Three requirements a plan now carries, and what the agencies have actually said about enforcing them
An attestation is due every 31 December and a drug spending report every 1 June. We could find no enforcement action on either, and the only good-faith allowance published for the drug report applied to the first cycle and has never been renewed.
Published November 9, 2026
10 min read
Information provided is for general reference only and does not constitute medical advice. Consult a qualified healthcare professional before making medical decisions.
The Consolidated Appropriations Act requirements give every group health plan two recurring filings: a gag clause attestation due by 31 December each year and a prescription drug report due by 1 June. We found no enforcement action on either, and the only good-faith allowance for the drug report expired with its first cycle in December 2022.
Sylk Health. Current as of October 2026.
A plan that is weighing any change to how it buys care is already carrying three reporting duties created by the same statute, enacted on 27 December 2020. A companion piece covers the first of them, which is the disclosure a plan must receive about what its broker or consultant is paid. This one places that alongside the other two and sets out what the primary documents say, including where the enacted statute and the current code text do not match.
What does the gag clause prohibition reach?
It reaches contracts that stop a plan sharing cost or quality information. The prohibition (opens in new tab) covers an agreement between a plan and a provider, a network, a third-party administrator or another service provider offering network access, where that agreement would restrict the plan from doing certain things. The first of those things is "providing provider-specific cost or quality of care information or data, through a consumer engagement tool or any other means, to referring providers, the plan sponsor, participants or beneficiaries, or individuals eligible to become participants or beneficiaries of the plan or coverage."
The proof obligation is separate and annual: "A group health plan (or health insurance coverage offered in connection with such a plan) shall annually submit to the Secretary an attestation that such plan or issuer of such coverage is in compliance with the requirements of this subsection."
The deadline has not moved since it was set. The agency collecting the attestations (opens in new tab) states that "The first GCPCA is due no later than December 31, 2023. Subsequent attestations are due by December 31 of each year thereafter." The initialism is the gag clause prohibition compliance attestation. We checked the department's numbered guidance series through its most recent instalment and found nothing revising that date.
Who has to file the attestation?
More plans than sponsors often assume. The departments' own list (opens in new tab) of entities that must attest includes "fully-insured and self-insured group health plans, including ERISA plans, non-Federal governmental plans; and church plans subject to the Code", where ERISA is the Employee Retirement Income Security Act. There is no small-plan exemption anywhere in that list.
The entities excused are named separately and are "plans or issuers offering only excepted benefits; issuers offering only short-term, limited-duration insurance; Medicare and Medicaid plans; state Children's Health Insurance Program (CHIP) plans; the TRICARE program; the Indian Health Service program; and Basic Health Program Plans." There is one further current carve-out, and it is a real agency position rather than an inference from silence. The departments state that they "will not enforce the requirement to submit a Gag Clause Prohibition Compliance Attestation against plans that consist solely of health reimbursement arrangements (HRAs), or other account-based group health plans".
What does the prescription drug report ask for?
It asks for a year of drug and spending data, every year. The codified text (opens in new tab) requires that "Not later than 1 year after December 27, 2020, and not later than June 1 of each year thereafter, a group health plan (or health insurance coverage offered in connection with such a plan) shall submit to the Secretary, the Secretary of Health and Human Services, and the Secretary of the Treasury the following information with respect to the health plan or coverage in the previous plan year".
Ten categories follow. The first five are:
"The beginning and end dates of the plan year"
"The number of participants and beneficiaries"
"Each State in which the plan or coverage is offered"
"The 50 brand prescription drugs most frequently dispensed by pharmacies for claims paid by the plan or coverage, and the total number of paid claims for each such drug"
"The 50 most costly prescription drugs with respect to the plan or coverage by total annual spending, and the annual amount spent by the plan or coverage for each such drug"
Later items reach total health spending broken down by cost type and by who bears it, and the effect of manufacturer rebates on premiums. The agency runs the submissions through its prescription drug data collection page (opens in new tab).
Where do the texts disagree with each other?
In two places, and both are worth knowing before citing either. The first is a codification convention. The enacted provision set the trigger as one year after the date of enactment. The current code section substitutes the literal date, 27 December 2020. Nothing substantive changed, and a reader holding the public law next to the code will still see two different sentences.
The second is not a convention. The statute was enacted in three parallel versions, and only the public health service version carries the words "(except for a church plan)". The labour version does not, and neither does the tax code version, which we checked because our first pass had left it open. Whether a church plan is excused from the drug report therefore depends on which of three simultaneously enacted texts a reader happens to open.
For a reader today the codified sections are the ones to cite, which is also how the departments cite them in their own current guidance.
What have the agencies said about enforcement?
Less than the volume of commentary would suggest, and the most quoted reassurance has expired. The table below lists every enforcement statement we found, with what it covers and whether it still applies.
Agency statement
What it covers
Status in October 2026
Non-filers "may be subject to enforcement action"
Missed gag clause attestation
Current
Good-faith self-reporting taken into account
A plan that discloses a prohibited clause
Current
No enforcement against account-based plans
Attestation by plans consisting solely of HRAs
Current
No enforcement for good-faith interpretation
Drug report data for 2020 and 2021, due 27 December 2022
Expired; never extended
The second row is narrower than it sounds. The departments "will take into account good-faith efforts to self-report a prohibited gag clause in any enforcement action brought by the Departments", according to their later guidance (opens in new tab). That is consideration for self-reporting a violation. It is not a safe harbour, and it does nothing for a missed deadline.
The fourth row is historical and says so on its face. The departments wrote (opens in new tab) that "for the 2020 and 2021 data submissions that are due by December 27, 2022, the Departments will not take enforcement action with respect to any plan or issuer that uses a good faith, reasonable interpretation of the regulations and the Prescription Drug Data Collection (RxDC) Reporting Instructions in making its submission." We read the numbered guidance series through its newest instalment and found nothing extending it to any later data year.
We looked for an enforcement action on either requirement and found none, in the department's own newsroom or on its enforcement pages. Two readers searched separately and reached the same result. That is a failure to find rather than proof that none has occurred. In April 2026 the labour department also announced a bulletin narrowing its enforcement priorities across the board. It is not about either requirement and must not be cited as though it were.
Frequently asked questions
When is the gag clause attestation due?
By 31 December every year. The agency collecting attestations states that "The first GCPCA is due no later than December 31, 2023. Subsequent attestations are due by December 31 of each year thereafter." Its page was last modified on 19 September 2024, and the department's guidance series, read through its newest instalment, contains nothing moving that date.
Do small employer plans have to file the attestation?
The published list contains no size exemption. It names "fully-insured and self-insured group health plans, including ERISA plans, non-Federal governmental plans; and church plans subject to the Code" as required to attest. The 7 categories excused are defined by type of coverage, such as excepted benefits or Medicare plans, and one further position excuses plans consisting solely of HRAs. Size is not among them.
Is there still a good-faith allowance for the prescription drug report?
Not one we could find. The only published good-faith allowance covered "the 2020 and 2021 data submissions that are due by December 27, 2022". We read the departments' numbered guidance through its newest instalment and found nothing extending it to any later data year. A summary that describes it as a standing allowance is describing the first cycle only.
What the Consolidated Appropriations Act requirements have to do with a price
The Consolidated Appropriations Act requirements have nothing directly to do with a price, and that is the point of including them. Our business is supplying a procedure price from outside the United States. A plan that might one day use such a price is already carrying these duties, and they are the machinery a sponsor is actually operating when anyone proposes a change to it. Our posts on level-funded plans and what we supply to employers set out where a price fits.
We describe what the instruments say. We do not advise on compliance with any of them, and a sponsor with a decision to make should take it from counsel.
This article is general information about federal statutes and agency guidance. It is not legal, tax or financial advice; consult counsel on any compliance decision.
Disclosure: Sylk Health supplies procedure-price data and earns a commission from providers on bookings completed through its platform. It would benefit from broader use of externally benchmarked prices for medical procedures, and from any gap between those prices and prices in the United States.
29 U.S.C. 1185n (opens in new tab), reporting on pharmacy benefits and drug costs, as codified, including the ten enumerated data categories.
Public Law 116-260, Division BB, Title II, sections 201 and 204, as enacted, at 134 Stat. 2890 to 2893 and 2918 to 2921, comprising the public health service, labour and tax code versions.
Department of Labor, Employee Benefits Security Administration, Field Assistance Bulletin 2026-01, announced 14 April 2026, cited only as agency-wide enforcement context.
Browse provider-listed prices on medical procedures at accredited international hospitals. No coordinator, no callbacks. Send a consultation request directly.
