What is a gag clause in health plan contracts?

A gag clause is a contractual provision that prevents a health plan from accessing, sharing, or using provider-specific cost and quality data. For example, a TPA contract might prohibit the employer from sharing claims data with a third-party analytics vendor, or a carrier contract might prevent the employer from disclosing provider-specific pricing. The CAA 2021 prohibits these clauses in health plan contracts effective December 27, 2020.

What is the gag clause attestation requirement?

The CAA requires health plans and health insurance issuers to annually attest to CMS that their contracts do not contain prohibited gag clauses. The attestation is submitted through the CMS Health Insurance Oversight System (HIOS). The first attestation was due December 31, 2023, with annual attestations required by December 31 each year thereafter. Self-funded employers must submit the attestation directly or through their TPA.

How do I submit the gag clause attestation?

Self-funded employers submit the gag clause attestation through the CMS HIOS portal (hios.cms.gov). You will need a CMS Enterprise Portal account and your plan's EIN and plan year information. Many TPAs offer to submit the attestation on behalf of their self-funded clients — confirm with your TPA whether they will submit on your behalf or whether you need to submit directly. Keep documentation of the attestation submission for your compliance records.

What contracts should employers review for gag clause language?

Review all health plan vendor contracts for gag clause language, including: TPA agreements, PBM contracts, stop-loss carrier contracts, network access agreements, disease management vendor contracts, and any other vendor that handles claims data or provider pricing information. Look for provisions that restrict data sharing, limit the employer's ability to use claims data with third parties, or prohibit disclosure of provider-specific pricing or quality information.

What are the penalties for failing to submit the gag clause attestation?

The CAA does not specify a direct penalty for failing to submit the gag clause attestation, but failure to comply with CAA requirements can trigger ERISA enforcement actions by the DOL and excise tax penalties under IRC Section 4980D ($100 per day per affected individual). CMS has indicated it will use attestation data to identify plans that may have prohibited gag clauses and refer them for further review. Submitting the attestation is a low-effort compliance step that should not be skipped.

CAA — Gag Clause Prohibition

Gag Clause Attestation for Employer Health Plans

The Consolidated Appropriations Act of 2021 prohibits health plans and issuers from entering into contracts with providers, TPAs, or other service providers that include "gag clauses" — terms that restrict the plan's ability to share cost, quality, or claims data. Employers must attest annually that their plan contracts comply with this prohibition.

Annual attestation deadline

The gag clause attestation is due by December 31 each year. Attestations are submitted through the CMS Health Insurance Oversight System (HIOS) at hios.cms.gov. The plan sponsor or a designated submitter (such as the TPA or insurer) can submit on the plan's behalf, but the plan sponsor remains responsible for compliance.

What the CAA prohibits

Plans cannot enter into contracts that include any of the following types of restrictions:

Provider-specific cost data restrictions: Contract terms that prevent the plan from sharing provider-specific cost or quality data with plan participants, employers, or plan sponsors.

Claims data restrictions: Terms that restrict the plan from sharing de-identified claims data with third parties for analysis, benchmarking, or plan management purposes.

Formulary data restrictions: Terms that prevent the plan from sharing formulary information, drug pricing, or rebate data with plan sponsors or participants.

Network adequacy data restrictions: Terms that restrict the plan from disclosing provider network composition, tiering, or adequacy information.

Benchmarking data restrictions: Terms that prevent the plan from using claims or cost data for benchmarking against other plans or industry standards.

How to complete the attestation

Review all plan contracts: Review your TPA agreement, PBM contract, network access agreements, and any other service contracts for gag clause language.

Obtain written confirmation: Request written confirmation from your TPA, PBM, and network vendors that their contracts do not contain prohibited gag clauses.

Register in HIOS: The plan sponsor or designated submitter must register in the CMS HIOS system. TPAs can register as submitters on behalf of self-funded plans.

Submit the attestation: Complete the attestation form in HIOS by December 31. Retain a copy of the submission confirmation for your records.

Document annually: Repeat this process each year. Maintain documentation of your contract reviews and submission confirmations.

Common gag clause attestation mistakes

Missing the December 31 deadline because no internal owner was assigned

Assuming the TPA submitted without obtaining written confirmation

Failing to review PBM contracts for data-sharing restrictions

Not retaining submission confirmation records

Overlooking network access agreements that may contain data-sharing restrictions

Review your plan's compliance posture

Use our free tools to assess your plan's CAA compliance readiness and identify contract language that may need to be addressed.

Get a free plan checkup