The gag clause attestation is an annual compliance filing that group health plans and health insurance issuers must submit to the federal government, confirming that none of their provider contracts contain provisions that block the sharing of cost or quality data. The requirement stems from the Consolidated Appropriations Act of 2021, and the first submission deadline was December 31, 2023, with annual filings due every December 31 thereafter.
What Gag Clauses Actually Block
In healthcare contracting, a gag clause is a provision that prevents a health plan or insurer from disclosing negotiated prices or quality information to outside parties. These clauses have historically been embedded in agreements between health plans and providers, pharmacy benefit managers, third-party administrators, and network associations. Their practical effect is straightforward: they stop consumers from comparing prices across providers, and they stop employers from seeing what their plans are actually paying for care.
The Consolidated Appropriations Act of 2021 made these clauses illegal. Specifically, it prohibits any agreement that would directly or indirectly restrict a plan or issuer from:
- Sharing provider-specific cost or quality data with plan participants, beneficiaries, enrollees, plan sponsors, or referring providers
- Electronically accessing de-identified claims and encounter data for each person covered by the plan, consistent with privacy regulations
- Directing that data to a business associate such as a consultant or analytics firm, again consistent with privacy rules
This means an employer sponsoring a health plan now has the legal right to see what their plan pays individual providers, and no contract can prevent that. It also means plan members can access cost and quality information that was previously locked behind contractual secrecy.
What the Attestation Requires
The Gag Clause Prohibition Compliance Attestation, or GCPCA, is the mechanism the federal government uses to verify compliance. It’s submitted through a web portal maintained by the Centers for Medicare and Medicaid Services (CMS), which collects attestations on behalf of the Departments of Labor, Health and Human Services, and the Treasury.
The attestation itself is not a detailed audit. It’s a formal certification that the filing entity has reviewed its provider agreements and confirmed they don’t contain prohibited gag clauses. But it does require specific information. The person submitting the form must provide their name, title, email, phone number, employer name, and the type of entity they represent. A separate attester (who may or may not be the same person) must certify they have the legal authority to attest on behalf of the reporting entity and that all information is accurate.
For each reporting entity covered by the filing, the submission requires the entity’s name, nine-digit federal tax ID, entity type (such as an ERISA plan, church plan, non-federal governmental plan, or issuer), mailing address, and a point of contact. ERISA plans must also include the three-digit plan number from their Form 5500. The submitter indicates whether the attestation covers all provider agreements or only specific categories: medical, pharmacy benefits, behavioral health, or other.
Who Has to File
The requirement applies broadly. Group health plans, whether self-insured or fully insured, and health insurance issuers offering group or individual coverage all fall under the mandate. That includes employer-sponsored plans of all sizes, church plans, and non-federal governmental plans.
For fully insured plans, the insurance carrier typically handles the attestation since the issuer controls the provider contracts. For self-insured employer plans, the obligation technically falls on the plan itself, meaning the employer or plan sponsor bears responsibility. In practice, many employers delegate the submission to their third-party administrator or pharmacy benefit manager. The GCPCA webform accommodates this by allowing a TPA, PBM, or other service provider to submit on behalf of multiple plans using a bulk upload template. However, the legal responsibility for compliance still rests with the plan or issuer, not the entity that clicks “submit.”
If you’re an employer with a self-insured plan, the most important step is confirming in writing that your TPA or benefits administrator is handling the filing on your behalf. Don’t assume it’s being done automatically.
How to Submit
The attestation is filed electronically through the GCPCA webform hosted on the CMS HIOS platform. After logging in, you’ll find instructions, a user manual, and an Excel template for entities filing on behalf of multiple plans. If you’re attesting for a single plan, the webform itself walks you through the required fields. For bulk submissions covering many plans, you prepare a tab-delimited text file using the provided template and upload it through the portal.
The annual deadline is December 31. The initial filing was due December 31, 2023, and every year after that, a new attestation must be submitted by the same date. This is not a one-time requirement.
Why This Matters for Price Transparency
Gag clauses and similar contractual restrictions have been among the most effective barriers to healthcare price transparency. When a hospital system negotiates rates with an insurer, those rates have traditionally been treated as trade secrets. Employers paying the bills often couldn’t see what they were being charged for specific services at specific facilities. Consumers had even less visibility.
Removing these clauses doesn’t automatically make prices public, but it clears a critical legal obstacle. Employers and their consultants can now request and analyze claims data without running into contractual walls. Plan members and referring providers can access cost and quality comparisons. Combined with other transparency rules (like the requirement for hospitals to post machine-readable price files), the gag clause prohibition is designed to create an environment where price competition can actually function in healthcare.
The attestation requirement adds teeth to the prohibition. Without it, the ban on gag clauses would exist on paper but lack any verification mechanism. By requiring annual certification, federal regulators create a paper trail of accountability. If a plan attests to compliance but is later found to have prohibited clauses in its contracts, the attestation itself becomes evidence of a compliance failure.