Gag clause filing due Dec. 31: outsourcing won’t shift the liability

Self-insured and level-funded sponsors can hand the filing to a TPA through a written agreement, but legal responsibility under CAA-21 stays with the plan. If the TPA misses the deadline, the liability does not move. Treatment of level-funded arrangements varies, so the contract and the funding structure both matter. Under joint guidance from the Departments of Labor, Health and Human Services, and the Treasury in January 2025, a plan that finds a prohibited clause in a contract cannot skip the attestation. It must still file and disclose the clause in the additional information field.

The real cutoff may arrive earlier than December 31. UnitedHealthcare told administrative services only (ASO) customers that requests for the insurer to cover their attestation must reach UnitedHealthcare representatives by November 6, with supporting documents due by November 16. Employers with ASO arrangements who miss that internal window will have to file through the CMS portal themselves before year-end.

Why claims data access is part of this

The attestation is more than paperwork. It sits inside the CAA-21 transparency framework, which is meant to give plan sponsors access to the cost and quality data their plans generate. A contract that still contains a prohibited restriction undercuts those data rights whether or not an attestation has been filed.

That matters because access is already a pain point. HRD America has reported that employers say they cannot get the claims data needed to explain rising costs, and Gallagher’s 2026 Workforce Trends research points to a shift toward continuous oversight and data-driven benefits governance. Confidence in compliance is thin elsewhere in benefits too, with NFP finding only 26 percent of employers very confident in compliance as leave laws spread.

What to confirm before December 31

World Insurance Associates’ 2026 year-end compliance roundup sets out the standard process. Identify who will submit, confirm that every plan option and reporting period is covered, and keep the submission confirmation. For self-insured or carved-out arrangements, that means checking the TPA’s scope and not just the primary medical plan.