Self-insured plan sponsors stay on the hook when a third-party administrator files late, and carve-outs can leave gaps
The December 31 deadline for the gag clause attestation is close, and assuming someone else filed it is the classic way to miss it. Under the Consolidated Appropriations Act, 2021 (CAA-21), group health plans must attest each year that their contracts with providers, third-party administrators (TPAs) and other service providers do not restrict access to cost, quality or claims data. The filing is known as the Gag Clause Prohibition Compliance Attestation (GCPCA). Jay Kirschbaum of World Insurance Associates calls the unverified assumption that another party handled it the most common year-end compliance failure.
The attestation goes to the Centers for Medicare and Medicaid Services (CMS) through the agency’s online portal for gag clause prohibition compliance. It applies to fully insured and self-insured plans of any size, grandfathered or not. Plans that offer only excepted benefits, such as standalone dental and vision coverage, do not need to attest.
Where the filing gap opens
For fully insured plans, the carrier typically files on the employer’s behalf, and that submission covers both the plan and the issuer. The coverage is narrower than many employers realize. Some sponsors run a fully insured medical plan alongside a self-insured arrangement, such as a carved-out pharmacy benefit or a behavioral health program. In those cases the carrier’s attestation covers only the insured piece, and the self-insured arrangement needs its own submission.
Self-insured and level-funded sponsors can hand the filing to a TPA through a written agreement, but legal responsibility under CAA-21 stays with the plan. If the TPA misses the deadline, the liability does not move. Treatment of level-funded arrangements varies, so the contract and the funding structure both matter. Under joint guidance from the Departments of Labor, Health and Human Services, and the Treasury in January 2025, a plan that finds a prohibited clause in a contract cannot skip the attestation. It must still file and disclose the clause in the additional information field.
The real cutoff may arrive earlier than December 31. UnitedHealthcare told administrative services only (ASO) customers that requests for the insurer to cover their attestation must reach UnitedHealthcare representatives by November 6, with supporting documents due by November 16. Employers with ASO arrangements who miss that internal window will have to file through the CMS portal themselves before year-end.
Why claims data access is part of this
The attestation is more than paperwork. It sits inside the CAA-21 transparency framework, which is meant to give plan sponsors access to the cost and quality data their plans generate. A contract that still contains a prohibited restriction undercuts those data rights whether or not an attestation has been filed.
That matters because access is already a pain point. HRD America has reported that employers say they cannot get the claims data needed to explain rising costs, and Gallagher’s 2026 Workforce Trends research points to a shift toward continuous oversight and data-driven benefits governance. Confidence in compliance is thin elsewhere in benefits too, with NFP finding only 26 percent of employers very confident in compliance as leave laws spread.
What to confirm before December 31
World Insurance Associates’ 2026 year-end compliance roundup sets out the standard process. Identify who will submit, confirm that every plan option and reporting period is covered, and keep the submission confirmation. For self-insured or carved-out arrangements, that means checking the TPA’s scope and not just the primary medical plan.
Treat December 31 as a task that needs proof of filing, not a vendor’s assurance.
