Among other things, the Consolidated Appropriations Act (CAA) requires group health plans to attest that they are in compliance with the CAA’s gag clause prohibition. TPAs and PBMs seem ready to attest (or sub-attest).

But what’s an employer to do if its plan is not in compliance? And what if the TPA or PBM doesn’t contractually restrict the data, but in practice restricts the data? Is it okay for a TPA or PBM to restrict information as long as they don’t contractually do so? This sure seems contrary to the intent of the law!

So, can a plan sponsor in good faith continue with a TPA or PBM arrangement that is non-compliant with the CAA’s prohibition? For example, most PBM arrangements do not provide plan sponsors with claim-specific rebate information. Is that legal under the CAA? Can a plan sponsor attest that it is compliant with the prohibition if its PBM won’t provide this information?

We also just reviewed an NDA from one of the national TPAs/networks. It only has 12 gag clauses in it. This same TPA also withholds data that it is required to release under the CAA prohibition. Yet, it will “provide a confirmation of compliance to support the customer’s responsibility to complete their own attestation.” And we have already seen one of the PBMs that withholds this information sub-attest that it’s compliant.

Of course, a plan sponsor must first ask for the detailed cost and price information. Those I have spoken to about this topic have not asked for the data. We have asked and are still awaiting answers.

So, what are an employer’s options? Is a plan sponsor supposed to still attest (wink-wink)? Is it better to not ask and to attest “to the best of my knowledge…” or “as far as I know…” Or does an employer in this situation need to file a complaint with CMS if it doesn’t get the data needed for it to be able to attest in good faith?

Just asking for a friend.