The annual deadline for the gag clause prohibition compliance attestation, known as the GCPCA, lands on December 31, and a recurring compliance hazard threatens to catch employers off guard again this year. Many plan sponsors assume their carrier or third-party administrator has handled the submission. Often, that assumption goes unverified until it is too late.
The GCPCA is a requirement under the Consolidated Appropriations Act of 2021 (CAA-21), which prohibits group health plans and health insurance issuers from entering into contracts with providers, TPAs, or other service providers that restrict access to cost, quality, or claims data. The annual attestation, submitted to the Centers for Medicare and Medicaid Services (CMS) through the agency’s online portal, confirms the plan’s compliance with the prohibition on such restrictions in its agreements. It applies to fully insured and self-insured plans alike, regardless of plan size or grandfathered status. Plans that offer only excepted benefits, such as standalone dental and vision coverage, are not required to attest.
For fully insured plans, the carrier typically files the attestation on the employer’s behalf, and a carrier submission covers both the plan and the issuer. But that automatic coverage is narrower than many employers realize. Some plan sponsors offer both a fully insured medical plan and a self-insured arrangement. A carved-out pharmacy benefit or a behavioral health program are common examples. In those cases, the carrier’s attestation covers only the insured piece. The self-insured arrangement requires a separate submission.
Self-insured and level-funded plan sponsors can delegate the filing to a TPA through a written agreement, but the legal responsibility under CAA-21 does not transfer with it. If a TPA fails to file on time, the liability stays with the plan. Under guidance the federal Departments of Labor, Health and Human Services, and the Treasury issued in January 2025, plans that have identified a non-compliant provision in their contracts cannot simply skip the attestation. They must still file and disclose the prohibited clause in the submission’s additional information field.
The window for some employers is already tighter than the December 31 deadline suggests. UnitedHealthcare communicated to ASO customers that requests for the insurer to cover their attestation had to be submitted to UHC representatives by November 6, with supporting documents due by November 16. Employers with ASO arrangements on UHC who missed that internal window now need to submit independently through the CMS portal before year-end.
The GCPCA is often treated as a paperwork exercise, but it sits inside a broader transparency framework that has direct implications for plan management. The gag clause prohibition is one of several CAA-21 provisions designed to ensure employer plan sponsors can access the cost and quality data their plans generate. That data access is a prerequisite for making meaningful use of price transparency tools and PBM accountability measures that have since been built on top of the same legal foundation. A plan operating under a contract that still contains a prohibited restriction cannot fully exercise those data rights, regardless of whether it has filed an attestation.
That connection has grown more material as the federal transparency framework has expanded. The leverage that brokers and advisors can build through CAA-related data access depends on the underlying contracts being free of restrictions, which is what the attestation is meant to confirm.
The practical steps before the deadline are straightforward but require active verification. Jay Kirschbaum, benefits compliance director and senior vice president at World Insurance Associates, outlines the standard in the firm’s 2026 year-end compliance roundup: identify who will submit, confirm that all applicable plan options and reporting periods are covered, and retain the submission confirmation. For clients with self-insured or carved-out arrangements, that means verifying the TPA’s scope, not just the primary medical plan. The most common year-end compliance failure, Kirschbaum noted, is the assumption that another party handled a requirement that was never confirmed.
