Gag Clauses Are “Banned”… So Why Can’t Employers Access Their Own Healthcare Data?

On this episode of The EOB Podcast, we tackled one of the most frustrating contradictions in the healthcare benefits industry right now:

Gag clauses are technically banned under the Consolidated Appropriations Act (CAA)… yet employers still cannot consistently access their own healthcare data.

And honestly, that disconnect is becoming impossible to ignore.

The original purpose behind banning gag clauses was simple:
Employers cannot properly manage healthcare plans if they cannot see the underlying data.

Seems reasonable, right?

But what we are seeing in the real world is that many carriers, PBMs, and vendors have simply adapted their strategies post-ban. Instead of relying on explicit contractual gag clauses, they now often use:

• Internal company policies
• “Proprietary information” arguments
• Delayed responses
• Aggregate-only reporting
• Administrative barriers
• Extra fees
• Operational resistance

So technically, the gag clauses may be gone from contracts.

But functionally?
Many employers still feel completely locked out.

What Is a Gag Clause in Healthcare?

A gag clause is a contractual provision that restricts employers or plan sponsors from accessing:

• Claims data
• Pricing information
• Provider reimbursement information
• Pharmacy data
• Quality metrics
• Utilization data

Historically, these provisions prevented employers from fully understanding:

• What healthcare services actually cost
• How vendor pricing worked
• How pharmacy dollars moved
• Whether plans were being managed efficiently
• Whether fiduciary obligations were being met

The Consolidated Appropriations Act prohibited many of these restrictions because regulators recognized a major problem:
You cannot responsibly govern a health plan if you cannot access the underlying information.

And that is exactly where the gag clause attestation requirement came from.

What Is the Gag Clause Attestation Requirement?

Under the CAA, nearly all employer-sponsored health plans are now required to submit annual gag clause attestations confirming that their contracts do not contain prohibited restrictions.

And this applies much more broadly than many employers realize.

During the episode, we discussed how the requirement applies to:

• Fully insured plans
• Self-funded plans
• Level-funded plans
• Consortiums
• Captives
• Church plans
• Most employer-sponsored health arrangements

Yet many employers still assume:
“We’re fully insured, so this doesn’t apply to us.”

That is incorrect.

The requirement applies to almost everyone.

The Biggest Problem: Form Over Substance

One of the strongest themes throughout this conversation was how disappointing the gag clause attestation process has become in practice.

Because in theory, the requirement should help improve transparency.

But in reality, many employers are simply:

• Signing attestations
• Allowing carriers to file on their behalf
• Checking compliance boxes
• Still not getting meaningful data access

As we discussed during the episode, this has become one of the clearest examples of “form over substance” in healthcare regulation.

On paper:
Everything looks compliant.

In practice:
Many employers still cannot access the information they need to properly govern their plans.

And that is a major problem.

“There’s No Gag Clause”… But You Still Can’t Get the Data

One of the most important points we made throughout the episode is that carriers and PBMs have become smarter about how they restrict access.

Years ago, the restrictions often existed directly inside contracts.

Now, employers more commonly hear:

• “That information is proprietary.”
• “We only provide aggregate reporting.”
• “We are not operationally set up for that.”
• “There will be an additional fee.”
• “We need an internal review first.”
• “Why are you asking for this?”

That last one might actually be the most frustrating.

Because employers should not have to justify why they want access to their own healthcare data.

Especially when they are the fiduciaries responsible for overseeing the plan.

Why Claims Data Access Matters So Much

This issue becomes especially problematic when employers try to:

• Move from fully insured to self-funded plans
• Obtain stop-loss coverage
• Evaluate high-cost claims
• Analyze pharmacy spend
• Review utilization trends
• Implement point solutions
• Monitor fiduciary performance

We discussed a real-world example involving a fully insured client attempting to transition toward self-funding.

The issue?
Stop-loss carriers repeatedly declined to quote because the underlying claims data was unavailable or insufficient.

Without meaningful underwriting data:

• Employers lose leverage
• Competition decreases
• Renewal increases become harder to challenge
• Markets become less transparent

And that creates enormous financial consequences.

HIPAA Is Often Used Incorrectly as a Shield

Another important topic throughout the episode was HIPAA.

Many vendors attempt to use HIPAA as justification for restricting access to information.

But as we discussed, HIPAA actually permits employers to access de-identified data tied to their own health plans.

The problem is that many organizations now pivot toward a different argument:
“Pricing is proprietary.”

And honestly, that is where a lot of this conversation starts falling apart.

Because pricing transparency is exactly what employers need in order to:

• Monitor vendors
• Evaluate contracts
• Compare solutions
• Analyze trends
• Improve plan performance
• Fulfill fiduciary obligations

You cannot prudently manage what you cannot see.

The 1,000 Character Opportunity Most Employers Are Ignoring

One of the biggest practical takeaways from the episode involved a lesser-known update to the gag clause attestation process.

Thanks to updated FAQ guidance, employers now have a section where they can provide additional commentary when filing attestations.

It is only 1,000 characters.

But that small box could become far more important than most employers realize.

Why?

Because regulators may not understand the scope of these ongoing transparency problems unless employers actively report them.

If every attestation simply says:
“Everything is fine.”

…then regulators assume the market is functioning properly.

Meanwhile, employers continue struggling behind the scenes.

That is why we strongly encouraged employers, advisers, and fiduciaries to begin documenting:

• Data access restrictions
• Delays
• Refusals
• Aggregate-only reporting
• Operational barriers
• Transparency limitations

If enough organizations report the same problems involving the same vendors, eventually regulators may be forced to take a closer look.

Fiduciary Responsibility Requires Visibility

One of the most important points throughout this episode is that fiduciary responsibility requires access to information.

That includes:

• Claims data
• Pharmacy data
• Utilization reporting
• High-cost claimant information
• Rebate reporting
• Pricing structures
• Compensation arrangements

Because employers are expected to:

• Monitor vendors
• Evaluate plan performance
• Prudently manage plan assets
• Protect employee interests

But those responsibilities become nearly impossible if critical information remains hidden behind:

• proprietary claims
• operational roadblocks
• delayed responses
• incomplete reporting

This is why transparency is not just a “nice to have” anymore.

It is foundational to fiduciary governance.

Gag Clauses Eventually Led Us Into Compensation Disclosure

As the episode evolved, the conversation naturally expanded into compensation disclosure and conflicts of interest.

Because ultimately, many of these transparency issues tie back to financial incentives.

We discussed:

• undisclosed compensation
• overrides
• persistency bonuses
• indirect payments
• hidden revenue streams
• conflicts within healthcare contracting

And one of the strongest points we made was this:
Employers should know exactly how every adviser, consultant, broker, PBM, and vendor involved with their plan is being compensated.

That should not be controversial.

In almost every other professional industry:

• compensation disclosure is standard
• conflicts must be disclosed
• fiduciary expectations are clearer

Healthcare benefits continues lagging behind in many of those areas.

What Employers Should Be Doing Right Now

One of the biggest goals of this episode was encouraging employers to become more proactive.

Right now, plan sponsors should be:

• Requesting detailed claims data
• Demanding pharmacy transparency
• Reviewing compensation arrangements
• Asking harder fiduciary questions
• Filing their own attestations when necessary
• Documenting transparency barriers
• Monitoring vendor behavior
• Evaluating reporting limitations

And importantly:
Do not assume that because a carrier filed an attestation on your behalf, there is no problem.

That assumption is exactly why many of these issues continue.

Final Thoughts: You Cannot Manage What You Cannot See

At the end of the day, this entire conversation comes back to one simple reality:

You cannot manage what you cannot see.

The gag clause prohibition was supposed to improve transparency inside employer-sponsored healthcare.

In many ways, it exposed just how difficult meaningful transparency still is.

But employers now have:

• more awareness
• more legal grounding
• more fiduciary responsibility
• more opportunities to demand accountability

And frankly, the organizations asking harder questions today are going to be in a much stronger position moving forward.

FAQ: Gag Clauses and Healthcare Data Access

What is a gag clause in healthcare?

A gag clause is a restriction that limits an employer’s ability to access healthcare claims, pricing, utilization, or reimbursement data tied to their health plan.

Were gag clauses banned?

Yes. The Consolidated Appropriations Act prohibited many gag clauses in employer healthcare contracts.

What is a gag clause attestation?

It is an annual filing requirement where employer-sponsored health plans confirm their contracts do not contain prohibited gag clauses.

Why are employers still struggling to access data?

Many carriers and PBMs now rely on operational policies, proprietary claims, delays, or aggregate reporting limitations instead of explicit contractual restrictions.

Does HIPAA prevent employers from accessing claims data?

Not necessarily. Employers can often access de-identified plan data needed for fiduciary oversight and plan management.

Why does healthcare data access matter?

Without detailed data, employers cannot properly evaluate vendors, monitor costs, analyze trends, or fulfill fiduciary responsibilities.

Listen to the Full Episode

To hear the full conversation and explore more discussions around gag clauses, healthcare transparency, ERISA compliance, fiduciary governance, and employer health plan strategy, visit The EOB Podcast.