Six contract clauses that fail the gag clause attestation

ERISA §724(a)(1) bars a group health plan from entering into an agreement with a provider, a network or association of providers, a TPA, or any other service provider offering access to a network that would directly or indirectly restrict the plan from:

1. providing provider-specific cost or quality-of-care information, through a consumer engagement tool or any other means, to referring providers, the plan sponsor, participants and beneficiaries, or people eligible to enroll;
2. electronically accessing de-identified claims and encounter data for each participant, on request and consistent with HIPAA, GINA, and ADA privacy rules, including per-claim financial information such as the allowed amount, provider name and clinical designation, service codes, and any other data element in the claim; or
3. sharing that information, or directing that it be shared, with a business associate as defined in 45 CFR 160.103.

Everything below is a way of doing one of those three things without saying so. How the attestation itself works is in the gag clause attestation guide; the filing steps are in the webform walkthrough.

Look for: the plan pays providers at rates the TPA calls proprietary, and the contract says the plan may not disclose those rates to participants or beneficiaries. FAQs Part 57, Q2 uses exactly this example, a TPA's “Point of Service Rates,” and calls the non-disclosure language a prohibited gag clause.

Ask for: a carve-out allowing the plan to disclose provider-specific cost and quality information to participants, beneficiaries, eligible individuals, referring providers, and the plan sponsor, by any means. The vendor may keep a reasonable restriction on public disclosure (ERISA §724(a)(2)); it may not keep one on disclosure to the people the statute names.

Look for: language that makes the plan sponsor's access to provider-specific cost or quality data subject to the TPA's approval, “as the Administrator may determine,” or “upon request and at Administrator's discretion.” FAQs Part 57, Q2 gives the discretionary-access clause as its second example of a prohibited gag clause.

Ask for: an unconditional right of access for the plan and the plan sponsor, with timing and format spelled out, and no approval step.

Look for: de-identified claims data may be shared with a third party “only with the prior written consent of” the TPA or network, or only with vendors the TPA approves. FAQs Part 69, Q7: an agreement that lets the plan share de-identified claims data with a business associate only at the discretion of the provider, network, or TPA contains an impermissible gag clause, because it could have the effect of restricting the plan.

Ask for: an express right to share the data with any business associate, including a benefits consultant, pharmacy auditor, or data analytics vendor, subject only to a HIPAA business associate agreement.

Look for: access to claims only in an audit; audits no more than once a year; a “statistically significant sample” or “minimum necessary” set of claims; a fixed number or type of claims; stripped data fields; review only on the TPA's premises. FAQs Part 69, Q8 lists each of these as an impermissible gag clause unless the data is otherwise electronically accessible to the plan, because a limit on the scope, scale, or frequency of access is a restriction on the statute's “upon request” right.

Ask for: electronic access to de-identified claims and encounter data, on request, at the claim level, with the data elements the statute lists (allowed amount and other financial fields, provider name and designation, service codes, and every other element in the claim), with no purpose limitation beyond the privacy rules.

Look for: nothing in your contract at all. The restriction sits in a downstream agreement between your TPA and the owner of a rented network or a carve-out vendor, limiting what the TPA may pass to its clients. Since January 14, 2025, the Departments treat that as an indirect restriction on the plan, and the plan is the one in violation (FAQs Part 69, Q6). The tell is a TPA that says it cannot give you rate or claims detail “because of our network agreement.”

Ask for: the provision the Departments say they expect to see in plan–TPA contracts: a covenant that the TPA will not enter into any downstream agreement that restricts the plan from providing, accessing, or sharing the statutory information, plus a representation that no existing downstream agreement does.

Look for: a general confidentiality or “proprietary information” clause, often older than 2021, that covers “all pricing, reimbursement, and claims information” with no exception for the uses the statute protects. It never mentions gag clauses. FAQs Part 57, Q4 says a term that functions to restrict the plan, without explicitly restricting it, is still a prohibited gag clause.

Ask for: a short amendment stating that nothing in the agreement restricts the plan from the three statutory uses, and that the amendment controls over any confidentiality, proprietary-information, or data-use provision. Most carriers and TPAs have this language; some only produce it when asked.

Administrative services agreements, PBM and TPA agreements, network access and rental-network agreements, data-use addenda, business associate agreements, and renewal riders. Read the most recent amendment, not just the original; a clean 2022 amendment can be undone by a 2025 renewal rider. For self-funded plans, ask the TPA which networks it rents and whether any of those agreements limit what it can share (pattern 5).

Do not attest around it. Request the amendment from the vendor in writing and keep the request and the answer. Vendors with standard section 201 language can turn this quickly; others take weeks, so ask in October.

If the vendor refuses, you still attest. FAQs Part 69, Q9 requires a plan that has been unable to remove a non-compliant provision to submit the attestation anyway and identify the provision in the “Additional Information” box at Step 3 of the webform: the clause, the vendor's name, the vendor's conduct, the plan's requests to remove it, and the other steps the plan has taken. The clause may still be a violation, but failing to attest is a separate one and “may be subject to enforcement action.” The same FAQ notes that the Department of Labor may investigate a TPA or service provider whose gag clause keeps an ERISA plan from its claims data.

• By October 31: send amendment requests and ask each TPA about downstream network agreements.
• By November 30: signed amendments back, or refusals documented for disclosure.
• By December 18: attest, following the webform walkthrough, and save the receipt.

Is this list of six official?

No. The statute names three restrictions. The six patterns are the examples the Departments have published in FAQs Part 57 and Part 69, grouped by how they show up in contracts, and Part 69 says its examples are “not an exhaustive list.” Any term that has the effect of restricting one of the three statutory uses fails.

Do stand-alone dental and vision contracts need this review?

A plan or issuer offering only excepted benefits is not required to attest (FAQs Part 57, Q8), so stand-alone dental and vision contracts are outside the attestation. Dental or vision bundled into the medical plan is inside it.

Our carrier attests for us. Do we still have to read anything?

For a fully insured plan, the issuer's attestation on the plan's behalf satisfies the plan's requirement (FAQs Part 57, Q10); confirm in writing that it covers your plan and the year. For a self-funded plan, a TPA may attest under a written agreement, but the legal obligation stays with the plan, and the TPA can only attest to the agreements it administers (Instructions §1.4.2). Any direct contract the plan signed with a PBM, carve-out vendor, or consultant is still yours to review.

Want a second set of eyes on your contracts? Request the free BenefitsLedger audit from the employer search before December 31.