The Consolidated Appropriations Act, 2021 (CAA) prohibits employer-sponsored group health plans from entering into agreements that contain so-called “gag clauses.” This prohibition generally restricts group health plans from entering into agreements that limit the plan’s access to de-identified claims data or the group health plan’s ability to disclose provider-specific information (such as cost and quality information) to certain third parties, including plan participants. In addition, the CAA added a requirement that each group health plan annually attest to the absence of gag clauses in its agreements. The rules do not apply to “excepted benefits,” such as dental and vision plans.

On February 23, 2023, the federal agencies responsible for compliance issued new guidance on these requirements and specified that the first annual attestation is due by December 31, 2023, covering the period December 27, 2020, through 2023. Subsequent attestations will be due by December 31 of each following year. The annual attestation is made through a Centers for Medicare & Medicaid Services (CMS) portal.

Self-insured group health plans may choose to contract in writing with their third-party administrator (TPA) to submit the attestation on their behalf; however, the responsibility to make the filing remains with the group health plan. Similarly, insured group health plans may (and most will be expected to) have the insurer submit the attestation on their behalf, and that will fulfill the plan’s attestation obligation.

The agencies also provided additional guidance on what constitutes a “gag clause.” For example, gag clauses include provisions that, directly or indirectly, treat provider rates as proprietary and restrict disclosures to participants, or provisions that state that rates can only be disclosed at the discretion of the TPA.

We recommend that plan sponsors follow up on two action items:

• Promptly review and amend any agreements with potential gag clauses to the extent necessary in light of the new guidance.
• Reach out to their TPAs or other service providers, including pharmacy benefit managers as appropriate, and coordinate who will submit the attestation with CMS. If the TPA will handle the attestation, plan sponsors will need to enter into a written agreement providing for their submission. Insured plans should coordinate and confirm with that the insurer will handle all CMS attestations.

[View source.]