Upcoming Compliance Obligations Under the CAA 

By Stephanie Raborn

The Consolidated Appropriations Act (CAA) of 2021 includes a prohibition on “gag clauses,” that prohibits group health plans and health issuers (insurers) from entering into agreements with providers, provider networks or administrators that would, in essence:

• Restrict the plan or insurer’s ability to provide information about the cost or quality of care
• Restrict the plan or insurer’s ability to share or access financial information such as de-identified claims 

The prohibition is intended to promote the transparent disclosure of information and to ensure that plans and insurers are not contractually hampered in their ability to share information not otherwise protected by other laws such as HIPAA, the Americans with Disabilities Act, or the Genetic Information Nondiscrimination Act. A classic example would be a contractual term that treats rates payable to providers at a point of service as proprietary. 

The CAA also includes a requirement that plans and insurers annually attest to regulators that they are compliant with this prohibition. While the anti-gag clause rules have been in effect since the law was passed in late December 2020, the affirmative attestation component was initially delayed pending guidance from regulators regarding how and when to submit these attestations of compliance.  

Regulators finally issued a set of Frequently Asked Questions (FAQs) in February of this year providing the awaited guidance. These FAQs clarify that group health plans and insurers will be required to submit their first attestation of compliance, indicating that no prohibited gag clauses exist in contracts for the period covering Dec. 27, 2020—when the gag clause prohibition went into effect—no later than Dec. 31, 2023. 

Subsequent attestations covering the period since the last submission will be due Dec. 31 each year thereafter. Attestations must be submitted through a web form created by the Centers for Medicare and Medicaid Services (CMS). CMS has also created a web page with resources to assist entities in understanding these requirements, such as instructions for submitting attestations and a user manual for the relevant web form used to attest. 

Perhaps frustratingly for self-insured plan sponsors, the FAQs make clear that the prohibition and attestation rules apply to health plans and insurers, but do not directly regulate other vendors such as third-party administrators (TPAs) or pharmacy benefit managers (PBMs). As a result, fully insured plan sponsors should generally be able to rely on carriers to submit attestations on their behalf, while self-insured plans will need to determine whether their TPA and/or PBM are willing to submit on their plan’s behalf. 

The FAQs make clear that self-insured plans may satisfy the requirement to submit a gag clause prohibition compliance attestation by entering into a written agreement with a service provider enabling the provider to attest on the plan’s behalf, though the legal requirement to provide an attestation remains with the self-insured plan. And, naturally, self-insured plans may face resistance from vendor partners who are unwilling or unable to take on this obligation. 

On the subject of who and what is being regulated, the gag clause rules apply to health insurers, fully insured and self-insured group health plans, including ERISA plans, non-Federal governmental plans, and church plans subject to the Internal Revenue Code. Grandfathered status is irrelevant for these purposes. Excepted benefits such as dental and vision coverage are exempt, and account-based plans such as health reimbursement arrangements, while not technically exempt, will not face enforcement action. Most vendors worth their salt will be willing to provide information regarding whether or not their benefits offerings are subject to these rules. If in doubt, ask! 

So, what should employer plan sponsors do now? 

First, take a deep breath. This upcoming obligation is not expected to require nearly the heavy lift as some of the CAA’s other compliance obligations, such as MHPAEA comparative analyses or prescription drug reporting. 

Second, confirm with vendors that your contract(s) do not contain the prohibited gag clauses. Because the gag clause prohibition attestation will essentially operate as a promise to the government that your plan(s) do not contain the prohibited gag clauses, employer plan sponsors must verify that this is in fact true. 

Third, determine who will be submitting the attestation on the plan’s behalf. Carriers and TPAs have begun to communicate their strategies to assist plan sponsors in meeting their obligations by either submitting the attestation on their clients’ behalf or advising that they will not be doing so. If you have not received communication to this effect, now is the time to ask questions. Ask your carrier/TPA how they plan to assist their clients in complying with the anti-gag clause rules. If you determine that your relevant vendor partners(s) will be submitting the necessary attestation on your plan’s behalf, document this information and check it off your to-do list. 

And finally, if you determine that you will be responsible for submitting an attestation, become familiar with the resources CMS has created to assist. These resources are also available at the CMS web page mentioned above.