What is the gag clause prohibition and attestation?
Last updated October 2, 2026
Health plans may no longer agree to contract terms that block access to provider-specific cost or quality data, or restrict sharing claims data — "gag clauses." Plans must attest compliance to CMS annually by December 31, and the attestation duty sits with the plan even when vendors file it.
The CAA voided a quiet feature of many network and TPA contracts: clauses preventing plans from seeing or sharing their own cost, quality, and claims data. Plans and carriers cannot enter agreements containing these "gag clauses," and every plan must file an annual Gag Clause Prohibition Compliance Attestation with CMS by December 31.
For fully-insured plans, the carrier's attestation can cover the plan — but confirm it in writing. Self-funded plans typically attest themselves, even when the TPA assists.
The attestation has teeth beyond the filing: it forces a contract review. If a vendor agreement still contains data-access restrictions, the fix is renegotiation, not creative attestation. Document the review, the vendor confirmations, and the filing date each year.
Thanks for your feedback!