
- If no communications on this topic are received, proactively reach out to service providers to clarify.
For sponsors of an insured group health plan, the insurer will likely file the attestation. Make sure to follow up and confirm the attestation is actually filed and keep all confirmations and communications in your gag clause file.
Plan sponsors of a self/level funded plan are allowed to enter into a written agreement with the TPA/PBM/BHM to attest on behalf of the plan. If this happens, ensure there is a written agreement and confirm the attestation was actually filed.
- Typically, employers must attest and file the attestation itself. Do not delay. Assign someone within your organization to become familiar with HIOS and begin the process today to submit the attestation. For instructions, and resources on submitting attestations, see the next page.
Create and maintain an internal Gag Clause compliance file that includes any applicable communications as well as your steps and efforts to comply.
Submitting Attestations through HIOS
Attestations must be submitted electronically via the U.S. Department of Health and Human Services (HHS) HIOS online portal. HIOS is the acronym for the Health Insurance and Oversight System, and it is a web-based application that allows a department within HHS, the Center for Consumer Information and Insurance Oversight (CCIIO or CMS) to collect health insurance data and information.
Assign yourself or an appropriate individual within your organization, in advance of the deadline, to become familiar with and understand how to move around within the HIOS system as well as successfully complete and submit an attestation.
To that end, please see these important instructions to get started as well as links to HIOS helpful resources.
Instructions for HIOS
Go to https://hios.cms.gov/HIOS-GCPCA-UI and click on “don’t have a code or forgot yours.”
Once you have a code, go back to https://hios.cms.gov/HIOS-GCPCA-UI and insert the code and access the system.
Once in the system, open this link https://www.cms.gov/files/document/hios-gcpca-usermanual-020000.pdf on another screen. This link will open a document from CMS that contains written step by step instructions as well as helpful screen shots illustrating each step you will encounter within the online system. If you’d like, you can skip to page 11 of this document and start with section entitled “6 – Get Started with your GCPCA submission.”
For more information, including an overview and more detail about the rules and submitting the attestation, you can reference Annual Submission Instructions at https://www.cms.gov/files/document/gag-clause-prohibition-compliance-attestation-instructions.pdf.
IMPORTANT TIP: Note that within these instructions, there are two different paths for attesting, Option A and Option B. Please ensure you are using the appropriate option.
Option A: An employer that sponsors a single group health plan that offers more than one benefit package within the group health plan (such as a Health Maintenance Organization (HMO) and a Preferred Provider Organization (PPO)) is a single plan/Responsible Party and may submit a single attestation under Option A, and even if one or more coverage types are fully insured and the others are self-funded. Instructions for Option A begin on page 10 of the Annual Submission Instructions.
Option B: If an employer sponsors more than one group health plan (and, in the case of plans subject to ERISA, has more than one ERISA plan number), each such plan is a Responsible Entity and each plan must attest using Option B. Instructions for Option B begin on page 15 of the Annual Submission Instructions.
January 2025
