CAA Gag Clause Prohibition

The Consolidated Appropriations Act of 2021 (CAA) included a prohibition on gag clauses in health plan contracts with providers, TPAs, and other service providers. A gag clause is any contract term that would prevent the plan (or the plan sponsor) from accessing its own claims data, sharing that data with business associates, or disclosing provider-specific cost or quality information. Since December 2020, such clauses are unenforceable in health plan contracts.

Every group health plan sponsor must file an annual gag clause attestation with CMS confirming their contracts don't contain prohibited gag clauses. This is a real compliance burden — the attestation forces employers to actually review TPA, PBM, and network access contracts for gag language, which historically was buried and rarely challenged. Self-funded employers have used the CAA to gain claims-data access their carriers used to restrict, which in turn enables independent analysis, transparent PBM audits, and vendor benchmarking. The DOL and CMS have been signaling more aggressive enforcement, including lawsuits against health systems and carriers that maintained restrictive contract language.

The takeaway: if you're a self-funded employer and you haven't filed the annual gag clause attestation or reviewed your TPA/PBM contracts for prohibited language, do both now. This is one of the clearest compliance obligations to come out of the CAA.