Updated Instructions for Gag Clause Attestations

The Departments of Labor, the Treasury, and Health and Human Services (collectively, “the Departments”) recently issued the updated Annual Submission Instructions and User Manual to facilitate the Gag Clause Prohibition Compliance Attestation (“GCPCA”) for 2024.

Background

Briefly, group health plans and health insurance carriers are prohibited from entering into an agreement with a health care provider, network or association of providers, third-party administrators (“TPAs”), or other service provider offering access to a network of providers, that directly or indirectly restricts the plan or carrier from:

• disclosing cost or quality of care information or data, and certain other information, to:

*active or eligible participants, beneficiaries, and enrollees of the plan or coverage,
*the plan sponsor, or
*referring providers.

• electronically accessing de-identified claims and encounter information or data for each participant or beneficiary in the plan or coverage, upon request and consistent with the relevant privacy regulations, or

• sharing such information with a business associate, consistent with applicable privacy regulations.

A group health plan or carrier must annually attest that, for the period of the attestation, it has not entered into any agreements that violate the gag clause prohibition. The annual attestation is submitted through the Centers for Medicare and Medicaid Services (“CMS”) via a webform on the GCPCA homepage. The first attestation was due by December 31, 2023. The next attestation is due by December 31, 2024.

What’s New?
There are a handful of changes made to the information as follows:

• In a separate section of the instructions, the agreements that are subject to an attestation of compliance are clarified to include agreements between group health plans (fully insured or self-funded) and carriers (offering group or individual health insurance coverage) with:
  • health care providers,
  • a network or association of providers,
  • TPAs, or
  • other service providers (including vendors) offering access to a network of providers.
• The term “Reporting Entity” has been changed to “Responsible Entity;” however, the definition remains the same.
  • The Responsible Entity is defined as the plan or issuer that has (directly or indirectly) entered into agreements, usually through a TPA or another vendor (like a pharmacy benefit manger (“PBM”) or behavioral health manager (“BHM”), with health care providers, a network or association of providers, TPAs or other service providers offering access to a network of providers.
• The terms “Attestation Period” and “Attestation Year” have been clarified.
  • The Attestation Period begins on the day immediately following the date of the prior attestation and extends
    to the date of the current attestation.
• The year in which the attestation is submitted is the Attestation Year.
• The list of Responsible Entities (those required to attest) has been updated to include Tribal health plans that qualify as ERISA plans or state or local government plans. In addition, a footnote has been added to address who is the Responsible Entity in a Multiple Employer Welfare Arrangement (“MEWA”).
• The instructions clarify that a single group health plan with multiple benefit packages (e.g., a single plan using a single ERISA plan number that offers a PPO and an HDHP health plan option) is a single Responsible Entity and may submit one attestation. However, if there are multiple group health plans (such as a PPO plan that uses ERISA plan number 501 and a separate HDHP plan that uses ERISA plan number 502) the Responsible Entity will need to file an attestation for each separate plan.
• Additional changes to the webform submission and GCPCA user manual.

Employer Action

Employers should begin to prepare for compliance with the gag clause attestation for Attestation Year 2024, due no later than December 31, 2024.
For fully insured group health plans, the carrier is responsible for submitting the attestation. The employer should confirm that the carrier will submit on behalf of the plan.
For self-funded group health plans (including level-funded plans), the plan sponsor (the employer) is responsible for compliance and remains legally responsible for the attestation. In many cases, the employer will need to act as the Responsible Entity and submit the annual attestation on behalf of the plan.
In some cases, the TPA or other third party will submit the attestation on behalf of the plan. Employers looking to have a TPA or other third party submit the attestation on the plan’s behalf should confirm this in writing with the applicable vendor.
Further, if there are carved out vendors (e.g., PBMs, BHMs) with a contract subject to this provision, employers should confirm no gag clauses exist and either, through written agreement, have the vendor submit the attestation on behalf of the plan or prepare to file on the carve-out portion of the arrangement.
A reminder on the Gag Clause Attestation will be sent out closer to the December 31, 2024, due date.