Gag Clause Prohibition Attestation

• Service-provider contracts: Agreements with your carrier or TPA, PBM, and any third party that creates or maintains provider networks or handles claims/cost data. These are what you are attesting about.
• Written confirmation from each provider that its agreement does not restrict the plan's access to de-identified provider-specific cost and quality-of-care data, or its ability to share that data with participants or referring providers (subject to HIPAA and reasonable confidentiality terms).
• Plan information for the form: Plan/employer name, EIN, plan sponsor contact details, and the type of plan (group health plan vs. issuer).
• CMS portal access: The CMS GCPCA submission system at hios.cms.gov/HIOS-GCPCA-UI. No CMS/HIOS login is required; the GCPCA system uses a stand-alone web form.
• Prior submission receipt: Confirmation of the previous year's attestation, so you know the period this year's attestation must cover.

• Primary method: The CMS GCPCA web system at hios.cms.gov/HIOS-GCPCA-UI. The attestation is collected on behalf of the Departments of Labor, Health and Human Services, and the Treasury.
• No participant delivery: Unlike most plan notices, the GCPCA is filed with CMS only. There is nothing to distribute to employees or participants.
• Carrier submissions (fully-insured): If the carrier submits on the plan's behalf, that satisfies the plan's obligation; no separate employer filing is required. Confirm in writing.
• Multiple plans: A submitter attesting for several plans or many reporting entities can use the CMS Excel template to upload them in one submission rather than completing the web form repeatedly.

• The CMS confirmation for each year's attestationScreenshot or saved page; the system does not email a receipt.
• Written assurances from each carrier, TPA, and PBMThat their agreements contain no prohibited gag clauses.
• Your internal contract review notesShowing what you checked and when.
• For fully-insured plansThe carrier's written confirmation that it submitted the attestation on the plan's behalf.
• RetentionRetain records at least 7 years, consistent with ERISA document-retention practices and common audit lookback periods.

Common traps

FAQs

What exactly is a "gag clause"?

A contract term that directly or indirectly restricts the plan from (1) accessing de-identified provider-specific cost or quality-of-care information, (2) sharing that information with participants, beneficiaries, or referring providers, or (3) accessing and using its own de-identified claims data. Reasonable confidentiality protections that don't have these effects are still permitted.

We're fully-insured, do we have to do anything?

Usually not, if your carrier submits the attestation on the plan's behalf, which most do. Get written confirmation. If the carrier won't, the plan must submit its own attestation.

We're self-funded and our TPA won't sign, can we still attest?

Yes. The plan sponsor submits the attestation directly through the CMS GCPCA system. You're attesting based on your own review of the contracts and the assurances you obtained from your vendors.

Do HRAs or health FSAs need to attest?

No. Account-based plans (any HRA, including ICHRAs) and plans consisting solely of excepted benefits (health FSAs, stand-alone dental/vision, most EAPs) are not required to submit the GCPCA.

What period does each attestation cover?

Each attestation covers the period back to the date of your prior attestation. The very first attestation covered December 27, 2020 (the date the CAA gag-clause prohibition took effect) through the date of attestation.

The submission system, instructions, and Excel template are in Templates & Resources below.

• FAQs About ACA Implementation Part 57: The tri-agency guidance (DOL/HHS/Treasury) explaining the gag-clause prohibition and attestation requirement.
• Consolidated Appropriations Act, 2021: The statute creating the gag-clause prohibition (ERISA Section 724, PHSA Section 2799A-9, and IRC Section 9824).

• Fully-insured vs. self-funded: For fully-insured plans, the carrier can submit on the plan's behalf and satisfy the requirement. For self-funded and level-funded plans, the plan sponsor is responsible and typically submits directly because TPAs usually won't sign.
• Level-funded plans: Treated like self-funded plans for this purpose. The plan sponsor is the responsible party even though a stop-loss carrier is involved.
• Carve-out PBM or behavioral-health vendor: The prohibition reaches any agreement affecting access to cost or quality data, so include carved-out PBMs and network vendors in your contract review and vendor-assurance requests, not just the medical carrier or TPA.
• Excepted benefits and account-based plans: Stand-alone dental and vision, health FSAs, most EAPs, and all HRAs (including ICHRAs) are excepted or account-based and are not required to attest. Confirm a plan's status before attesting for it.
• Multiple plans under one sponsor: A sponsor with several group health plans can cover them in a single submission using the CMS reporting-entity template rather than filing separately for each.

★There's no paper form to mail; the attestation is completed online through the CMS GCPCA system. Use the official links below to submit, and the instructions and Excel template if you're attesting for more than one plan.