Set out below are Frequently Asked Questions (FAQs) regarding implementation of certain provisions of Title I (the No Surprises Act) and Title II (Transparency) of division BB of the Consolidated Appropriations Act, 2021 (the CAA).  These FAQs have been prepared jointly by the Departments of Labor, Health and Human Services (HHS), and the Treasury (collectively, the Departments), along with the Office of Personnel Management (OPM).  Like previously issued FAQs (available at https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs and http://www.cms.gov/cciio/resources/fact-sheets-and-faqs/index.html), these FAQs answer questions from stakeholders to help people understand the law and promote compliance.

The No Surprises Act

Sections 102 and 103 of the No Surprises Act added section 9816 to the Internal Revenue Code (Code), section 716 to Employee Retirement Income Security Act (ERISA), and section 2799A-1 to the Public Health Service (PHS) Act. Section 104 of the No Surprises Act added sections 2799B-1 and 2799B-2 to the PHS Act. Section 105 of the No Surprises Act added section 9817 to the Code, section 717 to ERISA, and sections 2799A-2 and 2799B-5 to the PHS Act. These provisions provide protections against surprise medical bills for participants, beneficiaries, and enrollees in a group health plan or group or individual health insurance coverage offered by a health insurance issuer with respect to certain out-of-network services.

The Departments and OPM(1) issued interim final rules (July 2021 interim final rules(2) and October 2021 interim final rules(3)), and the Departments issued final rules (August 2022 final rules(4)) implementing provisions of Code sections 9816 and 9817, ERISA sections 716 and 717, and PHS Act sections 2799A-1 and 2799A-2. Pursuant to Code section 9816(c)(2)(A), ERISA section 716(c)(2)(A), and PHS Act section 2799A-1(c)(2)(A), the Departments also established a Federal Independent Dispute Resolution (IDR) process for resolving disputes between plans or issuers and providers, facilities, or providers of air ambulance services about the out-of-network rate for items or services subject to the No Surprises Act in cases where a specified State law or an applicable All-Payer Model Agreement does not provide a method for determining the out-of-network rate, and the parties do not agree to an out-of-network rate through open negotiation. The Departments have also previously issued guidance on various No Surprises Act implementation issues, including FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 55 (FAQs Part 55).(5)

TMA III and Related Guidance: Calculation of Qualifying Payment Amounts (QPAs)

On August 24, 2023, the United States District Court for the Eastern District of Texas (district court) issued an opinion and order in Texas Medical Association, et al. v. United States Department of Health and Human Services et al. (TMA III), vacating certain provisions of the July 2021 interim final rules as well as certain portions of several No Surprises Act guidance documents issued by the Departments.(6) The district court in TMA III held that several provisions of the regulations and guidance are unlawful and vacated and remanded them for further consideration, including provisions related to the methodology for calculating the QPA. The Department of Justice partially appealed the district court's decision in TMA III to the United States Court of Appeals for the Fifth Circuit (Fifth Circuit).(7)

On October 6, 2023, the Departments and OPM issued FAQs about Consolidated Appropriations Act, 2021 Implementation Part 62 (FAQs Part 62).(8) In FAQs Part 62, the Departments and OPM acknowledged the impact of the district court's decision in TMA III on QPAs and the significant resources and challenges associated with recalculating QPAs in accordance with the applicable statutes and regulations that remained in effect after the decision. Therefore, the FAQs stated that the Departments and OPM would exercise their enforcement discretion under the relevant No Surprises Act provisions for any plan or issuer, or party to a payment dispute in the Federal IDR process, that uses a QPA calculated in accordance with the methodology under the July 2021 interim final rules and guidance in effect immediately before the district court's decision in TMA III (the 2021 methodology), for items and services furnished before May 1, 2024, the first day of the calendar month that was 6 months after the issuance of FAQs Part 62. This exercise of enforcement discretion applied to QPAs for purposes of calculating patient cost sharing, providing required disclosures with an initial payment or notice of denial of payment, and providing required disclosures and submissions under the Federal IDR process.

The FAQs stated that HHS would also exercise enforcement discretion under the relevant No Surprises Act provisions for a provider, facility, or provider of air ambulance services that bills, or holds liable, a participant, beneficiary, or enrollee for a cost-sharing amount based on a QPA calculated with respect to an item or service furnished before May 1, 2024, in accordance with the 2021 methodology.

The Departments and OPM subsequently issued FAQs about Consolidated Appropriations Act, 2021 Implementation Part 67 (FAQs Part 67)(9) on May 1, 2024. In FAQs Part 67, in consideration of feedback from plans and issuers that additional time was necessary to complete the significant efforts associated with recalculating QPAs in a manner consistent with the statutes and regulations that remained in effect after the district court's decision in TMA III (the 2023 methodology), the Departments and OPM extended the enforcement relief provided in FAQs Part 62 for an additional 6 months, that is, for items and services furnished before November 1, 2024.

On October 30, 2024, the Fifth Circuit issued an opinion and order in TMA III,(10) which partially reversed the district court's decision with respect to certain provisions in the July 2021 interim final rules and implementing guidance under the No Surprises Act related to the methodology for calculating the QPA that had been vacated by the district court in TMA III. The Fifth Circuit reversed the district court's vacatur of certain challenged provisions related to the QPA methodology, including the inclusion of contracted rates for items and services "regardless of the number of claims paid at that contracted rate," the exclusion of single case agreements, and the exclusion of bonus, incentive, and risk-sharing payments.(11) The Fifth Circuit also affirmed the district court's vacatur of certain deadline provisions(12) and the district court's holding as to the requirements regarding disclosure of information about the QPA.(13)

Q1: How should plans and issuers calculate a QPA for purposes of patient cost sharing, disclosures with an initial payment or notice of denial of payment, and disclosures and submissions required under the Federal IDR process following the Fifth Circuit decision in TMA III?

Unless the Fifth Circuit decides to rehear its panel's TMA III decision and alters its judgment,(14) plans and issuers will have to calculate QPAs using a good faith, reasonable interpretation of the applicable statutes and regulations that remain in effect(15) following the decisions of both the Fifth Circuit and the district court in TMA III (the 2024 methodology) upon issuance of the Fifth Circuit's mandate.(16)

The Departments and OPM acknowledge the impact of the Fifth Circuit decision on QPAs and the challenges for plans and issuers associated with recalculating QPAs under changing methodologies. The Departments and OPM recognize that it might take a significant amount of time and resources to again review existing QPAs and recalculate the QPAs in accordance with the 2024 methodology once the Fifth Circuit's mandate issues. Therefore, the Departments and OPM have extended the enforcement discretion, originally provided in FAQs Part 62 and extended in FAQs Part 67, under the relevant No Surprises Act provisions for any plan or issuer, or party to a payment dispute in the Federal IDR process, that uses a QPA calculated in accordance with the 2021 methodology, for items and services furnished before August 1, 2025, the first day of the calendar month that begins after 6 months from the issuance of these FAQs.

Because the Fifth Circuit's mandate has not yet issued, plans and issuers may also, consistent with FAQs Part 62, continue to rely on any QPAs that have already been calculated using a good faith, reasonable interpretation of the 2023 methodology. Once the Fifth Circuit's mandate issues, the Departments will also exercise their enforcement discretion under the relevant No Surprises Act provisions for any plan or issuer, or party to a payment dispute in the Federal IDR process, that uses a QPA calculated using a good faith, reasonable interpretation of the 2023 methodology, for items and services furnished before August 1, 2025. These exercises of enforcement discretion (with respect to the 2021 methodology and the 2023 methodology) apply to QPAs for purposes of patient cost sharing, providing required disclosures with an initial payment or notice of denial of payment, and providing required disclosures and submissions under the Federal IDR process.

HHS will similarly exercise enforcement discretion under the relevant No Surprises Act provisions for a provider, facility, or provider of air ambulance services that bills, or holds liable, a participant, beneficiary, or enrollee for a cost-sharing amount based on a QPA calculated in accordance with the 2021 methodology or the 2023 methodology, for items and services furnished before August 1, 2025.

HHS encourages States that are the primary enforcers of the relevant No Surprises Act provisions with respect to issuers, providers, facilities, or providers of air ambulance services to adopt a similar approach to enforcement. HHS will not consider a State to be failing to substantially enforce these provisions because the State adopts such an approach.

The Departments and OPM will reevaluate in a timely fashion whether additional time for the enforcement relief is necessary as plans and issuers take reasonable steps to come into compliance with the applicable statutes and regulations that remain in effect after the Fifth Circuit and district court decisions in TMA III.

Q2: How should plans and issuers make disclosures about the QPA to nonparticipating providers, facilities, and providers of air ambulance services with an initial payment or notice of denial of payment, and in a timely manner upon request of the provider or facility?

Consistent with previously issued guidance,(17) which was not affected by the Fifth Circuit decision, plans and issuers must continue to comply with the requirements related to disclosure of information about the QPA.(18) This includes the requirement to include a statement certifying that the QPA applies for purposes of the recognized amount (or, in the case of air ambulance services, for calculating the participant's, beneficiary's, or enrollee's cost sharing) and that each QPA was determined in compliance with 26 CFR 54.9816-6T, 29 CFR 2590.716-6, and 45 CFR 149.140, as applicable.

For purposes of the statement that each QPA was determined in compliance with applicable regulatory requirements, a plan or issuer may certify that a QPA was determined in compliance with applicable rules where the QPA was calculated using a good faith, reasonable interpretation of the applicable statutes and regulations that remain in effect following the decisions of both the Fifth Circuit and the district court in TMA III, as described in Q1.

Further, the Departments and OPM will exercise enforcement discretion for disclosures regarding a QPA provided with an initial payment or notice of denial of payment, consistent with the exercise of enforcement discretion outlined in Q1. Specifically, for items and services furnished before August 1, 2025, the Departments and OPM will exercise enforcement discretion with respect to these disclosures where a plan or issuer that uses the 2021 methodology or the 2023 methodology certifies that a QPA was determined in compliance with 26 CFR 54.9816-6T, 29 CFR 2590.716-6, and 45 CFR 149.140, as applicable, provided that the plan or issuer, in a timely manner upon request of the provider, facility, or provider of air ambulance services, discloses that it is using a QPA calculated in accordance with the 2021 methodology or the 2023 methodology, as applicable.

HHS encourages States that are the primary enforcers of the relevant No Surprises Act provisions with respect to issuers to adopt a similar approach to enforcement. HHS will not consider a State to be failing to substantially enforce these provisions because the State adopts such an approach.

Requirements for Initial Payments or Notices of Denial of Payment and Related Disclosures

The No Surprises Act and the July 2021 interim final rules require plans and issuers to determine whether services are covered under the plan or coverage and, if the services are covered, to send an initial payment or notice of denial of payment to a nonparticipating provider, facility, or provider of air ambulance services not later than 30 calendar days after the provider, facility, or provider of air ambulance services submits a bill related to items and services subject to the No Surprises Act.(19, 20)

The July 2021 interim final rules and the August 2022 final rules outline certain written disclosures that a plan or issuer must provide, in paper or electronic form, with the initial payment or notice of denial of payment, in cases in which the recognized amount (or with respect to air ambulance services, the amount on which cost sharing is based) is the QPA. This includes information related to the QPA for each item or service, whether the QPA is based on a downcoded service code or modifier,(21) a certification statement, a statement related to the opportunity to initiate a 30-day open negotiation period, and contact information for the appropriate person or office to initiate open negotiation.(22)

The No Surprises Act and the October 2021 interim final rules provide that either party may, during the 30-business-day period beginning on the day the provider, facility, or provider of air ambulance services receives an initial payment or notice of denial of payment regarding the item or service, initiate an open negotiation period for purposes of determining the out-of-network rate for such item or service.(23) The open negotiation period may continue for up to 30 business days. The parties may discontinue the negotiation if they agree on an out-of-network rate before the last day of the 30-business-day open negotiation period. Code section 9816(c)(6), ERISA section 716(c)(6), and PHS Act section 2799A-1(c)(6) provide, with respect to an item or service for which a payment amount is determined through open negotiation, payment shall be made directly to the nonparticipating provider or facility not later than 30 days after the date on which such determination is made.(24)

If the parties cannot agree on an out-of-network rate, they must exhaust the 30-business-day open negotiation period before initiating the Federal IDR process.(25) Thereafter, either party may initiate the Federal IDR process during the 4-business-day period(26) beginning on the 31st business day after the start of the open negotiation period.(27) The No Surprises Act and the October 2021 interim final rules provide that, not later than 30 business days after the selection of a certified IDR entity, the certified IDR entity must select one of the offers submitted by either party to the dispute to be the out-of-network rate for the qualified IDR item or service.(28) If applicable, the amount of the offer selected by the certified IDR entity (less the sum of the initial payment and any cost sharing paid or owed by the participant, beneficiary, or enrollee) must be paid directly to the provider, facility, or provider of air ambulance services not later than 30 calendar days after the determination by the certified IDR entity. If the offer selected by the certified IDR entity is less than the sum of the initial payment and any cost sharing paid or owed by the participant, beneficiary, or enrollee, the provider, facility, or provider of air ambulance services will be liable to the plan or issuer for the difference and must pay the difference directly to the plan or issuer not later than 30 calendar days after the determination by the certified IDR entity.(29)

The Departments have received questions about whether and how these timeframes are affected when a plan or issuer sends an initial payment or notice of denial of payment to a nonparticipating provider, facility, or provider of air ambulance services electronically, while separately furnishing the disclosures required to be provided with the initial payment or notice of denial of payment in paper form.(30) As a result, a nonparticipating provider, facility, or provider of air ambulance services may receive an initial payment or notice of denial of payment on an earlier date than it receives the required disclosures.

Q3: When must a plan or issuer provide the required disclosures to a provider, facility, or provider of air ambulance services in situations where an initial payment or notice of denial of payment is sent electronically and the required disclosures are sent in paper form?

Plans and issuers are required to furnish certain disclosures in writing, in paper or electronic form, to a nonparticipating provider, facility, or provider of air ambulance services with the initial payment or notice of denial of payment, in cases in which the recognized amount (or with respect to air ambulance services, the amount on which cost sharing is based) is the QPA.(31) The fact that a plan's or issuer's method of electronic transmission of the initial payment or notice of denial of payment does not allow for these disclosures to be sent as part of the same transmission does not relieve the plan or issuer from the requirement to provide the required disclosures "with each initial payment or notice of denial of payment."(32)

Therefore, where an initial payment or notice of denial of payment is sent electronically and the required disclosures are sent in paper form for out-of-network emergency services and applicable non-emergency items and services, a plan or issuer must transmit the required disclosures on or near the date that it sends the initial payment or notice of denial of payment, and must ensure that both the initial payment or notice of denial of payment and the required disclosures are sent not later than 30 calendar days after the plan or issuer receives the information necessary to decide a claim for payment for the services billed by the provider or facility. Where an initial payment or notice of denial of payment is sent electronically and the required disclosures are sent in paper form for out-of-network air ambulance services, a plan or issuer must transmit the required disclosures on or near the date that it sends the initial payment or notice of denial of payment, and must ensure that both the initial payment or notice of denial of payment and the required disclosures are sent not later than 30 calendar days after the bill for services is transmitted by the provider of air ambulance services.(33)

Requirements for Initiation of Open Negotiation Periods and Federal IDR Process

In general, providers, facilities, and providers of air ambulance services have 30 business days from the day they receive an initial payment or notice of denial of payment from the plan or issuer to initiate open negotiation. The Departments understand that the disclosures a plan or issuer must provide with an initial payment or notice of denial of payment contain critical information necessary for a provider, facility, or provider of air ambulance services to initiate open negotiation.(34) However, as explained in Q3 above, the Departments recognize that providers, facilities, and providers of air ambulance services might not receive an initial payment or notice of denial of payment on the same date as the required disclosures.

The Departments stated in FAQs Part 55, Q20, that when a plan or issuer fails to comply with the disclosure requirements in 26 CFR 54.9816-6T(d)(1) or (2), 26 CFR 54.9816-6(d)(1), 29 CFR 2590.716-6(d)(1) or (2), and 45 CFR 149.140(d)(1) or (2), providers, facilities, or providers of air ambulance services retain the right to initiate the open negotiation period within 30 business days of receiving the initial payment or notice of denial of payment.(35) FAQs Part 55, Q20 further provides that in cases in which a plan or issuer fails to comply with the disclosure requirements; the provider, facility, or provider of air ambulance services did not have the information necessary to initiate the 30-business-day open negotiation period; and the provider, facility, or provider of air ambulance services subsequently missed the deadline to initiate the Federal IDR process, the provider, facility, or provider of air ambulance services may alternatively request an extension to initiate the Federal IDR process(36) by emailing a request for extension due to extenuating circumstances to FederalIDRQuestions@cms.hhs.gov.

Q4: By when must providers, facilities, and providers of air ambulance services initiate open negotiation if they receive the required disclosures in paper form on a later date than they receive the initial payment or notice of denial of payment sent electronically?

The Departments are aware of instances where, even when a plan or issuer timely provides the required disclosures, providers, facilities, and providers of air ambulance services receive them many days later than they receive the initial payment or notice of denial of payment. Because the 30-business-day period to initiate open negotiation begins on the date the provider, facility, or provider of air ambulance services receives an initial payment or notice of denial of payment, the provider, facility, or provider of air ambulance services might have only a short amount of time to review the information contained in the disclosures before having to decide whether to initiate open negotiation.

If a provider, facility, or provider of air ambulance services receives the required disclosures sent in paper form on a date that is later than the date it receives an initial payment or notice of denial of payment sent electronically, and the disclosures were sent by the plan or issuer in a timely manner,(37) the Departments will consider(38) the period to initiate open negotiation to end 30 business days after the provider, facility, or provider of air ambulance services has received both the initial payment or notice of denial of payment and the required disclosures that provide the information necessary to initiate the open negotiation period.(39) However, a provider, facility, or provider of air ambulance services may initiate open negotiation after receipt of an initial payment or notice of denial of payment but before receipt of the required disclosures (and prior to end of the applicable 30-business-day period described in this Q4), if the provider, facility, or provider of air ambulance services elects to do so.

If a provider, facility, or provider of air ambulance services receives an initial payment or notice of denial of payment but does not receive the required disclosures at all, or receives disclosures that were not sent within the required timeframe, the provider, facility, or provider of air ambulance services may initiate open negotiation or request an extension to initiate the Federal IDR process pursuant to the guidance in FAQs Part 55, Q20.(40)

Patient Cost Sharing Under the No Surprises Act

Under the No Surprises Act and the July 2021 interim final rules, cost-sharing requirements for out-of-network emergency services and applicable non-emergency items and services cannot be greater than the requirements that would apply if the services were provided by a participating provider or participating emergency facility and must be calculated based on the "recognized amount," which is:

1. an amount determined by an applicable All-Payer Model Agreement under section 1115A of the Social Security Act;
2. if there is no such applicable All-Payer Model Agreement, an amount determined by a specified State law; or
3. if there is no such applicable All-Payer Model Agreement or specified State law, the lesser of the billed charge or the QPA.

Cost-sharing requirements for out-of-network air ambulance services must be the same requirements that would apply if the services were provided by a participating provider of air ambulance services and must be calculated using the lesser of the billed charge or the QPA.

Q5: After a certified IDR entity has made a payment determination with respect to a qualified IDR item or service, may a plan or issuer recalculate a participant's, beneficiary's, or enrollee's cost-sharing amount for that item or service using the amount of the certified IDR entity's payment determination, if the recalculation results in a cost-sharing amount that exceeds the permitted cost-sharing amount calculated using the lesser of the billed charge or the QPA?

No. Under the No Surprises Act and the July 2021 interim final rules, cost-sharing requirements for out-of-network emergency services and applicable non-emergency items and services are calculated using the "recognized amount" (or with respect to out-of-network air ambulance services, the lesser of the billed charge or the QPA). The Departments have received reports of some plans and issuers generating new explanations of benefits (EOBs) after an IDR payment determination has been made that shows an increase in cost sharing that exceeds the maximum amount permitted under the No Surprises Act, based on the amount of the IDR payment determination. After a certified IDR entity has made a payment determination with respect to a qualified IDR item or service, a plan or issuer may not recalculate or increase a participant's, beneficiary's, or enrollee's cost sharing for that item or service based on the amount of the certified IDR entity's payment determination (or for any other reason), if such a recalculation or increase would result in a cost-sharing amount that exceeds the permitted cost-sharing amount calculated using the recognized amount (or with respect to out-of-network air ambulance services, the lesser of the billed charge or the QPA).

The Departments reiterate their explanation from the preamble to the July 2021 interim final rules: "By requiring plans and issuers to calculate the cost-sharing amount using the recognized amount, rather than the amount the plan or issuer ultimately pays the nonparticipating provider or nonparticipating emergency facility for the furnished items or services, the No Surprises Act and [the July 2021] interim final rules limit the effect of provider-payer disputes about payment amounts on participant, beneficiary, or enrollee cost sharing. Under the statute and [the July 2021] interim final rules, the provider or facility and plan or issuer separately determine the total payment amount for the furnished items or services, but that amount generally does not affect the cost-sharing amount the individual must pay."(41) Additionally, under the No Surprises Act, nonparticipating providers, facilities, and providers of air ambulance services are prohibited from billing or holding liable such individual for a payment amount that is more than the cost-sharing amount allowed to be charged under the No Surprises Act (calculated using the recognized amount, or in the case of air ambulance services, the lesser of the billed charge or the QPA).

The Departments also remind plans and issuers that any payment owed to a nonparticipating provider, facility, or provider of air ambulance services after a certified IDR entity makes a payment determination must be paid to the provider, facility, or provider of air ambulance services in full and must not include a reduction in payment based on any prohibited increase in cost sharing displayed on the EOB generated after an IDR payment determination.

For concerns about compliance with these requirements, contact the No Surprises Help Desk at 1-800-985-3059 or submit a complaint at https://www.cms.gov/nosurprises/policies-andresources/providers-submit-a-billing-complaint.

Gag Clause Prohibition and Attestation

Code section 9824, ERISA section 724, and PHS Act section 2799A-9, as added by section 201 of Title II of division BB of the CAA, prohibit group health plans and health insurance issuers offering group or individual health insurance coverage(42) from entering into an agreement with a health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers that would directly or indirectly restrict the plan or issuer from:

1. making provider-specific cost or quality of care information or data available to active or eligible participants, beneficiaries, and enrollees of the plan or coverage, plan sponsors, or referring providers;
2. electronically accessing de-identified claims and encounter information or data for each participant, beneficiary, or enrollee in the plan or coverage consistent with applicable privacy regulations, upon request;(43) or
3. sharing such information or data described in (1) and (2), or directing such data be shared, with a business associate,(44) consistent with applicable privacy regulations.(45)

These prohibitions, collectively referred to as the "Gag Clause Prohibition," became effective on December 27, 2020.(46)

Plans and issuers must annually submit an attestation of compliance with these requirements (a Gag Clause Prohibition compliance attestation (GCPCA)) to the Departments. On February 23, 2023, the Departments issued FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 57 (FAQs Part 57) providing guidance on the Gag Clause Prohibition and annual attestation requirements, including clarification on the meaning of a gag clause and attestations by TPAs or other service providers or issuers on behalf of a plan or issuer, as well as information about how to submit the GCPCA to satisfy the annual attestation requirement.(47) In addition to the FAQs, the Departments issued a webform, GCPCA instructions, a system user manual, and a Reporting Entity Excel Template.(48) Use of the GCPCA webform, at https://hios.cms.gov/HIOS-GCPCA-UI, will satisfy the requirement to submit an annual attestation of compliance.

The first GCPCA was due no later than December 31, 2023, covering the period beginning December 27, 2020, or the effective date of the applicable group health plan or health insurance coverage (if later), through the date of attestation. Subsequent attestations, covering the period since the preceding attestation through the date of the new attestation, are due by December 31 of each year.

Following the implementation of the GCPCA requirement, the Departments have continued to receive questions about the Gag Clause Prohibition and attestation requirements. Therefore, the Departments are issuing the following FAQs in response to such questions. The Departments will apply the clarifying guidance in Q6 through Q9 beginning on January 14, 2025.

Q6: A plan or issuer may contract with a TPA or other service provider that offers access to a network of providers. In turn, the TPA or other service provider may have separate agreements with entities other than the plan or issuer (downstream agreements) to provide or administer the plan's or issuer's network. If such a downstream agreement restricts the plan or issuer from providing, electronically accessing, or sharing the information or data specified in Code section 9824, ERISA section 724, and PHS Act section 2799A-9, is this restriction prohibited under the Gag Clause Prohibition?

Yes. Where a plan or issuer has entered into an agreement with a TPA or other service provider to provide network access, and the plan or issuer is restricted from providing, electronically accessing, or sharing the relevant information or data available to the TPA or service provider with participants, beneficiaries, and enrollees, plan sponsors, referring providers, or a business associate (as applicable) due to the TPA or service provider having entered into a downstream agreement that restricts the use of such relevant information or data, the plan's or issuer's agreement with the TPA or other service provider indirectly restricts the plan or issuer in a manner that violates the Gag Clause Prohibition. For example, terms of an agreement between a TPA and the owner of a network that restrict the TPA from sharing the relevant information with a plan, except under certain conditions, which have the effect of restricting a plan from providing cost information to a business associate would indirectly restrict the plan, even if the plan is not a party to the agreement with the owner of the network. As a result, the plan would be in violation of the Gag Clause Prohibition. To ensure compliance with the Gag Clause Prohibition, the Departments expect that, in their direct contracts with TPAs or other service providers, plans and issuers will include provisions that prohibit the TPA or other service provider from entering into a downstream agreement that restricts the plan or issuer from sharing information or data specified by statute. See Q9 regarding how plans and issuers that violate the Gag Clause Prohibition should complete their attestation. Plans and issuers are encouraged to work with their TPAs and service providers to provide, electronically access, or share the relevant information or data, as appropriate.

Q7: Does the Gag Clause Prohibition prohibit a plan or issuer from entering into an agreement with a health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers that restricts the plan or issuer from providing de-identified claims data(49) to a business associate, except at the discretion of the health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers?

Yes. To the extent the terms of an agreement between a plan or issuer and a health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers prevent or limit a plan or issuer from sharing, or directing such information be shared, with a business associate, consistent with applicable privacy regulations, the agreement would violate the Gag Clause Prohibition. For example, if an agreement permits the plan or issuer to share de-identified claims data with a business associate only at the discretion of a health care provider, network or association of providers, TPA, or other service provider offering access to a network, the agreement contains an impermissible gag clause. The Gag Clause Prohibition prohibits a plan or issuer from entering into such agreement because the agreement could have the effect of restricting the plan or issuer from providing de-identified claims data to a business associate.

Q8: What is considered a restriction on access to de-identified claims and encounter information or data that is prohibited by the Gag Clause Prohibition?

A limitation on the scope, scale, or frequency of electronic access to de-identified claims and encounter information or data is considered to be a restriction on de-identified claims and encounter information or data that is prohibited by the Gag Clause Prohibition, to the extent the provision places unreasonable limits on the ability of plans and issuers to access such information or data "upon request" as required by the statute.

Unless the information or data specified by statute is otherwise electronically accessible to the plan or issuer, the following examples of restrictions on an audit or claims review would be considered impermissible gag clauses:

• Limiting access to a statistically significant or the "minimum necessary" number of de-identified claims;
• Limiting the scope of access to the data to specific, narrow purposes (such as limiting access to the context of an audit);
• Unreasonably limiting the frequency of claims reviews (e.g., no more than once per year);
• Limiting the number and types of de-identified claims that a plan or issuer may access;
• Restricting the data elements of a de-identified claim that a plan or issuer may access; and
• Providing access to de-identified claims data only on the TPA's or service provider's physical premises.

Note that this is not an exhaustive list of potentially prohibited gag clauses. The Departments will continue to engage with interested parties and may provide additional examples of prohibited gag clauses in further guidance.

Q9: Plans and issuers must annually submit an attestation of compliance with the requirements of Code section 9824(a), ERISA section 724(a), and PHS Act section 2799A-9(a) to the Departments through a GCPCA. Are plans and issuers required to complete and submit the required annual attestation even if they are aware that they have entered into an agreement that would violate the Gag Clause Prohibition?

Yes. To the extent plans and issuers have an agreement that violates the Gag Clause Prohibition (including because a TPA or service provider entered into a downstream agreement that restricts the use of such relevant information or data) and have been unable to remove the non-compliant provision from their agreement with a health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers (or from a downstream agreement), plans and issuers must identify the non-compliant provision as part of their attestation, and may use the GCPCA webform system in the text box labelled "Additional Information," on Step 3 for this purpose.(50) Such additional information should include, but is not limited to, any prohibited gag clauses that a service provider has refused to remove; the name of the TPA or service provider with which the plan or issuer has the agreement containing the prohibited gag clause; conduct by the service provider that shows the service provider interprets the agreement to contain a prohibited gag clause; information on the plan's or issuer's requests that the prohibited gag clause be removed from such agreement; and any other steps the plan or issuer has taken to come into compliance with the provision.(51) Plans and issuers that do not submit a GCPCA, including in circumstances described in this Q9, would be considered to be in violation of the attestation requirement of Code section 9824(a), ERISA section 724(a), and PHS Act section 2799A-9(a) and may be subject to enforcement action by the Departments.

With respect to plans and issuers that submit a GCPCA that includes such additional information as part of their attestation, the provision in question could still be considered a prohibited gag clause, in violation of Code section 9824(a), ERISA section 724(a), and PHS Act section 2799A-9(a), and may be subject to enforcement action by the Departments. However, a plan or issuer that submits an attestation of compliance that includes such additional information will be considered to satisfy the requirement to submit a GCPCA, and the Departments will take into account good-faith efforts to self-report a prohibited gag clause in any enforcement action brought by the Departments. The Departments may review the supporting information submitted and assess a plan's or issuer's compliance with the Gag Clause Prohibition based on the information provided in the submission. The Departments may also initiate an investigation based on complaints or any other information that may indicate potential noncompliance.

Footnotes

1. No Surprises Act section 102(d)(1) added 5 U.S.C. 8902(p) to require that Federal Employees Health Benefits Program (FEHB) carriers provide these protections to their enrollees. OPM regulations are set forth at 5 CFR 890.114. For purposes of this document, the term "plans and issuers" includes FEHB carriers to the extent consistent with 5 CFR 890.114.
2. 86 FR 36872 (Jul. 13, 2021).
3. 86 FR 55980 (Oct. 7, 2021).
4. 87 FR 52618 (Aug. 26, 2022).
5. See FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 55 (Aug. 19, 2022), available at https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/faqs/acapart-55.pdf and https://www.cms.gov/files/document/faqs-part-55.pdf.
6. See Tex. Med. Ass'n, et al. v. U.S. Dep't of Health & Human Servs., et al., No. 6:22-cv-450-JDK (E.D. Tex. Aug. 24, 2023), and Tex. Med. Ass'n, et al. v. U.S. Dep't of Health & Human Servs., et al., No. 23-40605.
7. The Department of Justice did not appeal the following vacaturs, which remain in place: portions of paragraphs (a)(8)(iv), (a)(15)(ii)(B), (b)(1), and (b)(2)(i) of 26 CFR 54.9816-6T, 29 CFR 2590.716-6, and 45 CFR 149.140 and FAQs Part 55, Q15 (allowing plan sponsors of self-insured group health plans to determine the QPA using contracted rates recognized by all self-insured group health plans administered by their third party administrators (TPAs); portions of 26 CFR 54.9816-6T(a)(12), 29 CFR 2590.716-6(a)(12), and 45 CFR 149.140(a)(12) and FAQs Part 55, Q14 (defining "provider in the same or similar specialty" and clarifying when a median contracted rate must be calculated separately by provider specialty); CMS, "Technical Guidance for Certified IDR Entities," 2-3 (Aug. 18, 2022) (relating to IDR requirements for medical air transport); and 5 CFR 890.114(a), insofar as it requires compliance with the foregoing provisions.
8. See FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 62 (Oct. 6, 2023), available at https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-62 and https://www.cms.gov/files/document/faqs-part-62.pdf.
9. See FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 67 (May 1, 2024), available at https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-67 and https://www.cms.gov/files/document/faqs-part-67.pdf.
10. Tex. Med. Ass'n, et al. v. U.S. Dep't of Health & Human Servs., et al., Case No. 23-40605 (5th Cir. Oct. 30, 2024).
11. 86 FR 36872, 36889 (Jul. 13, 2021) (the phrase "regardless of the number of claims paid at that contracted rate"); 26 CFR 54.9816-6T(a)(1), 29 CFR 2590.716-6(a)(1), and 45 CFR 149.140(a)(1) (from "Solely for purposes of this definition a single case agreement" to "or enrollee in unique circumstances, does not constitute a contract"); and 26 CFR 54.9816-6T(b)(2)(iv), 29 CFR 2590.716-6(b)(2)(iv), and 45 CFR 149.140(b)(2)(iv); and 5 CFR 890.114(a), insofar as it requires compliance with the foregoing provisions.
12. 26 CFR 54.9817-1T(b)(4)(i), 29 CFR 2590.717-1(b)(4)(i), and 45 CFR 149.130(b)(4)(i) (from "For purposes of this paragraph (b)(4)(i), the 30-calendar-day period begins" to "decide a claim for payment for the services"). The Departments reiterate the guidance contained in FAQs Part 62, Q5, which states that the Departments and OPM expect plans and issuers to make reasonable efforts to determine coverage and provide initial payments or notices of denial of payment where applicable under the plan or coverage within the 30-calendar-day timeframe, and also reiterates existing requirements under the ERISA claims procedure regulation and the Affordable Care Act internal claims and appeals regulation.
13. 26 CFR 54.9816-6T(d), 29 CFR 2590.716-6(d), and 45 CFR 149.140(d).
14. On December 16, 2024, the plaintiffs in TMA III filed a petition for rehearing en banc.
15. See FN 10.
16. Under Rule 41 of the Federal Rules of Appellate Procedure, the court of appeals' mandate will generally issue seven days after the time to file a petition for rehearing has expired, or seven days after entry of an order denying a timely petition for panel rehearing, petition for rehearing en banc, or motion for stay of mandate, whichever is later. Prior to that time, the district court's judgment continues to bind the Departments. Following the filing of a petition for rehearing en banc by the plaintiffs in TMA III, the court issued an order withholding issuance of the mandate. The issuance of the mandate will be reflected on the appellate docket in Texas Medical Ass'n, v. U.S. Department of Health & Human Services, No. 23-40605 (5th Cir.).
17. See FAQs Part 62, Q3.
18. 26 CFR 54.9816-6T(d), 26 CFR 54.9816-6(d), 29 CFR 2590.716-6(d), and 45 CFR 149.140(d).
19. Code sections 9816(a)(1)(C)(iv)(I) and 9817(a)(3)(A), ERISA sections 716(a)(1)(C)(iv)(I) and 717(a)(3)(A), and PHS Act sections 2799A-1(a)(1)(C)(iv)(I) and 2799A-2(a)(3)(A); 26 CFR 54.9816-4T(b)(3)(iv)(A), 54.9816-5T(c)(3), and 54.9817-1T(b)(4)(i), 29 CFR 2590.716-4(b)(3)(iv)(A), 2590.716-5(c)(3), and 2590.717-1(b)(4)(i), and 45 CFR 149.110(b)(3)(iv)(A), 149.120(c)(3), and 149.130(b)(4)(i).
20. For additional guidance on this 30-calendar-day period, see FAQs Part 62, Q5.
21. The term "downcode" means the alteration by a plan or issuer of a service code to another service code, or the alteration, addition, or removal by a plan or issuer of a modifier, if the changed code or modifier is associated with a lower QPA than the service code or modifier billed by the provider, facility, or provider of air ambulance services. 87 FR 52618, 52622 (Aug. 26, 2022).
22. 26 CFR 54.9816-6T(d), 29 CFR 2590.716-6(d), and 45 CFR 149.140(d).
23. The 30-business-day period to initiate open negotiation begins on the date the provider, facility, or provider of air ambulance services receives an initial payment or notice of denial of payment, which may differ from the date listed on a remittance advice or on the required disclosures.
24. Code section 9817(b)(6), ERISA section 717(b)(6), and PHS Act section 2799A-2(b)(6) include parallel provisions with respect to timing of payment for air ambulance services for which a payment amount is determined under open negotiation or through the Federal IDR process.
25. Code sections 9816(c)(1)(A) and 9817(b)(1)(A), ERISA sections 716(c)(1)(A) and 717(b)(1)(A), and PHS Act sections 2799A-1(c)(1)(A) and 2799A-2(b)(1)(A); 86 FR 55984 (Oct. 7, 2021).
26. This 4-business-day period applies unless the item or service is subject to the 90-day "cooling off" period under Code section 9816(c)(5)(E)(ii), ERISA section 716(c)(5)(E)(ii), or PHS Act section 2799A-1(c)(5)(E)(ii). In cases where the item or service is subject to such a cooling off period, either party may initiate the Federal IDR process within 30 business days of the end of the cooling off period.
27. Code sections 9816(c)(1)(B) and 9817(b)(1)(A), ERISA sections 716(c)(1)(B) and 717(b)(1)(A), and PHS Act sections 2799A-1(c)(1)(A) and 2799A-2(b)(1)(B); 86 FR 55984 (Oct. 7, 2021).
28. Code section 9816(c)(5)(A), ERISA section 716(c)(5)(A), and PHS Act section 2799A-(1)(c)(5)(A), "Qualified IDR item or service" is defined at 26 CFR 54.9816-8T(a)(2)(xi), 29 CFR 2590.716-8(a)(2)(xi), and 45 CFR 149.510(a)(2)(xi).
29. Code section 9816(c)(6), ERISA section 716(c)(6), and PHS Act section 2799A-1(c)(6); 86 FR 56000 (Oct. 7, 2021); 26 CFR 54.9816-8T(c)(4)(ix), 29 CFR 2590.716-8(c)(4)(ix), and 45 CFR 149.510(c)(4)(ix).
30. For example, the ASC X12N 835 Version 5010 (835 transaction) is the current HIPAA standard that plans and issuers must use to electronically transmit explanation of benefits or remittance advice information to providers and facilities. The current ASC X12 835 standards predate, and therefore do not address, No Surprises Act requirements. As a result, plans and issuers that use the 835 Electronic Remittance Advice transaction will generally need to provide the required disclosures using an alternate mechanism, such as using email or sending in paper form. See https://www.cms.gov/about-cms/what-we-do/administrative-simplification/hipaa/adopted-standards-operating-rules#:~:text=HIPAA%20required%20HHS%20to%20establish,Health%20care%20clearinghouses.
31. 26 CFR 54.9816-6T(d)(1), 26 CFR 54.9816-6(d)(1), 29 CFR 2590.716-6(d)(1), and 45 CFR 149.140(d)(1). See also 88 FR 75744 (Nov. 3, 2023) (proposing technical and conforming amendments to the disclosure requirements).
32. Id.
33. See Tex. Med. Ass'n, et al. v. U.S. Dep't of Health & Human Servs., et al., No. 6:22-cv-450-JDK, at *28-30 (E.D. Tex. Aug. 24, 2023) and FAQs Part 62, Q5.
34. Specifically, the information required under 26 CFR 54.9816-6T(d)(1), 26 CFR 54.9816-6(d)(1), 29 CFR 2590.716-6(d)(1), and 45 CFR 149.140(d)(1).
35. https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/faqs/aca-part-55.pdf and https://www.cms.gov/files/document/faqs-part-55.pdf.
36. 26 CFR 54.9816-8T(g); 29 CFR 2590.716-8(g); 45 CFR 149.510(g).
37. See Q3, above.
38. See Code sections 9816(c)(9) and 9817(b)(9), ERISA sections 716(c)(9) and 717(b)(9), and PHS Act sections 2799A-1(c)(9) and 2799A-2(b)(9) (authorizing the Departments to modify certain IDR-related deadlines and timing requirements in extenuating circumstances). The Departments are exercising their extension authority only for the specific extenuating circumstances addressed in this FAQ.
39. Specifically, the information required under 26 CFR 54.9816-6T(d)(1), 26 CFR 54.9816-6(d)(1), 29 CFR 2590.716-6(d)(1), and 45 CFR 149.140(d)(1).
40. https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/faqs/aca-part-55.pdf and https://www.cms.gov/files/document/faqs-part-55.pdf.
41. See 86 FR 36872, 36883-36884 (Jul. 13, 2021). See also 86 FR 55980, 56000 (Oct. 7, 2021) ("The Departments note that [an IDR payment] determination of the out-of-network rate does not change the participant's, beneficiary's, or enrollee's cost sharing, which is based on the recognized amount. The cost-sharing amount remains the same as originally calculated in accordance with 26 CFR 54.9816-4T(b)(3)(ii) and (iii), 29 CFR 2590.716-4(b)(3)(ii) and (iii), and 45 CFR 149.110(b)(3)(ii) and (iii); 26 CFR 54.9816-5T(c)(1) and (2), 29 CFR 2590.716-5(c)(1) and (2), and 45 CFR 149.120(c)(1) and (2); or 26 CFR 54.9817-1T(b)(1) and (2), 29 CFR 2590.717-1(b)(1) and (2), and 45 CFR 149.130(b)(1) and (2).").
42. The prohibition on restricting plans and issuers from electronically accessing de-identified claims and encounter information or data does not apply to issuers offering individual health insurance coverage. See PHS Act section 2799A-9(a)(2). In these FAQs, any discussion of restrictions on a plan or issuer from electronically accessing de-identified claims and encounter information or data applies only to group health plans and health insurance issuers offering group health insurance coverage.
43. Id.
44. Business associate as defined in 45 CFR 160.103.
45. Information shared must be consistent with the privacy regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Genetic Information Nondiscrimination Act of 2008 (GINA), and the Americans with Disabilities Act of 1990 (ADA).
46. On August 20, 2021, the Departments issued an FAQ stating that the statutory language of section 201 of Title II of division BB of the CAA is self-implementing and that, until any further guidance is issued, plans and issuers are expected to implement the requirements prohibiting gag clauses using a good faith, reasonable interpretation of the statute. See FAQs about Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 49 (Aug. 20, 2021), Q7, available at https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/faqs/aca-part-49.pdf and https://www.cms.gov/CCIIO/Resources/Fact-Sheets-and-FAQs/Downloads/FAQs-Part-49.pdf.
47. See FAQs About Affordable Care Act and Consolidated Appropriations Act, 2021 Implementation Part 57 (Feb. 23, 2023), available at https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/faqs/aca-part-57 and https://www.cms.gov/files/document/aca-part-57.pdf.
48. See Gag Clause Prohibition Compliance Attestation, available at https://www.cms.gov/marketplace/about/oversight/other-insurance-protections/gag-clause-prohibition-compliance-attestation.
49. The term "de-identified claims data" refers to claims data that are de-identified in accordance with 45 CFR 164.514. Once individually identifiable information is de-identified, it is no longer protected health information under the HIPAA Privacy Rule, and HIPAA covered entities may use and disclose the de-identified data so long as the de-identified data cannot be re-identified. See 45 CFR 164.502(d)(2).
50. See Gag Clause Prohibition Compliance Attestation: Annual Submission Instructions, August 2024, available at https://regtap.cms.gov/reg_librarye.php?i=5481.
51. To the extent ERISA plans or issuers providing coverage in connection with such plans are prevented from obtaining de-identified claims and encounter information or data due to an impermissible gag clause, or the TPA's or other service provider's attestation on behalf of the plan or issuer is not accurate due to the existence of an impermissible gag clause, the Department of Labor may investigate the TPA or other service provider for possible violations of ERISA, including ERISA's co-fiduciary and knowing participation requirements, where a group health plan encounters an impermissible gag clause.