Effective December 27, 2020, the Consolidated Appropriations Act of 2021 (CAA) prohibits health insurance issuers and group health plans from entering into contracts with health care providers, third-party administrators (TPAs) or other service providers that restrict the plan from providing, accessing or sharing de-identified claim information, provider pricing or quality of care information. Under the legislation, plans and health insurance issuers are required to submit an annual attestation of compliance to the Departments.

Per guidance released on February 23, 2023 by the Tri-Agencies (DOL, HHS and Treasury), the first gag clause prohibition attestation is due December 31, 2023, covering the period beginning December 27, 2020 (or the effective date of the applicable group health plan coverage, if later) through the date of attestation. Subsequent attestations are due by December 31st of each following year. The FAQs can be accessed here.


Plan Sponsors should review all contracts with TPAs and other health plan service providers offering access to a network of providers to ensure they do not violate the CAA’s prohibition of gag clauses. Specifically, these contracts cannot restrict a plan or issuer from:

  1. Providing provider-specific cost or quality-of-care information or data to referring providers, the plan sponsor, participants, beneficiaries or enrollees (or individuals eligible to become participants, beneficiaries or enrollees of the plan or coverage);
  2. Electronically accessing de-identified claims and encounter information or data for each participant, beneficiary or enrollee upon request and consistent with privacy rules under the Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), and the Americans with Disabilities Act (ADA); and
  3. Sharing information or data described in (1) and (2) above or directing such information to be shared with a business associate, consistent with applicable privacy rules.

As with other CAA requirements, a self-insured plan can enter into an agreement to have their TPA, PBM or another third party submit the gag clause attestation on their behalf, but the legal responsibility to submit a timely attestation remains with the plan. Likewise, the health insurance issuer can take on the responsibility for submission for its fully-insured plans, if done in writing. There are specific instructions applicable if an entity is submitting attestations on behalf of multiple plans.

These requirements apply to both grandfathered and grandmothered health plans, non-federal governmental plans and church plans.

Excepted benefits plans, short-term limited-duration insurance, Medicare and Medicaid plans, CHIP, TRICARE, Indian Health Service Program, and Basic Health Program Plans are all exempt from this new requirement. In addition, the Departments will not enforce the requirement to submit a gag clause attestation against plans that consist solely of health reimbursement arrangements (HRAs), or other account-based group health plans.

The gag clause attestations must be submitted using a website created through the Centers for Medicare and Medicaid Services (CMS) and can be accessed here.

The Tri-Agencies provide instructions, a system user manual and an excel template for reporting which can be accessed here.


The heavy lifting associated with submission of the gag clause attestation is likely to fall on the health insurance issuers and TPAs. Plan Sponsors should contact their health insurance issuer or TPA to determine how they will assist with the gag clause attestation that is due December 31, 2023.

If you have questions about compliance with the above requirements, please contact our office at