Gag Clause Attestation 2026: The December 31 Deadline Employers Miss

The Gag Clause Prohibition Compliance Attestation is due December 31, 2026 for every employer group health plan, fully insured or self-insured. Here is who has to file, what counts as a gag clause, and what changed for 2026.

Quick Answer (as of 2026): Every employer group health plan, fully insured or self-insured, of any size, must submit a Gag Clause Prohibition Compliance Attestation to CMS by December 31, 2026. The attestation confirms the plan has no contract terms that block sharing cost or quality data with the plan sponsor. A fully insured plan can rely on its carrier to file, but the sponsor should confirm it happened.

A 30-person company that only offers a fully insured medical plan through a well-known carrier still has a federal filing deadline most HR teams have never heard of. The Gag Clause Prohibition Compliance Attestation, created by the Consolidated Appropriations Act of 2021, applies to nearly every employer group health plan in the country, and missing it can trigger the same excise tax exposure as missing an ACA reporting deadline. Here is exactly who has to file, what a gag clause actually is, and what changed for the 2026 attestation.

What Is the Gag Clause Prohibition Compliance Attestation?

The Gag Clause Prohibition Compliance Attestation, known as the GCPCA, is an annual federal filing confirming that a group health plan's contracts with insurers, providers, and third-party administrators do not contain gag clauses. Congress created the underlying prohibition in Section 201 of the Consolidated Appropriations Act of 2021, amending ERISA Section 724, Internal Revenue Code Section 9824, and Public Health Service Act Section 2799A-9. The requirement applies to every group health plan and health insurance issuer, regardless of plan size, funding type, or grandfathered status under the Affordable Care Act, including employers running a Section 125 cafeteria plan alongside their major medical coverage.

What Counts as a Gag Clause?

A gag clause is a contract term that blocks a health plan from sharing provider-specific cost or quality data, or from accessing its own claims data. Specifically, the prohibition targets contract language that restricts a plan or insurer from giving provider-specific cost or quality information to referring providers, the plan sponsor, or plan participants, from electronically accessing de-identified claims data on request, or from sharing that data with a business associate consistent with privacy law. A common example is a network contract clause that bars an employer from seeing what its own plan actually pays different providers for the same procedure, language that was common in provider network agreements before the CAA banned it.

Summit Health Benefits helps employers stay ahead of federal compliance deadlines. If you are not sure whether your carrier or TPA has filed your gag clause attestation, we will help you confirm it before December 31. Get a free compliance check.

Who Has to File the Attestation?

Every group health plan sponsor has to file, but who actually submits the attestation depends on how the plan is funded. For a fully insured plan, the insurance carrier can submit the attestation on the plan's behalf, and once the carrier does, the sponsor's own filing requirement is considered satisfied. For a self-insured plan, including a level-funded plan, the legal responsibility to file stays with the employer even if a third-party administrator submits it under a written agreement to do so. Employers weighing a move toward one of the small business health insurance alternatives covered elsewhere on this site should factor the GCPCA into that decision, since switching from fully insured to self-insured shifts this filing duty squarely onto the employer. An employer that assumes its carrier automatically handles everything should still confirm the filing was actually completed, since the consequence of an unfiled attestation falls on the plan sponsor, not the vendor.

When Is the 2026 Attestation Due?

The GCPCA is due December 31, 2026, covering the period since the plan's last attestation, submitted electronically through the Centers for Medicare and Medicaid Services HIOS system using the GCPCA webform. The deadline is the same date every year regardless of a plan's own plan year start date, unlike a filing such as the PCORI fee, which is tied to when each plan year ends. Employers researching the requirement for the first time sometimes assume it is a one-time filing tied to a new plan launch, but it repeats annually as long as the plan exists, the same way Form 5500 filing obligations recur every year a plan stays active.

What Changed for the 2026 Attestation?

The 2026 attestation extends the no-gag-clause promise to downstream vendor contracts, not just the plan's own agreements. Starting with this year's filing, an employer's attestation also implies that the insurers and third-party administrators it contracts with have not entered into their own downstream agreements, such as with a network owner, that would violate the gag clause prohibition. Regulators expect a plan's contracts with its own vendors to include language requiring those vendors to avoid gag clauses in their own downstream deals, a layer of contractual flow-down that was not spelled out as clearly in earlier attestation cycles.

What Happens if a Plan Does Not File?

A missed gag clause attestation exposes the plan sponsor to the same excise tax framework that applies to other group health plan compliance failures under Internal Revenue Code Section 4980D, generally $100 per day per affected individual. A failure discovered on IRS audit and voluntarily corrected can still carry a minimum excise tax around $2,500 even for an unintentional oversight. Enforcement authority runs through the Department of Labor for plans subject to ERISA and through the Department of Health and Human Services for plans that are not, with HHS sharing enforcement against insurers with state insurance regulators.

How Should an Employer Confirm Compliance Before December 31?

An employer should ask its carrier or TPA in writing whether the 2026 GCPCA has been or will be filed on the plan's behalf, and keep that confirmation on file as documentation. For a self-insured plan relying on a TPA, the employer should confirm a written agreement exists assigning the filing task, since an informal understanding does not shift the underlying legal responsibility away from the plan sponsor. This is the same kind of vendor-documentation discipline that matters for HIPAA compliance and other federal health plan deadlines, and an employer already tracking COBRA notice timelines and open enrollment deadlines should simply add December 31 to that same compliance calendar. Legal counsel or a benefits consultant can also review vendor contracts for gag clause language before the deadline, which matters more this year given the new downstream-agreement expectation.

<!-- SECTION125_CONTACT -->

Frequently Asked Questions

What is the gag clause attestation deadline for 2026?
The Gag Clause Prohibition Compliance Attestation is due December 31, 2026 for every employer group health plan. The deadline is fixed to the calendar year and does not shift based on when a plan's own plan year begins or ends.
Does a small employer with a fully insured plan have to file a gag clause attestation?
Yes, the requirement applies regardless of plan size, but a fully insured plan's sponsor can rely on its insurance carrier to submit the attestation on the plan's behalf. Once the carrier files, the sponsor's own obligation is considered satisfied, though the sponsor should still confirm the filing actually happened.
Who is responsible for filing if a plan is self-insured?
The self-insured plan sponsor remains legally responsible for the attestation even if a third-party administrator submits it. A TPA can only file on the employer's behalf under a written agreement assigning that task, and the underlying legal responsibility never fully transfers away from the plan sponsor.
What is an example of a gag clause in a health plan contract?
A common example is a provider network agreement that prevents the plan from seeing or sharing what it actually pays different providers for the same procedure. Any contract term restricting provider-specific cost or quality data, or blocking access to de-identified claims data, qualifies as a prohibited gag clause under the Consolidated Appropriations Act.
What changed about the gag clause attestation for 2026?
The 2026 attestation now also implies that a plan's insurers and third-party administrators have not entered into their own downstream agreements, such as with a network owner, that would violate the gag clause prohibition. Employers are expected to have contract language with their own vendors requiring them to avoid gag clauses further down the vendor chain.
What is the penalty for missing the gag clause attestation?
A missed attestation falls under the same Internal Revenue Code Section 4980D excise tax framework as other group health plan compliance failures, generally $100 per day per affected individual. A failure caught on IRS audit and corrected can still carry a minimum excise tax of roughly $2,500 even when the oversight was unintentional.
Is the gag clause attestation a one-time filing?
No. The attestation repeats every year for as long as the group health plan exists, covering the period since the plan's last submission. A plan does not become exempt from future filings just because it submitted an attestation in a prior year.
Where is the gag clause attestation actually submitted?
The attestation is filed electronically through the Centers for Medicare and Medicaid Services HIOS system using the GCPCA webform on the GCPCA Dashboard. There is no paper filing option, so a plan sponsor or its designated vendor needs an active HIOS account before the December 31 deadline.

Sources

This article cites Section 201 of the Consolidated Appropriations Act of 2021, ERISA Section 724, Internal Revenue Code Sections 9824 and 4980D, Public Health Service Act Section 2799A-9, and guidance published by the Centers for Medicare and Medicaid Services and the Department of Labor on the Gag Clause Prohibition Compliance Attestation.

See Employer Benefit Options