Gag clause attestation — annual December 31 deadline
CAA 2021 §201 prohibits gag clauses in service-provider contracts that block plans from sharing claims data, network rates, or quality information. Every group health plan must annually attest by December 31 that no in-force contract contains a prohibited gag clause. Filed via the CMS Health Plan Management System (HPMS).
What a ‘gag clause’ is, in plain English
The Departments' gag-clause prohibition targets six specific contractual restrictions that block plans from getting access to their own data:
- Restrictions on disclosing provider-specific cost or quality information to plan participants, beneficiaries, enrollees, referring providers, or HHS.
- Restrictions on accessing de-identified claims data and pricing information by plan, sponsor, or business associate (subject to HIPAA and other privacy law).
- Restrictions on the plan sharing or transmitting that information to a third party (a benefits consultant, an independent auditor) — subject to the same privacy floor.
- Restrictions on disclosing network rates to plan participants or beneficiaries (with limited exceptions for negotiated terms still in dispute).
- Restrictions on the plan's ability to disclose provider-specific quality information.
- Restrictions on transferring claims data to a successor plan administrator at contract end.
A contract that includes any of these restrictions is presumed to contain a gag clause. The plan must either renegotiate the provision or terminate the contract before attesting.
What the attestation says
The attestation is a structured submission filed through the CMS HPMS portal. It identifies the plan, the responsible plan fiduciary, and the attestation period (typically the calendar year ending December 31), and certifies that no contract entered into or in force during the attestation period contains a prohibited gag clause.
The plan is expected to have reviewed every in-force service- provider contract — TPA, PBM, network, broker, consultant, vendor — to confirm none contain prohibited language. If any did, the plan should have either terminated the contract or had the provision removed before attesting.
Boilerplate language is the most common trap
The single most common gag-clause finding in 2024–2026 has been standard contract boilerplate that pre-dates CAA 2021 — language like “the foregoing data is confidential and proprietary and may not be disclosed to third parties without prior written consent.” That generic confidentiality clause is a gag clause if it covers cost, quality, or claims data.
The fix is usually a one-page contract amendment carving out CAA §201 disclosures. Most carriers and TPAs have standard amendment language available; some require the plan to ask for it.
What happens if the attestation is missed
The Departments have not published a specific civil-monetary- penalty rate for missed gag-clause attestations. The applicable enforcement framework is ERISA §502(c)(10) (up to ~$160 per day per affected participant, as inflation-adjusted) or PHSA §2723 for issuers. The bigger practical risk: a missed attestation in conjunction with any other compliance gap — Form 5500, RxDC, MHPAEA — surfaces as a pattern in DOL audits.
Late attestations are accepted via the HPMS portal but are flagged to the Departments. File as soon as the gap is identified.
Run a Fiduciary Fitness Audit on your plan
Our free audit walks the same Form 5500 record this guide references — broker compensation against same-size and same-industry peers, Schedule C disclosure, stop-loss adequacy, filing currency, and plan-disclosure breadth. 60 seconds, no login.
Open the audit searchSources
- CMS — Gag Clause Prohibition Compliance Attestation — CMS landing page; HPMS attestation portal opens annually.
- Consolidated Appropriations Act 2021 §201 — Gag Clause Prohibition — Statutory basis for the gag-clause prohibition.
- Departments’ FAQs Part 57 — Gag Clause Attestation guidance — Plain-English Q&A from the Departments on what counts as a gag clause and how to attest.