CAA Gag Clause Prohibition Compliance Attestations

Health plans and issuers must submit a Gag Clause Prohibition Compliance Attestation (GCPCA) to show compliance with the gag clause prohibition of the Consolidated Appropriations Act, 2021 (CAA). The prohibition applies to all agreements entered into on or after the date that the CAA was enacted (December 27, 2020) and must be submitted annually by December 31.

The CAA prohibits plans and issuers from entering into agreements with a health care provider, network or association of providers, third-party administrator (TPA), or other service provider offering access to a network of providers if those agreements (or any underlying agreements) contain gag clauses.

A “gag clause” is a contractual provision that would directly or indirectly restrict a plan or issuer from providing, accessing, or sharing certain information related to cost or quality of care or de-identified claims and encounter information.

The CAA requires plans and issuers to submit attestations of compliance annually. Attestations are due by December 31 of each year and cover the period since the last attestation was submitted.

All employer-sponsored group health plans must submit a GCPCA. This applies to fully insured and self-insured/level-funded medical plans, ERISA plans (or sponsors of ERISA plans), non-federal governmental plans, church plans, and grandfathered group health plans.

Issuers offering individual and group health insurance coverage must submit a GCPCA. This includes student health insurance plans, grandfathered and grandmothered plans, policies sold on or off Exchanges, policies sold through an associate, and all other group health insurance plans.

Under a limited exception, issuers and group health plans providing only excepted benefits coverage, account-based plans like HRAs, issuers that offer only short-term, limited-duration insurance, Medicare and Medicaid plans, state children’s health insurance programs plans, and Basic Health Program plans are not subject to the attestation requirement.

Self-funded plans must confirm with their service provider (ASO, TPA, PBM, etc.) whether the service provider will complete the attestation for the plan or if the plan must submit the attestation itself and follow the service provider’s instructions accordingly.

Benecon is not a service provider and Benecon contracts are not subject to the gag clause attestation requirement. Therefore, Benecon will not be filing any attestations on behalf of employers.

If the service provider is willing to complete the attestation, the plan and service provider must enter into a written agreement confirming the service provider’s intention to complete the attestation. Even with the written agreement, the plan retains ultimate liability for any failure to attest.

If the service provider is unwilling to complete the attestation on the plan’s behalf, the plan should still ask for written confirmation that the existing agreements are in compliance with the gag clause prohibition. If the service provider does not provide written confirmation, the plan should review the existing agreements to ensure compliance.

For fully insured plans, both the insurance issuer and the group health plan are required to attest. However, when an issuer submits a GCPCA on behalf of the plan, the attestation requirement will be considered satisfied for both the plan and issuer. In this instance, and when there are no other health benefits subject to the requirement (e.g., a carve-out pharmacy benefit), no action is required of the plan other than to retain documentation from the issuer that the issuer is submitting the GCPCA on behalf of the plan.

Carve-Out Pharmacy, Behavioral Health, and Other Medical Benefits (Direct Primary Care, Telehealth Programs, etc.)

For carve-out benefits, employers are required to submit attestations of compliance. Although a plan is permitted to enter into a written agreement under which a pharmacy benefits manager, behavioral health vendor, or other similar service provider would attest on the plan’s behalf.

Employers with these types of carve-out arrangements will need to attest on behalf of these benefits (in addition to the other medical benefits, if not being completed by the issuers or service providers).

Plans will need to take inventory of which health benefits are subject to the requirement, verify with the issuer or service provider that provider contracts are compliant, and determine who is submitting attestations. Many issuers and service providers have already communicated whether they will or will not assist with attestations.

If you need to complete an attestation, visit https://hios.cms.gov/HIOS-HCPCA-UI to log in to the GCPCA webform and complete the form.

Instructions, a user manual, and FAQs can be found on the Centers for Medicare & Medicaid Services webpage at https://www.cms.gov/marketplace/about/oversight/other-insurance-protections/gag-clause-prohibition-compliance-attestation

Benecon has also created a comprehensive Annual Submission Instructional Guide to be used in conjunction with the CMS instructions.

Failure to comply with the attestation requirement could be subject to the standard Internal Revenue Code penalty scheme, which is $100 per day per affected individual.