Deadline Reminder – Gag Clause Attestations Due by Year’s End

As you may be aware, the first annual Gag Clause Prohibition Compliance Attestation (GCPCA) – which was mandated by the Consolidated Appropriations Act of 2021 and which nearly all group health plans and health insurance issuers must complete – is due no later than December 31, 2023. To help guide you through this process, this Alert is meant to provide a high-level overview of what the GCPCA is, why it’s required, and how to complete the mandatory webform.

To read this Alert in PDF format, click here.

What is a “gag clause”?

A “gag clause” is a contractual term that directly or indirectly restricts the sharing of specific data and information with a third party. Examples of this information include provider-specific cost or quality of care information and de-identified claims data. As part of Congress’s increasing push for price transparency in the healthcare space, the Internal Revenue Code, ERISA, and the Public Health Service Act prohibit group health plans and health insurance companies from entering into agreements containing gag clauses with health care providers, networks or associations of providers, third-party administrators, Pharmacy Benefit Managers, or any other service providers offering access to a network of providers.

What is the GCPCA?

To enforce the gag clause prohibition, Congress passed a law requiring plans and insurance companies to annually submit an attestation to HHS, the DOL, and the Treasury Department, acknowledging that the plan or issuer is complying with this requirement. Plans and issuers must submit the GCPCA via a webform on the CMS website. The first attestation is due no later than December 31, 2023 and requires plans and issuers to attest for agreements during the period beginning December 27, 2020 through the date of attestation. Plans and issuers must then complete the attestation annually by December 31 each year thereafter.

Does this GCPCA requirement apply to both self-funded and fully insured plans?

Yes, both self-funded and fully insured plans must submit an attestation. Technically, the obligation to execute a GCPCA rests with the plan. If your plan is fully insured, the insurer may be executing the required attestation. But if it fails to do so, the employer will be on the hook. So, to play it safe, it may be advisable that, even with fully insured plans, the sponsoring employer should go ahead and execute a GCPCA for its plan. As noted below, the process is quite simple.

Can a third party (such as my TPA) submit the GCPCA on my plan’s behalf?

Yes, the rules allow plans to satisfy the GCPCA requirement by entering into a written agreement with a service provider for it to complete the attestation. But be aware that even if a plan enters into this type of agreement, the legal requirement to provide an attestation remains with the plan. Again, because the process is quite simple, to play it safe, a sponsoring employer should consider going ahead and executing a GCPCA for its plan.

How do I complete the webform?

The following is a step-by-step overview of how to complete the attestation on the CMS website. For a more detailed overview with screenshots of each page, see the CMS user manual, starting on p. 4.

1. To access the GCPCA home page, visit the following website: https://hios.cms.gov/HIOS-GCPCA-UI.

2. If this is your first time logging on to the website, click “Don’t have a code or forgot yours?” below the green Login button. A new box will prompt you to enter your email address. Enter your email address, and then select “Get my unique code.” The code that is emailed to you is now your password to log in to the GCPCA dashboard. (Note: The password will expire in two weeks, so you will need to go through this process of requesting a new code again if you start the form but do not complete it until a later date.) See pp. 4-8 of the CMS user manual.

3. Return to the home page and log in to the GCPCA dashboard using your email address and code. See p. 9 of the CMS user manual.

4. On the dashboard page, click either the blue “Start a new submission” button or the blue “Submit Gag Clause Prohibition Compliance Attestation” button. Either of these buttons will take you to step 1 of the webform. See pp. 11-12 of the CMS user manual.

5. The webform contains the following 5 steps:

1. 1. Step 1 – Enter the Submitter’s contact information. The Submitter is the individual actually completing the form on behalf of the plan(s). Once complete, click “save and continue.” See pp. 13-14 of the CMS user manual.

   2. Step 2 – Enter the Attester’s contact information. The Attester is the individual who has authority to attest on behalf of the plan(s). The Submitter and Attester might be the same person. If they are, click the box saying “Submitter is the same as the Attester.” Once complete, click “save and continue.” See pp. 15-16 of the CMS user manual.

   3. Step 3 – Enter Reporting Entity details. Completing this part of the form will look different depending on whether you are submitting for one plan or for multiple plans. If you are submitting on behalf of multiple plans, be sure to download and complete the “Reporting Entity excel template” on the GCPCA dashboard and upload the completed excel form in the appropriate part of step 3. After completing the applicable sections of step 3, click “save and continue.” See pp. 16-28 of the CMS user manual.

   4. Step 4 – Review the information you submitted. Step 4 will give you an at-a-glance view of all of the information you submitted. Review this carefully. If any of the information is incorrect, be sure to make necessary edits. After reviewing the information, click “save and continue.” See pp. 28-29 of the CMS user manual.

   5. Step 5 – Verify the entity type(s) on whose behalf you are attesting. This section should be completed by the Attester. It requires you to check a box acknowledging you understand to what you are attesting. Click the first box stating you are attesting on behalf of a group health plan. Then, click the last box under “Attest your submission,” enter the name of the Attester to sign, and click “Submit.” The name you enter in this section must exactly match the Attester’s name submitted in Step 2. See pp. 30-33 of the CMS user manual.

6. You should see a message saying “Submission Successful” along with a link to “Download receipt.” Download your receipt and keep it in a safe place as evidence that you completed the attestation. See pp. 33-34 of the CMS user manual.

For more information on the Gag Clause Prohibition Compliance Attestation, or any other employee benefits topic, please do not hesitate to contact one of the following attorneys on our Employee Benefits team at (316) 267-2000.

To read this Alert in PDF format, click here.

Employee Benefits Attorneys
Eric Namee
Steven Smith
Brad Schlozman
Blair Bohm