Client Alert: Group Health Plan “Gag Clause” Compliance Attestation Due by the End of 2023

A gag clause is language in a contract between a group health plan^[1] and service providers that directly or indirectly restricts the group health plan from sharing specific data and information. A gag clause can exist between a group health plan and:

• • • • A health care provider,
      • Network or association of providers,
      • Third-party administrator (TPA), or
      • Other service provider offering access to a network of providers.

The CAA prohibits contractual language that restricts a group health plan from:

• • • • Providing provider-specific cost or quality of care information or data to referring providers, the plan sponsor, participants, beneficiaries, enrollees, or eligible enrollees;

      • Electronically accessing de-identified claims and encounter information or data for participants, beneficiaries, or enrollees in the plan or coverage upon request and consistent with the privacy regulations; or

      • Sharing any of the above information or data with a business associate.

As mentioned, a gag clause’s restrictions can be either direct or indirect. In an example of a direct gag clause, a contract between a TPA and group health plan states that the plan will pay providers at rates designated as “Point of Services Rates,” which the TPA considers to be proprietary and includes language in the contract specifically prohibiting its disclosure. An example of an indirect gag clause, which is not as overt, is a contract between a TPA and group health plan in which the plan sponsor’s access to provider-specific cost and quality of care information is only at the discretion of the TPA. Both contract provisions are deemed gag clauses and are prohibited.

The first gag clause prohibition compliance attestation is due by December 31, 2023, and will cover the period between December 27, 2020 (or the effective date of the group health plan or health insurance coverage if later) and the date of attestation. Group health plans must annually submit an attestation by December 31 thereafter covering the period since the previous attestation. The initial attestation will require reviewing contracts in effect on or after December 27, 2020, for any offensive gag clause language. Amending existing contracts may be necessary to ensure ongoing compliance.

The entities that are required to submit an attestation include both self-insured and fully insured group health plans.^[2] Entities not required to attest include account-based plans like health reimbursement arrangements (HRAs), health flexible spending accounts (FSAs), and health savings accounts (HRAs) and plans or issuers offering only excepted benefits.

A self-insured plan may enter into a written agreement with service provider(s), such as a TPA or pharmacy benefit manager (PBM), to attest on behalf of the plan. However, the self-insured plan should be aware that the burden to comply and timely attest remains with the plan. Self-insured plans relying on service providers to submit an attestation should confirm and document that attestations were made. With respect to fully-insured group health plans, the group health plan and issuer are each required to annually submit the gag clause prohibition compliance attestation. However, when the issuer of a fully-insured group health plan submits an attestation on behalf of the plan, both the plan and issuer are considered to have satisfied the attestation submission requirement. 

Attestations will be made using the Health Insurance Oversight System (HIOS). The Centers for Medicare and Medicaid Services (CMS) have created a website with more information regarding the submission process. Failure to timely submit an attestation may result in enforcement action, such as $100 per day per affected individual. While practical enforcement action is unclear at this time, potential exposure could be significant for failing to comply.

Plans still working towards compliance should review contracts for gag clauses and/or ensure existing language is flexible enough to accommodate compliance with appliable law and amend where necessary. Plans should speak with their TPA, PBM, and other service providers to determine who will be submitting the attestation; and enter into a written agreement if necessary and document compliance. If the plan is attesting itself, it should follow CMS’ instructions for attesting through HIOS. If your company requires assistance reviewing contractual language or completing the attestation, reach out to your Jenner & Block contact for assistance.