FAQs Address Gag Clause
Prohibition and Attestation

The Departments of Labor, Health and Human Services (“HHS”), and the Treasury (collectively, “the Departments”) issued FAQ 57, providing the first guidance as it relates to the prohibition on gag clauses in provider agreements and the annual attestation as required under the Consolidated Appropriation Act of 2021 (“CAA-21”).
Among other things, the guidance requires group health plans and health insurance carriers to submit an annual attestation with the first attestation due no later than December 31, 2023.
Below you will find additional clarification provided by the FAQs:

What is a “gag clause?”

A “gag clause” is a contractual term that directly or indirectly restricts specific data and information that a plan or issuer can make available to another party. These clauses may be found in agreements between a plan or carrier and any of the following parties:
• a health care provider;
• a network or association of providers;
• a third-party administrator (“TPA”); or
• another service provider offering access to a network of providers.

Under the CAA-21, group health plans and carriers offering group health insurance are prohibited from entering into
agreements with providers, TPAs or other service providers that include language that would constitute a “gag clause”
and restrict:
1. Disclosure of provider specific cost or quality of care information to referring providers, the plan sponsor,
participants, beneficiaries and or any other plan members;

2. Electronic access to de-identified claims and encounter information or data for each participant, beneficiary
or enrollee in the plan upon request and consistent with relevant privacy rules; and

3. Sharing information or data described above or directing that such information or data be shared with
a business associate.

Plans and carriers must annually submit to the Departments an attestation that the plan or carrier complies with
these requirements (“Attestation”).

The Attestation

The first Attestation is due no later than December 31, 2023, covering the period from December 27, 2020 through the
date of the Attestation. Subsequent Attestations will be due by December 31 of each year and cover the period since
the last Attestation was submitted.
The Attestation must be submitted to the Centers of Medicare and Medicaid Services (“CMS”) through a webform.
An authentication code to access to the web form is required and generated upon request. CMS issued a detailed
instructions document with relevant submission information, which can be found at
https://www.cms.gov/files/document/gag-clause-prohibition-compliance-attestation-instructions.pdf.
A reporting entity, generally the group health plan or group health insurance carrier, is responsible for ensuring either
that it annually attests or has another party (e.g., carrier, TPA) attest on its behalf that the reporting entity is in compliance with the prohibition on gag clauses.

Fully insured plans

If a group health plan is fully insured, both the carrier and the plan are subject to the Attestation. However, the Departments will consider both the carrier and the plan to have met the attestation requirement if the carrier submits Attestations on behalf of the plan. Employers with fully insured plans should confirm the carrier will handle this obligation.

Self-funded (including level funded plans)

A self-funded plan is responsible for compliance and may satisfy the requirement by entering into a written agreement under which the plan’s service provider (e.g., TPA) attests on its behalf. But like other CAA provisions, the legal responsibility will remain with the plan. Employers should seek written assurances from TPAs and other services providers that they will submit the attestation on their behalf.
The following plans are not subject to the requirement, and therefore do not need to attest:
• Account based plans such as a health FSA, HRA and ICHRA
* Excepted benefits, such as hospital indemnity insurance, dental and vision
• Short-term limited duration insurance

Employer Action

Employers should ensure that their group health plans do not include language or other restrictions that are
considered “gag clauses” and coordinate with relevant carriers, TPAs and other service providers to timely submit
the Attestation. The first due date is December 31, 2023. It should be noted that, although the first Attestation is not
due until December 31, 2023, some employers have already received letters from HHS indicating that CMS is now
collecting Attestations.
Employers with fully insured plans should confirm carriers will submit the Attestation on behalf of the insured group
health plan. No further action is required if the carrier handles this step.
Employers with self-funded plans should enter into an agreement to have their TPA, PBM or other third party submit
the Attestations on its behalf.