By: HUB’s EB Compliance Team

As 2025 comes to an end, plan sponsors of ERISA, church and governmental plans should submit their Gag Clause Prohibition Attestation (“Gag Clause Attestation”) to the Centers for Medicare and Medicaid Services (CMS) no later than December 31, 2025. The attestation is submitted via the CMS’ HIOS website and reports a plan sponsor’s Gag Clause compliance for the 2025 calendar year (“the attesting year”). For more information about this mandate, which has been in effect since 2022, please refer to this HUB Alert: Gag Clause Prohibition Attestation.

What do plan sponsors attest to or certify under the Gag Clause?

The Gag Clause requires group health plan sponsors to attest that during the attesting year, they did not enter into an agreement with a health care provider, network, association of providers, Third Party Administrator (TPA), Pharmacy Benefits Manager (PBM) or other service provider offering access to a network of providers that would directly or indirectly restrict the plan from:

  1. Making provider-specific cost or quality of care information or data available to eligible participants, beneficiaries and enrollees
  2. Electronically accessing de-identified claims and encounter information or data for each covered participant upon request or
  3. Sharing the information noted in 1 and 2 above or directing such data be shared, with a business associate

As discussed in our January 2025 Alert, under newer guidance issued by the DOL, Treasury Department and HHS (Tri-Agencies) in FAQ 69, plan sponsors must also attest that their contracts do not contain any of the following clauses for the 2025 calendar year:

  1. Downstream Agreements that limit a plan’s access to information: A plan may not enter into an agreement with a TPA or other service provider, if that TPA or provider subcontracts the plan or network administration to a third party, and that agreement with the third party (the “downstream agreement”) prohibits the plan from providing, accessing or sharing the information noted in items 1 and 2 (in the list above).
  1. Restrictions on sharing de-identified claims data with a business associate: The contract will be deemed to include a gag clause if the ability to share de-identified claims data is left to the discretion of the health care provider, network, TPA, association of providers or other vendor offering access to a network of providers.
  1. Restrictions on the Access to De-Identified Claims and Information or Data, as Part of a Claims Audit or Review. Plan sponsors must ensure that their service agreements do not:
  • Limit access to a statistically significant or the "minimum necessary" number of de-identified claims
  • Limit the scope of access to the data for specific, narrow purposes (such as limiting access solely to the context of an audit)
  • Unreasonably limit the frequency of claims reviews (e.g., no more than once per year)
  • Limit the number and types of de-identified claims that a plan or issuer may access
  • Restrict the data elements of a de-identified claim that a plan or issuer may access and
  • Provide access to de-identified claims data only on the TPA's or service provider's physical premises

Are plan sponsors still required to complete and file a Gag Clause Attestation if their agreements contain one or more gag clauses?

Yes, the group health plan sponsors noted above are still required to complete and file a Gag Clause Attestation via the HIOS website if their service agreements contain one or more gag clauses. In this situation, the plan sponsor will need to complete the Additional Information box in Section 3, (“Responsible Entity’s Details”) using the following information:

  • Any prohibited gag clauses that a service provider has refused to remove
  • The name of the TPA or service provider with which the plan has the agreement containing the prohibited gag clause
  • Conduct by the TPA or service provider that shows the service provider interprets the agreement to contain a prohibited gag clause
  • Information that shows that the plan sponsor requested that the prohibited gag clause be removed from the agreement and
  • Any other steps the plan has taken to come into compliance with the elimination of gag clauses

Note that the text box is limited to 1000 words, so the plan sponsor or plan representative completing the attestation must be succinct. Failure to complete a Gag Clause Attestation may result in enforcement action from regulatory entities.

If an insurance carrier or third-party vendor completes a Gag Clause Attestation on behalf of the plan sponsor, is the plan sponsor required to complete a separate Gag Clause Attestation?

No, if the insurance carrier or third-party vendor attests for all agreements sponsored by the plan sponsor, the plan sponsor is not required to file a separate attestation. For example, if a medical insurance carrier files an attestation for all insured medical plans offered by a plan sponsor, the carrier attestation will relieve the employer from submitting a separate Gag Clause attestation. However, if the employer offers both an insured medical plan and a self-insured medical plan, the plan sponsor would have to complete a Gag Clause Attestation for their self-insured medical plan agreements. This may be necessary if the self-funded plan’s TPA, PBM or other vendor will not file an attestation on the plan’s behalf. Note that the HIOS site allows reporting entities to select the programs and contracts they are attesting for, which allows flexibility to the plan sponsor to attest only for the plans where other vendors are not providing attestations.

Next Steps

Employers and plan sponsors should review their service agreements to ensure they do not contain gag clauses. They should also confirm if their medical insurance carrier, TPA, PBM or other service provider will complete a gag clause attestation on their self-insured plan’s behalf. Employers and sponsors required to complete a Gag Clause Attestation for 2025 should be prepared to file their attestation no later than December 31, 2025.

New and recurrent reporting entities can rely on the GCPA Instructions and the CMS User Manual to complete their gag clause attestations or contact the CMS Marketplace Service Desk for assistance via email at CMS_FEPS@CMS.HHS.gov or via phone by calling (855)267-1515. For the first time since 2022, reporting entities will receive a confirmation email from CMS, acknowledging that the GCPA was successfully submitted. We recommend that employers and plan sponsors retain a copy of the confirmation email and a copy of the GCPA submission itself (a copy can be printed or downloaded from the HIOS site) with other benefit plan records.

If you have any questions, please contact your HUB Advisor. View more compliance articles in our Compliance Directory.

NOTICE OF DISCLAIMER

Neither HUB International Limited nor any of its affiliated companies is a law or accounting firm, and therefore, they cannot provide legal or tax advice. The information herein is provided for general information only and is not intended to constitute legal or tax advice as to an organization’s or individual's specific circumstances. It is based on HUB International's understanding of the law as it exists on the date of this publication. Subsequent developments may result in this information becoming outdated or incorrect and HUB International does not have an obligation to update this information. You should consult an attorney, accountant or other legal or tax professional regarding the application of the general information provided here to your organization’s specific situation in light of your or your organization’s particular needs.