The Consolidated Appropriations Act of 2021 (the CAA) requires group health plans and health insurance carriers to attest on an annual basis that they are in compliance with the CAA’s gag clause prohibition. While the prohibition of gag clauses was effective December 27, 2020, the first annual attestation is due December 31, 2023. Group health plan sponsors should begin taking steps now to prepare.

What Is a Gag Clause?

A gag clause is a contractual term that indirectly or directly restricts sharing of certain data and information with a third party. The CAA prohibits group health plans and health insurance carriers from entering into an agreement with a health care provider, network or association of providers, third party administrator (TPA), pharmacy benefit manager (PBM) or other service provider that contains a “gag clause” that restricts a plan or issuer from:

• providing provider-specific cost or quality of care information or data to referring providers, the plan sponsor, participants, beneficiaries, or enrollees, or individuals eligible to become participants, beneficiaries, or enrollees of the plan or coverage;

• electronically accessing de-identified claims and encounter information or data for each participant, beneficiary, or enrollee upon request, consistent with HIPAA, GINA and the ADA; and

• sharing information or data described in (1) and (2) above, or directing such information or data be shared with a HIPAA business associate, consistent with HIPAA, GINA and the ADA.

Who Is Required to Submit a Gag Clause Attestation?

To ensure compliance with this “gag clause” prohibition, the CAA requires that the following entities certify their compliance by submitting a Gag Clause Prohibition Compliance Attestation (GCPCA or Gag Clause Attestation) to the Departments of Labor, Health and Human Services, and Treasury (the “Departments”):

• Health insurance carriers offering group health insurance coverage;

• Health insurance carriers offering individual health insurance coverage, including student health insurance coverage and individual health insurance coverage issued through an association; and

• Fully insured and self-insured group health plans (regardless of grandfathered status), including ERISA plans, non-Federal governmental plans, and church plans subject to the Internal Revenue Code.

The GCPCA does not apply to excepted benefits such as standalone dental, vision, health flexible spending accounts and certain employee assistance plans. In addition, FAQs (Part 57) issued by the Departments (the Tri-Agency FAQs) state that a GCPCA will not be required for plans that consist solely of health reimbursement accounts and other account-based health plans because the benefit design of such plans precludes the need to enter into agreements with providers, therefore, making the concepts related to the prohibited gag clauses inapplicable.

Plan sponsors and carriers of fully insured plans are both required to submit a GCPCA. The Tri-Agency FAQs, however, provide that if the insurance carrier submits the GCPCA on behalf of the plan, the Departments will consider the plan (and insurer) compliant. Sponsors of fully insured plans, however, should confirm that the carrier will be submitting the GCPCA on the plan’s behalf.

Sponsors of self-insured plans may satisfy the GCPCA requirement by either (1) submitting the GCPCA on its own behalf, or (2) entering into a written agreement with the plan’s service provider/TPA stipulating that the service provider/TPA will timely submit the plan’s GCPCA. However, even if a plan chooses to enter into an agreement with the service provider/TPA, the plan is still legally responsible for ensuring the GCPCA is timely submitted. Sponsors of self-insured plans should consult with their service provider/TPA to determine who will submit the GCPCA.

When Must the Gag Clause Attestation be Submitted?

The first GCPCA is due no later than December 31, 2023 and covers the period from December 27, 2020, through the date of the attestation.  Subsequent attestations are due December 31 of each year.

How is the Gag Clause Attestation Submitted?

The GCPCA must be filed using the GCPCA website. An authentication code is required in order to access the platform where the GCPCA is to be completed and submitted. A code may be requested by visiting the log-in portal of the platform and selecting the “Don’t have a code or forgot yours?” link. For additional information, resources, and instructions, plan sponsors may visit the CMS website to access instructions for submitting the GCPCA and a user manual.

What Are the Penalties for Failing to Submit a Gag Clause Attestation?

While there are no specific penalties outlined in the CAA for failing to timely submit the GCPCA, the Tri-Agency FAQs state that failing to submit the attestation by the deadline may subject the plan or carrier to enforcement action, which typically might permit a penalty assessment of up to $100 per day per affected individual for noncompliance under Internal Revenue Code Section 4980D.

What Do Plan Sponsors Need to Do Now to Prepare for the Gag Clause Attestation?

If not done already, plan sponsors should review all health plan contracts/service agreements to ensure they do not include any provisions that would violate the CAA’s prohibition against “gag clauses” and amend those contracts accordingly. This applies to all current contracts as well as any new contracts. In addition, plan sponsors may want to further amend these contracts or enter into a separate agreement with the issuer or service provider/TPA delegating the responsibility for timely submitting the GCPCA. Please contact our Employee Benefits and Executive Compensation attorneys for assistance in complying the GCPCA requirements.