Under the Consolidated Appropriations Act, 2021 (CAA), group health plans and health insurance issuers are required to annually attest that they are in compliance with the CAA’s gag clause prohibition. On a high level, the CAA’s gag clause prohibition rule essentially prohibits plans and issuers from entering into agreements with providers, TPAs, or other service providers that would restrict (i) provider-specific cost or quality information sharing with plan members or (ii) claims data (including individual claims pricing) sharing with plan sponsors (and their service providers).

Per guidance released on February 23, 2023 by the Departments of Labor, Health and Human Services, and the Treasury (collectively, the “Departments”), the Gag Clause Prohibition Compliance Attestation (GCPCA) can now be submitted here. The first GCPCA is due by December 31, 2023, covering the period beginning December 27, 2020 (or the effective date of the applicable group health plan or health insurance coverage, if later) through the date of attestation; subsequent GCPCAs are due by December 31 of each year and cover the period since the last GCPCA was submitted.

The recently released guidance on the GCPCA, including Frequently Asked Questions, submission instructions, a submission user manual and the reporting template, is available here. To review all of the major CAA requirements, you can access our checklist for plan sponsors here and our checklist for plan service providers here.

As with other CAA requirements, a self-insured plan can enter into an agreement to have their TPA, PBM or another third party submit the GCPCA on their behalf, but the legal responsibility to submit a timely attestation remains with the plan. Likewise, fully-insured group health plans may offload the responsibility for submission of the GCPCA to the health insurance issuer, if done in writing. An issuer that both offers group health insurance and acts as a TPA for self-insured group health plans can submit a single GCPCA on behalf of itself, its fully-insured group health plan policyholders, and its self-insured group health plan clients. However, to avoid duplication, the Departments recommend that issuers acting as TPAs first coordinate with each plan to ensure that the group health plan does not intend to attest on its own behalf for some or all of its provider agreements. There are specific instructions applicable if an entity is submitting the GCPCA on behalf of multiple plans.

Entities not required to attest are issuers of only excepted benefits plans or short-term limited-duration insurance, Medicare and Medicaid plans, CHIP, TRICARE, Indian Health Service Program, and Basic Health Program Plans. The Departments will not enforce the requirement to submit a GCPCA against plans that consist solely of health reimbursement arrangements (HRAs), or other account-based group health plans.

Practically speaking, the heavy lifting associated with submission of the GCPCA is likely to fall on issuers and TPAs. Plans and issuers should review their service agreements to determine how the GCPCA is covered and to ensure that everything is on track for a submission to be made by December 31, 2023.