The Consolidated Appropriations Act of 2021 (CAA) prohibits employer-sponsored group health plans from entering into agreements that contain so-called “gag clauses.” Importantly, there is also a requirement that each group health plan annually attests to the absence of gag clauses in its agreements.
The goal of the provision is to allow group health plans and insurers to have access to and be able to publish cost and quality information as part of the CAA’s broader directive toward transparency in health coverage.
What are gag clause prohibitions?
On a high level, the prohibition generally restricts group health plans from entering into agreements that limit the plan’s access to de-identified claims data or the group health plan’s ability to disclose provider-specific information (such as cost and quality information) to certain third parties, including plan participants. Specifically, the gag clause rule prohibits plans and insurance companies from entering into agreements with providers, TPAs, or other service providers that restrict:
- Provider-specific cost or quality of care information sharing with plan members
- Claims data sharing with plan sponsors (and their service providers). Claims data sharing includes individual claims pricing.
- Electronic access of de-identified claims and encounter information or data.
The guidance also provided examples of what constitutes a gag clause, including provisions such as the following that are often included in TPA contracts:
- Provisions that treat provider rates as proprietary and restrict disclosures to participants
- Provisions that stipulate that rates can only be disclosed at the discretion of the TPA.
Gag Clause Prohibition Compliance Attestation (GCPCA)
The federal agencies issued guidance on February 23, 2023, outlining submission requirements. The agencies created a special web portal hosted by the Centers for Medicare and Medicaid Services (CMS) for submitting Gag Clause Prohibition Compliance Attestations. This is the only method available for submitting attestations. The link for submission is here.
What are the penalties?
Plans that fail to comply may face a civil penalty of up to $100 per day, adjusted annually, for each individual impacted by a violation.
Attestation Timing
The first annual attestation is due by December 31, 2023. This first attestation is to cover the period from December 27, 2020, through 2023. Subsequent attestations are due by December 31st of each year.
Which plans are subject?
The rules apply generally to health plans but not to “excepted benefits,” such as dental and vision plans. In addition, account-based plans, such as HRAs or FSAs, are not required to attest.
Responsibility for Submission
Employers may transfer responsibility for submission of the GCPCA to a TPA or insurer by maintaining a written agreement specifying the transfer of responsibility. However, there is a difference in actual legal responsibility between self-funded and fully insured employers.
Self-Funded Plans: Self-funded plans may contract with their third-party administrator (TPA) to submit the attestation on their behalf. The agreement must be in writing. That said, like the RxDC reporting, the legal responsibility for the attestation remains with the group health plan (regardless of any underlying agreement).
Fully Insured Plans: Fully insured plans may (and most will) have the insurer submit the attestation on their behalf. The agreement must be in writing. Once a written agreement is in place, the actual legal responsibility can be transferred to the insurance carrier.
Action Items
Practically speaking, the heavy lifting associated with the submission of the GCPCA is likely to fall on insurance companies and TPAs. That said, the following action items should be considered:
- All Employers: Review any agreements with potential gag clauses. Amend agreements as necessary.
- Self-Funded Employers: Reach out to TPAs or other service providers, including pharmacy benefit managers, and coordinate who will submit the attestation with CMS.
- Fully Insured Employers: Coordinate and confirm that the insurer will handle all CMS attestations.
- All Employers: Execute written agreements to clarify the transfer of responsibility for submission of the GCPCA. Confirm that responsible entities are on track for the initial submission to be made by December 31, 2023.
Resources
The Centers for Medicare and Medicaid Services (CMS) maintains a comprehensive website with many useful resources. Resource links follow:
