It’s time for group health plan sponsors to add another reminder to their calendars before the year’s end, as nearly all plan sponsors (that’s you, employers!) are responsible for a new electronic attestation requirement in 2023.

Background

On December 27, 2020, the Consolidated Appropriations Act, 2021 (2021 CAA) was enacted in part to amend the Employee Retirement Income Security Act (ERISA), the Public Health Services Act (PHSA), and the Internal Revenue Code. The 2021 CAA prohibits most group health plans and health insurance carriers from entering into agreements with health providers, third-party administrators (TPAs), or other service providers that include language that would constitute a “gag clause”. A gag clause is any contractual provision that restricts specific data and information that a health plan can make available to another party. Under the 2021 CAA, contracts between parties must not restrict disclosure of the following information: (1) provider-specific cost or quality data being shared with plan members, and (2) claims data, including individual claims pricing, being shared with plan sponsors (and their service providers).

The 2021 CAA gag clause prohibition enables the free flow of health care cost and quality information among insurers, health plans, health care consumers, providers, plan sponsors and their service providers. That free disclosure of information is necessary to optimize the various healthcare transparency provisions contained in the 2021 CAA and the Affordable Care Act (ACA). Once the gag clause prohibition became effective in late 2020, most insurers, TPAs, and other health plan vendors worked quickly to modify their contractual agreements to comply.

Significantly, the 2021 CAA also requires group health plans and health insurance carriers to annually submit an electronic attestation of compliance with the 2021 CAA’s gag clause prohibition to the Centers for Medicare and Medicaid Services (CMS). The first attestation to CMS is due December 31, 2023 (attesting to compliance for 2021 – 2023). Subsequent attestations will be due by December 31 of each year thereafter.

CMS has created this webpage offering FAQs, instructions, a user manual, and other information about how to comply with the gag clause prohibition as well as how to attest to compliance – a process that they’ve labeled the Gag Clause Prohibition Compliance Attestation (GCPCA).

Which Plans Must Comply?

The gag clause prohibition and attestation requirements apply to virtually all employer-sponsored health plans. However, the focus of compliance will be on major medical plans and the contracts maintained between insurers, TPAs, and health plan providers on behalf of such medical plans. Importantly, excepted benefits—including stand-alone dental or vision plans and health FSAs—are exempt, as are account-based health plans (e.g., HRAs) and short-term limited duration benefits.

Who Must Complete the Attestation?

Ultimately, it’s the responsibility of the health plan (and by extension, the sponsoring employer) to satisfy the requirement. Agency guidance issued in March 2023 indicates that carriers (on behalf of fully-insured plans) and TPAs (on behalf of self-funded plans) are permitted to attest for group health plans in the place of their sponsoring employers (subject to a written agreement between parties). However, aside from a few exceptions among carriers of fully-insured plans, the prevailing approach by most vendors has been to submit a general statement of confirmation of their own compliance with the gag clause rules and defer to the plan sponsor to take action to attest to CMS. Those action steps are detailed in the section below.

Attestation Process Overview

The first recommended step for all plan sponsors is to review any group health plan contracts to confirm there are no prohibited gag clauses. Plan sponsors are encouraged to contact their carriers, TPAs and any other service providers and ask for written confirmation that contracts they handle on behalf of the group health plan do not contain any prohibited gag clause provisions. (Your Graham/MMA account team will assist you with this step.) Such documents or electronic vendor communications should be kept in the employer’s files in the event of a compliance audit.

If the plan’s insurer or TPA will not attest on behalf of the sponsoring employer, the employer’s next step will be to access the CMS form online and attest to their plan’s compliance, which can be found here. This requirement will be a fairly straightforward process similar to the annual Part D Creditable Coverage online disclosure to CMS. CMS’s online portal will require only limited plan-identifying information, employer contact information, and a checked box and signature to indicate compliance.

More specifically, once a medical plan’s vendors confirm their compliance with the gag clause provisions, the plan sponsor’s attestation process can be broken down into three primary steps:

1. Obtain website access. Go to CMS’ portal link above, enter in an email address, and get a unique code to access the attestation form.

2. Complete the attestation form. Fill out the required information in 5 short sections of the form and then sign off on compliance with the gag clause prohibition requirements.

3. Confirm submission. Upon completion and submission of the form, download the submission receipt and file it way in case of future audit or questions.

Your Graham/MMA Employee Benefits Team has been working behind the scenes to obtain the necessary confirmation of compliance from your medical plan vendors. Be on the lookout for more information, instruction, and training to ensure your medical plan remains compliant by December 31, 2023.