Gag Clause Prohibition Compliance Attestation

Plans and issuers must attest annually that contracts with providers/networks/TPAs do not contain gag clauses restricting access to provider cost/quality data, claims data, or other information needed for plan administration. For fully insured plans, the carrier may submit the attestation on behalf of the plan; plan sponsors should confirm their carrier is handling this or submit independently.

Current Fee / Rate Information

No filing fee. Attestation submitted annually to CMS by December 31. Plans and issuers may submit jointly or separately.

Last reviewed: July 2026

Non-Compliance Penalties

Failure to comply: $100/day per affected individual under ERISA § 502(c)(10), potentially uncapped.

What are you actually attesting to?

That none of your contracts with providers, networks, or TPAs contain gag clauses: terms that block your access to provider cost data, quality data, or your own claims data. Congress banned those clauses in the CAA. The attestation is you certifying, once a year, that your contracts are clean.

How the submission works

The attestation goes to CMS through a webform by December 31 each year. Fully insured: your carrier can attest on the plan's behalf, but confirm it in writing rather than assume. Self-funded: your TPA can submit for you, but the legal duty stays with the plan. Get their confirmation email in your compliance file.

The bigger point

This attestation has teeth beyond the deadline. If your TPA won't hand over claims data, ask how they attested that your contract has no gag clause. The law says you're entitled to that data. The attestation is your leverage to get it.

Related Reading

• The SAR Distribution Requirement: What You Must Send Participants by September 30→
• The DOL Has a Manual for Penalizing You. Most Plan Administrators Have Never Read It.→
• ICHRA Moved You Out of the Group Market. It Didn't Move You Out of Compliance.→