Your Gag Clause Attestation Is Due December 31. Read Your Contracts Before You Sign It.

By Jude Odu

October 26, 2026

Before December 31, someone will sign a federal attestation saying your health plan has no gag clauses in its contracts. If your plan is self-funded, that statement belongs to you, whoever clicks submit.

Most sponsors will sign on the strength of a vendor’s compliance letter. That’s the risk. The attestation is a statement of fact about contract language, and guidance the federal Departments issued in January 2025 widened what counts as a gag clause in ways a vendor letter rarely addresses.

What the Rule Bans

Section 201 of the Consolidated Appropriations Act, 2021 added matching provisions to ERISA (section 724), the Internal Revenue Code (section 9824) and the Public Health Service Act (section 2799A-9), in force since December 27, 2020. They bar a group health plan from signing any agreement with a provider, network, TPA or other service provider that restricts three things: disclosure of provider-specific cost and quality information to the plan, its participants, the plan sponsor and referring providers; electronic access to de-identified claims and encounter data; and sharing that data with a business associate. A provider or network may still set reasonable limits on public disclosure. It may not wall the data off from you.

Group health plans and insurers must confirm compliance each year by December 31 through a CMS webform. The first attestations were due December 31, 2023. Each one covers the period from the day after your last attestation through the day you submit, so this filing speaks for everything your contracts allowed over the past year.

Your TPA Can File It. You Still Own It.

A self-funded plan can meet the requirement through a written agreement under which its TPA attests on the plan’s behalf, and many do. The Departments’ own submission instructions spell out what happens when that arrangement breaks down: if the TPA fails to submit, “the plan violates the requirement to provide an attestation of compliance.”

Vendors draw the same line from the other side. UnitedHealthcare’s August 2026 notice to brokers says it can attest only to services it administers, and that customers stay responsible for everything else. MedBen, a TPA, tells clients it cannot attest to contracts it hasn’t signed and that sponsors remain responsible for their own direct agreements with providers. Put those two statements side by side and the gap is plain. Your PBM contract, your direct contracts and any carve-out network sit outside your TPA’s attestation unless someone attests for each of them.

The cost of getting this wrong is real. Missing the requirement can expose the plan to enforcement, including the Internal Revenue Code’s section 4980D excise tax of up to $100 a day for each affected individual. For a plan covering 500 people, that’s up to $50,000 a day before any cap applies.

The 2025 Guidance Moved the Line

On January 14, 2025, the Departments of Labor, Health and Human Services and the Treasury published Part 69 of their CAA implementation FAQs. Three of its answers change what you are attesting to.

First, downstream contracts count. If your TPA has its own agreements with networks or providers, restrictions buried in those agreements are indirect gag clauses, and the Departments expect plans to write language into their direct contracts that bars the TPA from entering such agreements.

Second, discretion is a restriction. An agreement that lets you share de-identified claims data with a business associate only when the provider or TPA consents contains, in the FAQ’s words, “an impermissible gag clause.”

Third, the FAQ lists access limits that cross the line. They include holding you to a statistically significant or “minimum necessary” number of claims, limiting access to specific narrow purposes, unreasonably limiting how often you can review claims, limiting the number or types of claims you can see, restricting the data elements, and offering the data only on the TPA’s premises. The Departments say the list is not exhaustive.

The FAQ’s own example of an unreasonable frequency limit is a review no more than once a year. If your contract allows one audit a year, on site, against a sample, you have read a gag clause.

If You Find One

Ask the vendor in writing to remove it. If the vendor refuses, file anyway. FAQ Part 69 tells plans to submit the attestation and identify the non-compliant provision in the webform’s Additional Information box, and it says the Departments will take into account good-faith efforts to self-report. The provision itself can still draw enforcement, and for ERISA plans the Department of Labor says it may investigate the TPA or service provider.

Name the vendor and the clause in plain words. The box rejects special characters other than the dashes in dates. Silence is the one option the guidance leaves you without.

Five Things to Do Before December 31

One. Confirm who files, in writing, now. Vendor deadlines fall well before December 31. UnitedHealthcare asks self-funded customers who want it to attest to say so by November 6, 2026 and return a signed letter of direction by November 16. MedBen wants signed forms by November 15 from clients who want it to file.

Two. List every agreement that touches claims or network access. That means the administrative services agreement, the PBM contract, network rental and carve-out agreements, and any direct contracts with providers. Each one either sits inside someone’s attestation or needs yours.

Three. Read the data access and audit clauses against the FAQ’s list. Look for frequency caps, on-site-only reviews, sample sizes, purpose limits and consent rights. Ask each vendor in writing whether its downstream agreements restrict your data, and keep the answer.

Four. Test the access you’re attesting to. Request a de-identified claims extract. How a vendor handles that request will tell you more than its compliance letter does. If you file the attestation yourself, request the webform’s authentication code close to the day you plan to submit, because it expires after 15 days.

Five. Build the file. Keep the written attestation agreement, each vendor’s confirmation, your request letters and the PDF receipt the CMS webform issues. Then add downstream language to every contract you renew in 2027.

You can sign this year’s attestation on a vendor’s letter, or on your own reading of the contracts behind it. Only one of those is a fiduciary record.

MOC Fiduciary Intelligence reads your plan’s contracts, scores the plan against 32 fiduciary indicators and cites the provision behind each finding. That is the reading this attestation asks for, done before you sign. I also cover the CAA’s transparency provisions in Model Optimal Care: End US Healthcare Waste, One Health Plan at a Time.

Sources

• U.S. Departments of the Treasury, Labor, and Health and Human Services, Gag Clause Prohibition Compliance Attestation Annual Submission Webform Instructions
• U.S. Department of Labor, Gag Clause Prohibition Compliance Attestation
• U.S. Departments of Labor, Health and Human Services and the Treasury, FAQs About Consolidated Appropriations Act, 2021 Implementation Part 69, January 14, 2025
• UnitedHealthcare, Gag clause 2026 Confirmation of Compliance now available, August 21, 2026
• MedBen, Reminder: Gag Clause Attestation Deadline is December 31st, October 9, 2026
• Hunton Andrews Kurth, First Gag Clause Attestations Due December 31, 2023: What Group Health Plan Sponsors Need to Know