Don’t Forget About Your Gag Clause Attestations

When the Consolidated Appropriations Act, 2021 (CAA) was enacted on December 27, 2020, it included a provision that prohibits group health plans and health insurance carriers from entering into certain agreements that, either directly or indirectly, restrict the release of certain information related to provider networks and de-identified encounter data, among other things. Such restrictions are commonly referred to as “gag clauses.” The CAA also requires plans and carriers to attest annually that their agreements do not include such impermissible gag clauses. 

The first gag clause attestation was due on December 31, 2023, with the next one coming due by December 31, 2024, which covers the period between the last attestation and the date this year that the attestation is submitted. The attestation was modified somewhat  for 2024, including, among other things, a new requirement to include an attestation year (i.e., the year the attestation is submitted), a new requirement to include the attestation period (i.e., the date range for the attestation, which is the period between when the last gag clause attestation was submitted and the current gag clause submission) and a section to include the plan type (ERISA plan, non-federal governmental plan, or church plan). 

Key gag clause attestation requirements and considerations are described below, though more extensive FAQs can be located (along with the instructions, forms and user manuals for submitting the attestations) on the CMS website.

What is a gag clause?

Under the CAA, a gag clause is defined as:

1. Restrictions on the disclosure of provider-specific cost or quality of care information or data to parties such as the plan sponsor, participants, beneficiaries or referring providers;
2. Restrictions on electronic access to de-identified claims and encounter information or data for each participant, beneficiary or enrollee upon request and consistent with HIPAA, GINA and ADA privacy regulations, including, on a per claim basis —
   1. Financial information, such as the allowed amount, or any other claim-related financial obligations included in the provider contract;
   2. Provider information, including name and clinical designation;
   3. Service codes; 
   4. Any other data element included in claim or encounter transactions; 
3. Restrictions on sharing information or data described in (1) and (2), or directing that such information or data be shared with a business associate.

The gag clause provisions of the CAA (specifically Code Section 9824, ERISA Section 724, and PHSA §2799A-9(a)(1)), generally prohibit plans and carriers from entering into agreements with providers, third-party administrator (TPA) or other service providers that include such provisions.

Where would I typically find a gag clause?

Gag clauses in this context might be found in agreements between a plan or carrier and any of the following parties:

• A healthcare provider;
• A network or association of providers;
• A TPA or pharmacy benefits manager (PBM);
• Another service provider offering access to a network of providers.

Thus, a group health plan should confirm that its carrier, TPA and/or PBM agreements do not contain prohibited clauses. These clauses would typically be found in confidentiality or other privacy provisions of the agreements, though it is important for the agreements to be thoroughly reviewed. We suggest working with your counsel to review the agreement to determine whether it impermissibly restricts access to specific information that would be otherwise covered under the gag clause provisions, or whether there is language that only restricts access to such information in conformity with the gag clause requirements of the CAA or other applicable state or federal law.

To which plans do the gag clause restrictions apply? 

All group health plans (excluding FSAs, HRAs and other excepted benefits such as Dental or Vision Insurance) and insurance carriers are subject to these prohibitions. This includes self-funded and fully insured plans and grandfathered plans, as well as non-ERISA plans sponsored by non-federal governmental employers (i.e., state and local governmental employers) and church plans subject to the Internal Revenue Code.

What is the attestation requirement?

The CAA requires group health plans and health insurance carriers to attest annually to the government that they have no “gag clauses” in their contracts. Plans and carriers must complete the Gag Clause Prohibition Compliance Attestation (GCPA) form electronically, using the form provided by the federal Agencies. 

When is the GCPCA form due?

The attestation is due on or before December 31, 2024, and covers the period since the last preceding attestation. 

Who is responsible for completing the attestation for our group health plan?

That depends on whether the plan is fully insured or self-funded and whether your contractual arrangement with the carrier or TPA. While both the carrier and group health plan are required to submit a GCPCA with respect to a fully insured plan, a carrier may submit a GCPCA with respect to a fully insured plan that will satisfy the plan’s obligation. 

We expect that most carriers will agree to complete the attestation for their fully insured plans. Self-funded plans can contract with their TPA and/or their PBM to complete the attestation on behalf of the plan; however, the plan is ultimately responsible for ensuring the attestation is timely completed. It is important to communicate with your carrier or TPA before the December 31, 2024, deadline to determine who will be completing the attestation on behalf of the plan. 

We recommend ensuring that responsibility for completing the GCPCA is assigned well before the December 31 deadline so there are no surprises. The Agencies released an instruction manual for the webform to assist with completing the attestation when ready for filing.  

Note: Entities reporting on behalf of multiple responsible entities are required to also submit an Excel spreadsheet.

Are there penalties if our group health plan does not complete the attestation?

There are no specific penalties outlined in the CAA; however, in the FAQs, the Agencies indicate that failing to submit the attestation by the deadline may subject the plan or carrier to enforcement action. In such cases, it’s possible for the Agencies to assess a penalty of up to $100 per day per affected individual.

Where can I find more information on gag clauses and completing the attestation?

The FAQs are a good place to start, as well as the HIOS GCPCA User Manual, which explains how to use the GCPCA module within the Health Insurance Oversight System (HIOS). 

Next steps for employers

In preparation for submitting their attestations, employers should consider the following:

• If you have a fully insured plan and the carrier is the same carrier as last year’s, you may want to confirm the same process will be used again this year (e.g., the carrier files the attestation for you or provides you with certification that the plan is in compliance and you submit your own attestation). If it is a new carrier, you should consult with the carrier to determine whether it will be submitting the attestation for the plan.
• Similarly, if your plan is self-funded, and you have the same TPA as last year, you may consider confirming that the TPA will use the same process again this year (e.g., the TPA files the attestation for you or provides you with certification that the plan is in compliance and you submit your own attestation). If it is a new TPA, then you should review the TPA contract and/or consult with the TPA to determine whether it will submit the attestation for the plan.
• If you have separate TPAs, such as a TPA for medical and a PBM for prescription drug benefits, then you will want to ensure the process each of the TPAs will use.
• If your arrangement with your carrier, TPA or PBM is such that you will be responsible for filing the attestation, ensure that you have read all of the instructions for submitting the attestation and that you have completed the registration process.  We recommend registering in advance of the filing deadline to be safe.

About the Author. This alert was prepared for Alera Group by Barrow Weatherhead Lent LLP, a national law firm with recognized experts on the Affordable Care Act and Consolidated Appropriations Act. Contact Stacy Barrow or Nicole Quinn-Gato at sbarrow@marbarlaw.com or nquinngato@marbarlaw.com