What the CAA requires of self-funded employers — in plain terms

If your company self-funds its health plan, federal law now requires two recurring things and implies a third. You must attest every December 31 that your plan's contracts don't block access to cost and quality data. Your broker or consultant must disclose their compensation in writing before you sign. And behind both sits the older, larger obligation: when you administer the plan, ERISA holds you to fiduciary duties over its money.

The short version: attest every year, get your broker's compensation in writing, and remember the plan's money is spent under your fiduciary duty — employee-side firms have begun testing that duty in court.

What is the gag-clause attestation, and when is it due?

The Consolidated Appropriations Act of 2021 prohibits health plans from signing provider or network agreements that restrict access to price and quality information. Every group health plan — self-funded included — must submit a Gag Clause Prohibition Compliance Attestation, first due December 31, 2023 and every December 31 after. If a vendor files it for you, the responsibility is still the plan's.

What does my broker have to disclose?

Since December 27, 2021, anyone providing brokerage or consulting services to an ERISA group health plan who expects $1,000 or more in direct or indirect compensation must disclose that compensation in writing, in advance. The stated purpose is to let you — the responsible plan fiduciary — judge whether the fee is reasonable and see the conflicts. If you have never received that document, that is itself the finding.

Are we really "fiduciaries" of the health plan?

Yes — that is ERISA, not new law. What is new is enforcement attention. In Lewandowski v. Johnson & Johnson, employees sued their own employer for overpaying for prescription drugs through the plan. The case has so far been dismissed for lack of standing — not because the duty doesn't exist — and is on appeal at the Third Circuit as of January 2026. The practical reading: the duty is live, employee-side firms keep filing new versions of the claim, and about two-thirds of covered workers are in self-funded plans where the duty sits with the employer.

What data can we actually check our plan against?

The same federal transparency rules that created your obligations also created the evidence. Every hospital must publish its negotiated rates and cash prices in machine-readable files. On the record we maintain for Virginia and North Carolina, 59.7% of 68,955 comparable commercial-plan negotiated rates at 76 hospitals are higher than the hospital's own posted cash price. (Employer and individual plans only; Medicare Advantage and Medicaid plan rates are excluded.) A fiduciary does not need a consultant's black box to ask the first question — the hospital's own filings answer it. See the full breakdown.

What should a self-funded employer do this quarter?

File the attestation on time; put your broker's disclosure letter in the plan file; benchmark what your plan pays at the hospitals your employees actually use against those hospitals' own published prices. That last step is the one we do — see the Fiduciary Benchmark Brief.

Common questions

Does the attestation apply to level-funded plans? Group health plans generally, including self-funded; excepted benefits (stand-alone dental, vision, FSAs) are out of scope.

What happened in the J&J case? Dismissed on standing in November 2025; appeal filed January 2026. The fiduciary theory itself has not been rejected on the merits.

Is this legal advice? No. We publish the record and build benchmarks from it; compliance decisions belong with your counsel.

Sources: U.S. Department of Labor and CMS Gag Clause Prohibition Compliance Attestation instructions; DOL Field Assistance Bulletin 2021-03; Georgetown Health Care Litigation Tracker; KFF 2025 Employer Health Benefits Survey. Price figures derive from hospital machine-readable files (45 CFR Part 180) — methodology. Last updated 2026-09-06.