Employer health plans must make sure the annual gag clause attestation is filed by December 31, 2026. The task is short compared with RxDC reporting or a plan audit, but it is easy to miss because many employers think a carrier, TPA, or PBM has already handled it.
The real question is not only whether someone filed. It is who filed, which plan was covered, which contracts were covered, and what proof the employer kept.
What the gag clause attestation is
The gag clause attestation is a federal filing tied to the Consolidated Appropriations Act, 2021. CMS says the attestation confirms compliance with Internal Revenue Code section 9824, ERISA section 724, and Public Health Service Act section 2799A 9.
Those rules generally prohibit group health plans and issuers from entering agreements that stop the plan from getting or sharing certain information. The restricted information can include provider specific cost data, quality of care information, de identified claims and encounter data, provider details, service codes, and related financial terms.
In plain English, a health plan should not be locked out of its own plan data because a carrier, network, TPA, PBM, or other service provider put a blocking clause in a contract.
The attestation tells the Departments of Labor, Health and Human Services, and the Treasury that the plan or issuer is complying with that rule. CMS collects the filing on behalf of those agencies. The Department of Labor FAQ points employers back to the same attestation framework.
Who must pay attention in 2026
CMS instructions say group health plans can be fully insured or self funded, and both types are within the filing framework. The instructions also name ERISA plans, non federal governmental plans, church plans, and certain tribal health plans where they are treated as group health plans.
Some arrangements are outside the filing requirement. The CMS instructions list examples such as account based plans, retiree only group health plans, plans that offer only excepted benefits, stand alone dental, stand alone vision, accident only coverage, disability, workers compensation, Medicare, Medicaid, and short term limited duration insurance.
For most employers, the working rule is simple: if the company sponsors an active employee medical plan, someone needs to confirm the attestation path.
The December 31 deadline
CMS says plans and issuers must submit the attestation annually. After the first filing year, the due date is December 31 each year. For 2026, that means the filing should be completed by December 31, 2026.
Employers should not wait until the last week of the year to ask who is filing. Carriers and TPAs may have internal cutoffs, and the person who can confirm the filing may sit outside the normal renewal or account management process.
Fully insured plans
In a fully insured plan, the carrier often has the clearest path to file because it controls many of the network and provider contracts. CMS instructions state that if the issuer submits the attestation on behalf of the group health plan, the Departments will consider both the plan and issuer to have satisfied the requirement.
That does not mean the employer should ignore it. The employer should ask for written confirmation that includes:
- The legal plan name or employer name
- The filing year
- The date filed
- Whether the carrier filed on behalf of the plan
- Any exclusions or contracts the carrier did not cover
A general renewal email saying the carrier handles compliance is not enough if it does not mention the gag clause attestation.
Self funded and level funded plans
Self funded and level funded plans need more active control. CMS instructions say a self funded or partially self funded plan may satisfy the filing requirement through a written agreement where a service provider, such as a TPA, attests on the plan's behalf. But the instructions also warn that the written agreement alone does not satisfy the requirement if the vendor fails to submit.
That detail matters. An employer can delegate the task. It should not delegate the follow up.
For a self funded or level funded plan, ask each relevant vendor:
- Are you filing the 2026 gag clause attestation for our plan?
- Which contracts or benefit lines does your filing cover?
- Are any PBM, behavioral health, repricer, network, or point solution contracts outside your filing?
- Will you provide written confirmation after submission?
- If you are not filing, who must file?
This is especially important when the plan uses separate vendors for medical claims, pharmacy benefits, network access, behavioral health, data analytics, or reference based pricing support.
What contracts are the issue
The filing is not only a checkbox about the plan document. CMS instructions say the gag clause prohibition applies to agreements with health care providers, networks or provider associations, TPAs, and other service providers that offer access to a network of providers.
Employers should think broadly about plan data access. The contract review should consider whether any agreement restricts access to:
- Provider specific cost information
- Quality of care information
- De identified claims data
- Encounter data
- Provider names and clinical designations
- Service codes
- Financial terms tied to claims or provider contracts
- Sharing that data with a business associate for plan administration or quality work
The goal is not to make HR read every vendor contract alone. The goal is to know who reviewed the contracts and who is willing to stand behind the attestation.
What proof employers should keep
Keep a short compliance file for the 2026 attestation. It should be boring and easy to understand one year later.
Include:
- The plan name and EIN used for the filing, if applicable
- The funding arrangement
- The carrier, TPA, PBM, network, and other major vendors
- The party responsible for filing
- The written agreement or vendor statement, if a vendor files
- Submission date
- Confirmation number or filing receipt, if available
- Any contracts or vendors not covered by the filing
- Follow up notes for the next plan year
This matters most when a company changes carriers, moves from fully insured to level funded, changes PBMs, or adds a vendor that touches claims, networks, or plan data.
How this connects to other CAA duties
The gag clause attestation sits in the same general compliance family as other CAA transparency duties. Benefitra has separate guidance on health plan price transparency requirements and self funded fiduciary duties.
It also pairs well with RxDC controls. If your team had to chase vendor filings for prescription drug reporting, see Benefitra's RxDC recovery guide.
The common theme is vendor accountability. Employers do not need to become federal filing technicians, but they do need written proof that the right party handled the right filing for the right plan.
A practical 2026 employer checklist
Start in the third quarter, not December.
First, list every active group health plan and identify whether it is fully insured, level funded, or self funded.
Second, ask the carrier or TPA whether it will file the 2026 gag clause attestation on behalf of the plan.
Third, identify any vendors not covered by that filing, especially PBMs, behavioral health vendors, network access vendors, and repricing arrangements.
Fourth, ask for written confirmation after the filing is submitted.
Fifth, store the proof with the annual compliance calendar so the next filing does not start from scratch.
This is a small task when the owner is clear. It becomes a risk when HR assumes finance handled it, finance assumes the broker handled it, the broker assumes the carrier handled it, and no one has the receipt.
FAQ
What is a gag clause attestation?
A gag clause attestation is an annual filing that confirms a plan or issuer is complying with federal rules that prohibit certain contract restrictions on plan data access and sharing.
When is the 2026 gag clause attestation due?
The 2026 gag clause attestation is due by December 31, 2026.
Do fully insured employers need to file their own attestation?
A carrier can file on behalf of a fully insured group health plan. The employer should still get written confirmation that the carrier filed for the plan.
Do self funded employers remain responsible if a TPA files?
Yes. A self funded plan can use a written agreement for a TPA or other service provider to attest on its behalf, but CMS instructions state that if the vendor fails to submit as required, the plan violates the attestation requirement.
Are dental and vision plans included?
Stand alone dental and vision plans are generally listed as excepted benefits in the CMS instructions and are not treated the same way as active employee medical plans for this filing.
What should an employer keep after the filing?
Keep the plan name, filing year, responsible vendor, written delegation or vendor confirmation, submission date, receipt or confirmation number, and notes about any contracts or vendors not covered.