Employee Benefits Compliance Brief October 2026

2026 Gag Clause Attestation Deadline

Employers sponsoring group health plans should have the Dec. 31, 2026, Gag Clause Prohibition Compliance Attestation (GCPCA) on their year-end compliance calendars.

The requirement stems from the Consolidated Appropriations Act, 2021 (CAA), which prohibits group health plans and health insurance issuers from entering into certain agreements that restrict access to provider cost and quality information or certain claims data. Plans and issuers generally must attest to compliance with these requirements each year. The Centers for Medicare & Medicaid Services (CMS) collects the attestations on behalf of the Departments of Labor, Health and Human Services, and the Treasury (collectively, “The Departments”).

For employers, the key question is not simply whether an attestation is required. Employers also need to determine who will submit it, which contracts and service providers are implicated, and what documentation supports the plan’s compliance.

Quick Facts

Deadline: The 2026 GCPCA is due Dec. 31, 2026. Annual attestations are due by December 31 each year.
Plans covered: The requirement generally applies to fully insured and self-insured group health plans, including ERISA plans, non-federal governmental plans, and church plans subject to the Internal Revenue Code.
Important exclusions: Plans and issuers that offer only excepted benefits are not required to attest. A plan otherwise subject to the requirement generally does not attest as to its excepted-benefit coverage.
Service providers may help: A TPA or other service provider may submit an attestation on behalf of a self-insured plan under a written agreement. However, the legal obligation to provide a timely attestation remains with the self-insured plan.
Submission is electronic: Attestations are submitted through the CMS GCPCS webform.

Background

The gag clause prohibition became effective on Dec. 27, 2020, when the CAA was enacted. It is intended to prevent contractual restrictions that interfere with a health plan’s ability to obtain, use, or share certain information needed to understand health care costs and quality.

In general, covered plans and issuers may not enter into agreements with health care providers, provider networks or associations, third-party administrators (TPAs), or other service providers offering access to a provider network if those agreements directly or indirectly restrict the plan’s ability to:

Make provider-specific cost or quality information available to participants, beneficiaries, eligible individuals, plan sponsors, or referring providers.
Electronically access de-identified claims and encounter information, consistent with applicable privacy requirements.
Share that information with a business associate, consistent with applicable privacy requirements.

The restriction does not have to expressly say that information cannot be disclosed to violate the rule. The Departments have explained that a contractual term may constitute a prohibited gag clause if, in practice, it directly or indirectly restricts the plan from accessing, providing, or sharing the protected information.

Which Employer Plans Are Subject to the Requirement?

The attestation requirement applies broadly to employer-sponsored group health plans, including both fully insured and self-insured plans. Grandfathered status does not remove a plan from the requirement.

There are important exceptions.

Plans and issuers do not need to attest with respect to coverage that consists of excepted benefits. Examples can include certain stand-alone dental and vision coverage and health flexible spending accounts (FSAs).
Retiree-only group health plans are not required to attest.
HRAs and other account-based group health plans are not required to submit GCPCAs. The Departments are exercising enforcement discretion until those plans can be exempted through rulemaking.

Look Beyond the Medical Carrier or TPA

Employers should not automatically limit their compliance review to the primary medical carrier or TPA.

The federal prohibition can apply to agreements with providers, provider networks, TPAs, and others providing access to a network of providers. Federal GCPCA materials specifically recognize provider or service agreements and list medical networks, pharmacy benefit manager (PBM) networks, behavioral health manager networks, and “other arrangements.”

This issue became even more important following additional guidance from the Departments concerning downstream agreements. A plan may contract with a TPA or another service provider which in turn enters into separate agreements with other entities involved in providing or administering the plan’s network. The Departments have clarified that prohibited restrictions in these downstream arrangements can affect the plan’s compliance.

Who Submits the Attestation?

Often, carriers or TPAs can submit the attestation, but employers should confirm the arrangement rather than assume it.

For a fully insured group health plan, both the plan and the issuer are subject to the annual attestation requirement. However, when the issuer submits the GCPCA on behalf of the plan, the Departments will consider the plan’s submission requirement satisfied. Employers should obtain written confirmation when a carrier, TPA, or another service provider has agreed to attest for the plan and confirm the scope of that filing.

For a self-insured or partially self-insured plan, the plan may enter into a written agreement under which a service provider, such as its TPA, submits the attestation on the plan’s behalf. However, federal guidance states that the legal requirement to provide a timely attestation remains with the self-insured plan even when a service provider has agreed to perform the filing.

An employer with multiple vendors should also determine whether one vendor’s filing covers all of the relevant agreements associated with the plan.

What If a Vendor Will Not Attest?

If a service provider will not submit the attestation on the plan’s behalf, the employer will need to satisfy the filing requirement and obtain the information necessary to support the attestation. That may involve reviewing relevant agreements and obtaining written confirmation from service providers regarding their compliance with the gag clause prohibition.

Employers should also be careful not to treat a vendor’s refusal to attest as the end of the inquiry. The plan still needs to evaluate its compliance and, when required, ensure that an attestation is submitted.

What If the Employer Finds a Prohibited Gag Clause?

The Departments have clarified that a plan still must submit its annual GCPCA even when it knows an agreement contains a prohibited provision that it has been unable to remove, including a restriction arising through a downstream agreement.

In that situation, the plan should use the “Additional Information” field in the GCPCA webform to identify the noncompliant provision and provide relevant information about the issue. Federal guidance indicates that this information should include but is not limited to:

Any prohibited gag clauses that a service provider has refused to remove.
The name of the TPA or service provider with which the plan or issuer has the agreement containing the prohibited gag clause.
Conduct by the service provider that shows the service provider interprets the agreement to contain a prohibited gag clause.
Information on the plan’s or issuer’s requests that the prohibited gag clause be removed from such agreement.
Any other steps the plan or issuer has taken to come into compliance with the provision.

Submitting this information does not make the prohibited provision compliant. The Departments may still take enforcement action regarding the underlying violation. However, the Departments have stated that a plan submitting an attestation with the required additional information will be considered to have satisfied the requirement to submit the GCPCA, and that good-faith efforts to self-report will be considered in an enforcement action.

This distinction is important; employers should not simply skip the filing because a compliance problem has been discovered.

How Is the Attestation Submitted?

CMS provides an electronic Gag Clause Prohibition Compliance Attestation webform. The process begins by entering an email address and obtaining an authentication code. CMS’s user manual states that access codes are valid for 14 days.

The webform collects information concerning the submitter, attester, and responsible entity. CMS also provides instructions, a user manual, and an Excel template for situations involving multiple responsible entities.

Employers completing their own filing should allow enough time before December 31 to obtain access, gather plan information, resolve questions about vendor arrangements, and complete the submission.

Employer Action Items

Identify plans subject to the requirement. Determine which employer-sponsored health plans must submit a GCPCA and whether any benefits qualify for an applicable exception or enforcement discretion.
Inventory relevant service providers and arrangements. Consider the medical carrier or TPA as well as PBMs, behavioral health network arrangements, and other service providers offering access to provider networks.
Determine who will file. Ask each applicable carrier, TPA, or other service provider whether it will submit the 2026 attestation on the plan’s behalf.
Get the arrangement in writing. For a self-insured plan relying on a service provider to submit the GCPCA, federal guidance specifies a written agreement. Retain documentation showing the provider’s commitment and the plans or agreements covered by its filing.
Address gaps in vendor filing. If a vendor is not filing for the plan, determine what additional contract review, compliance confirmation, or employer submission is necessary.
Investigate potential prohibited restrictions. Do not overlook indirect restrictions or limitations contained in downstream agreements. If a prohibited provision cannot be removed, review the Departments’ guidance regarding disclosure through the GCPCA’s Additional Information field.
Submit by Dec. 31, 2026. If the plan is responsible for its own filing, complete the GCPCA through the CMS webform by the annual deadline.