A newer federal requirement under the Consolidated Appropriations Act (CAA) has created confusion for both employers and agents: the Gag Clause Prohibition Compliance Attestation, often shortened to GCPCA. It applies to most group health plans, it’s now an annual requirement, and failure to file can trigger federal enforcement.
Here’s a clear overview of what it is, who must file, and how the attestation works.
What Is the Gag Clause Attestation?
The CAA prohibits group health plans and insurers from having “gag clauses” in any agreements with providers, networks, or TPAs. A gag clause is any contractual restriction that prevents a plan from accessing or sharing:
-
Provider cost information
-
Provider quality information
-
Claims or encounter data
-
De-identified data needed for transparency tools
Because gag clauses are banned, group health plans must attest annually that they do not have prohibited restrictions in place. That attestation is filed with the federal government.
When Did the Requirement Begin?
The ban on gag clauses has been in effect since December 27, 2020.
The first required attestation covered 12/27/2020 through 12/31/2023, with a filing deadline of December 31, 2023.
Going forward, the attestation must be submitted every year by December 31.
Who Must File?
Most group health plans must file, including:
-
Fully insured plans
-
Self-funded plans
-
Level-funded plans
-
Governmental plans
-
Church plans
-
MEWAs and association plans
Plans that do NOT have to file
-
Excepted benefits (stand-alone dental/vision, EAP-only, etc.)
-
HRAs and FSAs
-
Retiree-only plans
Who actually submits the filing?
It depends on the funding arrangement:
| Fully Insured Carrier Files |
In almost all cases, the insurance carrier submits the attestation on behalf of the employer. Most carriers do this automatically as part of their standard compliance functions. |
|---|---|
| Self-Funded or Level-Funded Employer Responsible |
These plans are required to attest, but they typically rely on their TPA or compliance partner to file. Even when filing is delegated, the plan sponsor (employer) remains legally responsible for making sure it is completed. |
How the Attestation Is Filed
Attestations are submitted through the CMS HIOS Portal.
The government does not accept paper submissions.
The filer must submit:
-
Plan sponsor information
-
Whether the plan is fully insured or self-funded
-
Confirmation that no prohibited gag clauses exist
-
The reporting period covered
-
An electronic signature/attestation
This process is simpler than RxDC reporting and generally takes just a few minutes once delegation is set up.
Penalties for Not Filing
The statute does not list a specific dollar penalty, but federal agencies—CMS, DOL, and IRS—treat failure to attest as a compliance failure.
Possible consequences include:
-
$100 per affected individual per day (the standard ERISA civil penalty)
-
Requests for corrective filings
-
Investigation or audit activity
-
Enforcement actions for continued non-compliance
Federal agencies have publicly stated that they will ask for proof of attestation during audits.
Why This Requirement Matters
The Gag Clause Attestation is important because it supports the CAA’s broader transparency goals. It ensures that plans and insurers cannot hide provider cost, quality, or reimbursement information—data that is increasingly important for price-comparison tools, cost-sharing transparency, and future reforms.
For employers, this is a necessary annual compliance item.
For agents, it’s one more area where clear guidance can prevent an accidental violation.
Summary
-
The CAA bans gag clauses that limit access to cost, quality, or claims data.
-
Most group health plans must file a Gag Clause Attestation annually by December 31.
-
Fully insured carriers usually file automatically; self-funded groups often need their TPA to submit.
-
Employers remain responsible for confirming that the attestation is completed.
-
Failure to file can lead to federal penalties and compliance issues.