Gag clause attestation: CMS webform walkthrough

Every group health plan, insured or self-funded, must attest that it has not entered into an agreement with a provider, a network or association of providers, a third-party administrator, or another service provider offering access to a network that restricts the plan from using its own cost, quality, and claims data. The requirement is section 201 of the Consolidated Appropriations Act, 2021, codified at ERISA §724, IRC §9824, and PHSA §2799A-9, and it is enforced by the Departments of Labor, Health and Human Services, and the Treasury. CMS collects the attestations on the Departments' behalf.

FAQs Part 57, Q8 lists who attests: issuers of group and individual coverage, and fully insured and self-insured group health plans, including ERISA plans, non-federal governmental plans, and church plans, grandfathered or not. Not required: plans or issuers offering only excepted benefits (stand-alone dental and vision, fixed indemnity, disease-specific coverage, on-site clinics), and plans that consist solely of HRAs or other account-based plans, which the Departments have said they will not enforce against. The 2024 instructions add retiree-only plans and self-employed “groups of one” to the not-required list.

One attestation per plan. An employer with one group health plan offering several options (an HMO and a PPO, say) is one Responsible Entity and files once. An employer with more than one ERISA plan number files once per plan number (Instructions §1.4). The background and the three statutory restrictions are in the gag clause attestation guide.

Insured plans. The plan and the issuer are each required to attest, but when the issuer attests on behalf of the plan the Departments treat both as having satisfied the requirement (FAQs Part 57, Q10; Instructions §1.4.2). Most carriers do this for their book of business. Ask the carrier, in writing, whether its attestation covers your plan and for the attestation year in question.

Self-funded and level-funded plans. The plan may satisfy the requirement by entering into a written agreement under which its TPA, PBM, or other service provider attests on the plan's behalf. The written agreement does not by itself satisfy anything: if the TPA then fails to submit, the plan has violated the requirement (Instructions §1.4.2; FAQs Part 57, Q9). If several TPAs each administer a slice of the benefits, each may attest for its slice.

Proof. The instructions say a Responsible Entity whose attestation was submitted by someone else should contact that entity directly to request proof of submission (§2.4). The webform produces a confirmation receipt at the end of Step 5. Get a copy of it from the carrier or TPA and keep it with the plan's records.

The webform asks for a short list of facts (Instructions §2.2, Option A), and the attestation itself assumes someone has read the contracts. Have these ready:

• A list of every agreement in force during the attestation period with a provider, network, TPA, PBM, behavioral health manager, or other vendor that gives the plan access to a network, including the most recent amendment or renewal rider.
• The Responsible Entity's legal name, nine-digit EIN (the plan sponsor's EIN if the plan has none), mailing address, and the three-digit plan number from the plan's Form 5500. A plan not required to file Form 5500 enters 000.
• A point of contact at the plan who can answer the Departments' questions: name, email, phone.
• The date of last year's attestation. This year's attestation period starts the next day; the webform has a “Previous attestation date” button that fills it in.
• Two names: the Attester, an individual with legal authority to act for the plan, who signs; and the Submitter, who may be the same person or someone who keys in the form for the Attester to review.
• Whether you are attesting for all provider agreements or only some (medical network, PBM network, behavioral health network, other). If a carrier or TPA attests for part of the plan, you attest for the rest.

A contract fails if it directly or indirectly restricts the plan from (1) providing provider-specific cost or quality-of-care information to participants, the plan sponsor, or referring providers; (2) electronically accessing de-identified claims and encounter data for each participant, on request, consistent with HIPAA; or (3) sharing that information with a business associate such as a consultant or auditor (ERISA §724(a)(1); FAQs Part 57, Q2). A term that functions as a restriction without saying so counts (Q4). Since January 14, 2025, a TPA's own downstream agreement with a network owner that limits what the TPA can pass to the plan also counts, and the Departments expect plan contracts to prohibit TPAs from entering such agreements (FAQs Part 69, Q6).

Providers and networks may still place reasonable restrictions on public disclosure of the information; that is not a gag clause (FAQs Part 57, Q2). The specific language that fails most often, with the fix for each, is in six contract clauses that fail the gag clause attestation.

If a contract fails, ask the vendor in writing to amend or remove the provision, and keep the request and the answer. Many carriers and TPAs have standard section 201 language; some only provide it when asked, and the request can take weeks. Ask now.

If the vendor refuses, do not skip the attestation. FAQs Part 69, Q9 says a plan that has been unable to remove a non-compliant provision must still submit its attestation and identify the provision in the “Additional Information” box on Step 3 of the webform: the gag clause the vendor refused to remove, the vendor's name, conduct showing the vendor reads the contract that way, the plan's requests to remove it, and any other steps taken. A plan that does not submit at all is in violation of the attestation requirement and may face enforcement action. The same FAQ notes that the Department of Labor may investigate a TPA whose gag clause blocks an ERISA plan from its data.

The user manual and instructions describe one path with five steps. Only the screens and fields below are in those documents.

1. Get a code. On the GCPCA landing page select “Don't have a code or forgot yours?”, enter your email, and select “Get my access code.” The code arrives within about 10 minutes (check spam) and is valid for 14 calendar days. Enter the email and code and select “Login to the system.” You land on a Dashboard with a Submissions table and a “Get started” section that links the instructions, user manual, and Excel template.
2. Step 1, Submitter. Select the attestation year (2026), enter the Submitter's name, title, email, phone, and employer, and check the entity type the Submitter works for (for example “ERISA group health plan (GHP) or sponsor of ERISA plan”).
3. Step 2, Attester. Tick the box if the Submitter is the Attester; otherwise enter the Attester's details.
4. Step 3, Responsible Entity. Answer “No” to “Are you submitting on behalf of more than one plan or issuer?” (Option A). Enter the plan's name, type, EIN, plan number, address, and point of contact; answer whether you are attesting for all provider agreements; enter the attestation period start and end dates; use “Additional Information” only for special considerations such as a disclosed gag clause. A TPA or issuer filing for many plans answers “Yes” and uploads the Responsible Entity Excel template saved as a tab-delimited text file (Option B).
5. Step 4, Review. Check every field. If the Attester is a different person, the Submitter selects “Notify Attester”; the system emails the Attester a unique access code and submission ID from submissions@cms.hhs.gov.
6. Step 5, Attest. The Attester logs in with that code, selects whether the attestation is for a group health plan and/or an issuer, reads the attestation statement, checks the boxes confirming authority and accuracy, types their full name as the signature, and selects “Submit.” A Submission Successful window offers “Print submission receipt.”

The Departments have not published a dollar-per-day penalty specific to a missed attestation. Their stated position is that plans and issuers that do not submit by the deadline “may be subject to enforcement action” (FAQs Part 57, Q7; FAQs Part 69, Q9). The practical risk is the pattern: a missing attestation next to a late Form 5500 or missing RxDC data tells an investigator the plan is not being watched.

On late filing, the CMS materials say only that attestations are “accepted throughout the calendar year” (Instructions §1.6); nothing in them closes the webform after December 31. If you discover a missed year, attest now with an attestation period that reaches back to the day after the last attestation you actually made.

• By October 31: list every network, TPA, PBM, and vendor agreement; ask each vendor for its section 201 amendment language and, for insured and TPA-administered benefits, written confirmation that it will attest for your plan for 2026.
• By November 30: contracts reviewed, amendments signed or refusals documented for the Step 3 disclosure.
• By December 4: Attester and Submitter named; carrier or TPA confirmations in hand; facts from Step 1 above in one place.
• By December 18: code requested, attestation filed, receipt saved. Two weeks of margin before the deadline and the holidays.

Not sure whether your broker, TPA, or PBM contracts would pass? Request the free BenefitsLedger audit from the employer search and see where your plan stands before December 31. The contract language to look for is in the common patterns guide.