Category: Legal Alerts

On March 30, 2023, the United States District Court for the Northern District of Texas issued an order in Braidwood Management  Inc. v. Becerra (“Braidwood”), vacating any and all actions taken by the DOL and other federal agencies (in the past and in the future) to implement or enforce provisions of the ACA that require group health plans and health insurance issuers (“plans and issuers”)  to cover certain preventive care services with a rating of “A” or “B” by the United States Preventive Services Task Force (“USPSTF”) without cost sharing.  The court found that Congress’ delegation of authority to the USPSTF under the ACA violates the Appointments Clause of Article II of the U.S. Constitution.  The Braidwood decision does not impact coverage of preventive care services recommended by the Health Resources and Services Administration (“HRSA”) for infants, children, adolescents, or women, or immunizations for routine use in adults, adolescents, or children recommended by the Advisory Committee on Immunization Practices (“ACIP”), which are also required to be covered without cost sharing.

In response, on April 13, 2023, the DOL and other federal agencies released FAQs that provide guidance regarding how the agencies are interpreting the decision.  The FAQs strongly encourage plans and issuers to continue covering preventive services with an “A” or “B” rating by the USPSTF despite the Braidwood decision.  The guidance is summarized below.

Background

The Affordable Care Act (“ACA”) requires non-grandfathered plans and issuers to cover, without cost sharing, certain preventive care services.  The ACA specifies the categories and agencies who are responsible for determining the preventive care services that must be covered including the frequency, method, treatment, or setting for the recommended service.  Three entities were tasked with identifying and recommending preventive care services in four different categories:

Some preventive care items and services cross between the categories listed above and may be recommended by two different agencies.

Members of ACIP and HRSA fall within the purview of HHS such that HHS is responsible for creating and overseeing the members.  On the other hand, the USPSTF’s membership is comprised of volunteers who are not affiliated with a federal agency and, unlike ACIP and HRSA, USPSTF is not part of HHS or any other federal agency.

Braidwood Case

The Braidwood case centers on 2011 HRSA guidance that mandates coverage of all FDA-approved contraceptive methods (including certain birth control methods that have abortifacient properties) and the USPTFs 2019 “A” rating issued for PrEP drugs, which are drugs that prevent the spread of the HIV virus.  The plaintiffs alleged that forcing them to pay for insurance coverage for items or services they will either (a) not use due to their religious beliefs, or (b) object to on religious grounds, violates the Religious Freedom Restoration Act, Article II’s Appointments Clause, the nondelegation doctrine, and Article II’s Vesting Clause.

The court dismissed the claims related to the 2011 HRSA guidance recommending coverage of all FDA-approved contraceptives; however, the court determined, among other things, that the ACAs delegation of authority to the USPTF to make recommendations binding on health plans, issuers, and, in turn, participants, violates Article II’s Appointments Clause.  The court vacated any prior actions by the federal agencies (since 2010) to implement or enforce the provisions of the ACA requiring plans to cover preventive services with a “A” or “B” rating by the USPSTF without cost sharing and enjoin them from further implementing or enforcing this requirement on plans or issuers in the future.

The Department of Justice, on behalf of the DOL and other federal agencies, appealed the decision on March 31, 2023, and on April 12, 2023, requested that the appellate court issue a stay of the decision while the appeal is pending.

DOL FAQs/Guidance

The DOL and other agencies’ guidance provides the following:

• that have received an “A” or “B” recommendation/rating by the USPSTF on or after March 23, 2010 are impacted by the Braidwood decision.  Thus, this does not impact the requirement for plans and issuers to cover vaccination recommendations made by ACIP (including the COVID-19 vaccine even though it is also recommended by USPSTF) without cost sharing, HRSA recommended preventive care items or services for children, adolescents, or women (including FDA-approved contraceptive methods) without cost sharing, or methods recommended by the USPSTF prior to March 23, 2010.  The agencies will release guidance on how to address recommendations made by the USPSTF prior to March 23, 2010.
• Although the agencies are prohibited from enforcing or implementing coverage requirements for items and services recommended by USPTSF with an “A” or “B” rating, they strongly encourage plans and issuers to continue to cover these items or services without cost sharing.
• States are not bound by the Braidwood decision, so states may implement mandates to cover all items or services with an “A” or “B” rating by the USPSTF.  Further, contractual arrangements may bind fully insured and self-funded plans to cover these items or services for the remainder of their plan year even though the agencies cannot enforce the coverage requirements.
• To the extent a plan or issuer decides to change coverage under their plan as a result of the Braidwood decision, such changes would likely impact information that is included in the summary of Benefits and Coverage (“SBC”), which requires 60 days advance notice of the change by the plan or issuer.  If information included in the SBC is not impacted, then due to the material reduction in benefits that would result from such a change in covered items or services, a plan or issuer would still have to provide notice to participants within 60 days after adopting the changes.
• Unless further guidance is issued providing otherwise, the Braidwood decision does not impact the ability of a HDHP to cover items or services with an “A” or “B” rating by the USPSTF prior to a participant meeting the applicable deductible under the plan.

Conclusion

It is likely that the District Court’s decision in Braidwood will be stayed pending appeal.  In that case, none of the above guidance will be required as the DOL and other agencies can continue with business as usual, consistent with the provisions of the ACA, unless or until a Federal Court of Appeals or the United States Supreme Court determines that this particular provision of the ACA is unconstitutional and unenforceable.  Accordingly, employers should consult directly with counsel before making any plan design changes in reliance on the Braidwood decision.

On April 10, 2023, the President signed H.J.Res. 7, which ended the COVID-19 national emergency on April 10, 2023, approximately one month earlier than anticipated.  However, prior to the passage of H.J. Res. 7, the DOL and other federal agencies issued guidance in the form of FAQs that indicate an end date of May 11, 2023 for the national emergency and public health emergency.  Based on informal statements by officials at the DOL and other agencies, the agencies intend to stand by the May 11 end date for the national emergency and the corresponding July 10, 2023 end date for the outbreak period.  It is not clear whether the agencies will issue any additional formal written guidance.  This means that despite the President ending the national emergency on April 10, the DOL and other agencies will rely on the previously communicated May 11 end date as described in their FAQs to determine the end of the national emergency and public health emergency.

As a reminder, the national emergency relief disregards the following deadlines until the earlier of one year from the date the individual was first eligible for the relief, or until 60 days after the end of the national emergency:

• The 30-day period (or 60-day period, if applicable) to request a special enrollment;
• The 60-day election period for COBRA continuation coverage;
• The deadline for making COBRA premium payments;
• The deadline for individuals to notify the plan of a qualifying event or determination of disability;
• The deadline within which employees can file a benefit claim, or a claimant can appeal an adverse benefit determination, under a group health plan’s or disability plan’s claims procedures;
• The deadline for claimants to file a request for an external review after receipt of an adverse benefit determination or final internal adverse benefit determination; and
• The deadline for a claimant to file information to perfect a request for external review upon finding that the request was not complete.

Conclusion

Plans sponsors taking a cautious approach will administer their plans in accordance with the May 11 end date specified in the FAQs and continue to disregard the normal deadlines until after July 10, 2023.  Participant communications should be reviewed to ensure that the correct deadlines are communicated.

On January 30, 2023, President Biden issued a Statement of Administration Policy announcing his intent to end the COVID-19 national and public health emergencies on May 11, 2023.  However, on April 10, 2023, the President signed H.J.Res. 7, which ends the COVID-19 national emergency approximately one month earlier than anticipated, on April 10, 2023. 

On March 23, 2023, before the President signed H.J.Res. 7, the DOL and other federal agencies issued guidance in the form of FAQs intended to assist group health plans and health insurance issuers as we transition from the state of a  public health and national emergency that has been ongoing for more than three years.  While these guidelines do not reflect that the national emergency ended a month earlier than expected, they are still instructive for how plans and health insurance issuers should handle the resumed deadlines after June 9, 2023, which is 60 days from the end of the COVID-19 emergency.  It is unclear whether the agencies will issue updated guidance due to the unanticipated earlier end date of the national emergency.  NOTE:  H.J.Res. 7 does not impact the end of the COVID-19 public health emergency, which is set to expire on May 11, 2023.

As a reminder, the national emergency relief disregards the following deadlines until the earlier of one year from the date the individual was first eligible for the relief, or until 60 days after the end of the national emergency:

• The 30-day period (or 60-day period, if applicable) to request a special enrollment;
• The 60-day election period for COBRA continuation coverage;
• The deadline for making COBRA premium payments;
• The deadline for individuals to notify the plan of a qualifying event or determination of disability;
• The deadline within which employees can file a benefit claim, or a claimant can appeal an adverse benefit determination, under a group health plan’s or disability plan’s claims procedures;
• The deadline for claimants to file a request for an external review after receipt of an adverse benefit determination or final internal adverse benefit determination; and
• The deadline for a claimant to file information to perfect a request for external review upon finding that the request was not complete.

The FAQs clarify that with regard to the end of the national emergency, the relief above expires at the end of the outbreak period (which is 60 days after the end of the national emergency). Due to H.J.Res. 7, 60 days after the end of the national emergency, or the expiration date for the outbreak period, is now June 9, 2023. Thus, all extensions that are still effective for any plans or participants (i.e., those that are still in the 1-year extension window) will expire and the applicable clock will begin ticking after June 9, 2023. 

The FAQs include examples to help plans and employers administer the disregarded periods:

• Example 1 (Electing COBRA)

• Example 2 (Electing COBRA)
  • Same facts as Example 1, except the qualifying event and loss of coverage occur on May 12, 2023, and the individual is provided a COBRA election notice on May 15, 2023.  The deadline to elect COBRA is 60 days after the end of the outbreak period (August 8, 2023) because the qualifying event occurred on May 12, 2023, after the end of the national emergency but during the outbreak period.
• Example 3 (Electing COBRA)
  • Same facts as Example 1, except the qualifying event and loss of coverage occur on June 12, 2023, and the individual is provided a COBRA election notice on June 15, 2023.  The deadline to elect COBRA is 60 days after June 15, 2023 (August 14, 2023) because the qualifying event occurred on June 12, 2023, after the end of the outbreak period.
• Example 4 (Paying for COBRA Premiums)
  • An individual experiences a qualifying event and receives a COBRA notice on October 1, 2022. The individual elects COBRA on October 15, 2022, retroactive to October 1, 2022.  The individual has until 45 days after June 9, 2023 (the end of the outbreak period), which is July 24, 2023, to make the initial COBRA premium payment. The initial COBRA premium payment would include the monthly premium payments for October 2022 through June 2023. The premium payment for July 2023 must be paid by July 31, 2023 (the last day of the 30-day grace period for the July 2023 premium payment). Subsequent monthly COBRA premium payments would be due the first of each month, subject to a 30-day grace period.
• Example 5 (Special Enrollment Period)
  • An employee who previously declined participation in their employer’s group health plan gave birth on April 1, 2023 and would like to enroll herself and the child; however, open enrollment does not begin until November 15, 2023.  The employee and her child qualify for special enrollment as early as the date of the child’s birth, April 1, 2023. The employee may exercise her special enrollment rights for herself and her child until 30 days after June 9, 2023 (the end of the outbreak period), which is July 9, 2023, as long as she pays the premiums for the period of coverage after the birth.
• Example 6 (Special Enrollment Period)
  • Same as Example 5, except that the employee gave birth on May 12, 2023.  The employee and her child qualify for special enrollment as of the date of the child’s birth, May 12, 2023. Because Individual C became eligible for special enrollment during the outbreak period, the extensions under the emergency relief notices still apply. The employee may exercise her special enrollment rights for herself and her child until 30 days after June 9, 2023 (the end of the outbreak period), which is July 9, 2023, as long as she pays the premiums for the period of coverage after the birth.
• Example 7 (Special Enrollment Period)
  • Same as Example 5, except that the employee gave birth on June 12, 2023.  The employee and her child qualify for special enrollment as of the date of the child’s birth, June 12, 2023. Because she became eligible for special enrollment on June 12, 2023, after the end of both the national emergency and the outbreak period, the extensions under the emergency relief notices do not apply. The employee may exercise her special enrollment rights for herself and her child until 30 days after June 12, 2023, which is July 12, 2023, as long as she pays the premiums for the period of coverage after the birth.

The FAQs also note that until further guidance is issued, individuals enrolled in HSA-qualified plans may still receive coverage for items and services related to COVID-19 treatment without first satisfying the applicable annual deductible.

The FAQs clarify the following with regard to the end of the public health emergency, which is not impacted by H.J.Res. 7 and expires on May 11, 2023:

• The provisions of the FFCRA and CARES Act which require COVID-19 diagnostic tests to be provided without cost sharing, prior authorization, or other medical management requirements are tied to the COVID-19 public health emergency and, therefore, will expire on May 11, 2023, when the public health emergency ends.
  • Accordingly, group health plans and insurers will no longer be required to cover COVID-19 at home or in person diagnostic tests without cost sharing.
  • The agencies encourage plans and insurers to continue providing this coverage without imposing cost sharing.
  • Plans and insurers must consider the date an item or service was rendered, not the date the claim was submitted, when determining whether the item or service was provided during the public health emergency.
• The agencies encourage plans and insurers to notify participants, beneficiaries, and enrollees regarding key information of coverage of COVID-19 related items and services (including testing for COVID-19), including the date the plan or insurer will stop providing coverage and/or begin imposing cost sharing requirements or other medical management requirements.
  • Generally, plans and insurers must provide 60-days prior notice of a change to benefits that impacts any information that would affect the content of the Summary of Benefits and Coverage (SBC); however, the agencies will consider the 60 days advance notice of any of the COVID-19-related treatment changes due to the end of the public health emergency as satisfied if:
    • The plan or insurer previously notified the participant, beneficiary, or enrollee of the general duration of the additional benefits coverage or reduced cost-sharing (such as, that the increased coverage applies only during the PHE), or
    • The plan or insurer notifies the participant, beneficiary, or enrollee of the general duration of the additional benefits coverage or reduced cost sharing within a reasonable timeframe in advance of the reversal of the changes.

Note:  It is not sufficient if the above notification was provided in a prior plan year.  The notification must have been provided during the current plan year based on the recent guidance.

• Provisions governing coverage of the COVID-19 vaccine are also tied to the COVID-19 public health emergency.
  • After May 11, 2023, administration of the COVID-19 vaccine will still be covered without cost (similar to other preventive care vaccines) by health plans and insurers; however, plans and insurers will not be required to cover vaccines administered by OON providers; however, if the plan or insurer does not have a provider in its network who can provide the vaccine, the plan or insurer must cover the vaccine when furnished by an out-of-network provider in the same manner as would apply to in-network providers and may not impose cost sharing.

Conclusion

Communication is key here.  Employers need to be diligent to ensure they understand the approach their carriers and/or TPAs will take to comply with this guidance, and are encouraged to work with their carriers, TPAs, COBRA administrators, and other vendors to develop strategies for ensuring proper communication of the end of the COVID-19 Emergencies and the impact on participants and their benefits, and identify SPDs and other plan materials that may need to be amended.

On March 3, 2023, federal agencies released revised Prescription Drug Data Collection (RxDC) Reporting Instructions applicable to the 2022 reference year.  RxDC reporting for the 2022 reference year is due on or before June 1, 2023.   

Background

The Consolidated Appropriations Act, 2021 (“CAA, 2021”) includes a provision that requires group health plans and health insurance issuers (collectively “plans and issuers”) to report certain specified data related to prescription drug and other health care spending, including, but not limited to: (1) general information regarding the plan or coverage; (2) the 50 most frequently dispensed brand prescription drugs; (3) the 50 most costly prescription drugs by total annual spending; (4) the 50 prescription drugs with the greatest increase in plan expenditures over the preceding plan year; (5) total spending by the plan or coverage broken down by the type of costs; (6) the average monthly premiums paid by participants, beneficiaries, and enrollees and paid by employers; and (7) the impact of premiums on rebates, fees, and other remuneration paid by drug manufacturers to the plan or coverage or its administrators or service providers, including the amount paid with respect to each therapeutic class of drugs and for each of the 25 drugs that yielded the highest amount of rebates and other remuneration under the plan or coverage from drug manufacturers during the plan year. 

While the deadline for reporting 2020 and 2021 reference years was extended to January 31, 2023, the deadline for reference year 2022 reporting is June 1, 2023.

2022 Reference Year Reporting Changes

In anticipation of the June 1, 2023 deadline for reference year 2022 reporting, the agencies took into consideration some of the complexities from the 2020-2021 reference year reporting and made some changes to the filing requirements.  These changes are summarized below:

• Multiple vendors may now submit the same data file on behalf of the same plan, issuer, or carrier.  For example, a plan’s medical benefit issuer could submit the same file as the plan’s behavioral health benefit issuer, though each entity would need indicate to which data the file relates (ex. medical or behavioral health benefits).
• While discouraged, reporting entities that must create multiple HIOS submissions in the same reference year will be able to do so if the content is mutually exclusive, meaning each plan in the plan lists and data files will only be included in one submission.  Multiple submissions with overlapping content are not permitted, and the reporting entity would be required to edit and delete the submissions.
• A new column has been added to the plan list P2 to collect information about, and briefly describe, benefit carve-outs (i.e., benefits administered, offered, or insured by an entity that is different than the entity that administers, offers, or insures the majority of the plan’s other benefits) when multiple reporting entities are reporting on information about the same plan (this column replaces the previous column for the Plan ID).  This column is optional for reference year 2022.
• Plan list instructions have been rearranged to separately address P1, P2, and P3.
• For clarity purposes only, certain columns are renamed, specifically:
  • Columns A and B in the data files (D1 – D8) are renamed from “Issuer or TPA Name” and “Issuer or TPA EIN” to “Company Name” and “Company EIN” so that it is clear that data at the plan sponsor, carrier, reporting entity, or other company level can be aggregated at this level, rather than only the issuer or TPA level.
  • Column C in the data files (D1 – D8) is renamed “Aggregation State” (rather than “State”) to more clearly differentiate from the column labeled “States in which the plan is offered” in plan lists P2 and P3.
  • Column J in D1 is renamed as “Admin Fees Paid” (rather than “ASO/TPA Fees Paid”) to reflect that self-funded plans pay administrative fees to other types of companies, such as PBMs.
• As with reporting for prior reference years, due to the difficulties of having multiple reporting entities for a plan in certain instances, reporting entities may aggregate, within a state and market segment, at a less granular level than the reporting entity that submitted D2. For example, within a state and market segment, a PBM submitting D3 – D8 may aggregate to the issuer or TPA level even if an entity submitting D2 aggregates at the plan sponsor level.
• For purposes of determining premium equivalents in D1, the instructions clarify the following, among others, should be subtracted from the premium equivalent:
  • Prescription drug rebates, regardless of whether the rebate received in the reference year is retrospective or prospective.
  • Stop-loss reimbursements (Note, however, that the stop loss premium paid by the plan to the stop loss carrier should be included).
• For purposes of determining and reporting total spending in D2, the instructions clarify that stop loss reimbursements, among others, should NOT be subtracted from total spending; however, prescription drug rebates expected but not yet received should be subtracted (for prescription drugs covered either under a medical or pharmacy benefit).

Additionally, the new guidance clarifies that RxDC reporting does not apply to retiree-only plans; however, it does apply for plans located in U.S. Territories (in addition to all 50 states and D.C.).  Note for self-funded plans: When calculating premium equivalents, a self-funded plan may use the same types of costs that are used to develop COBRA premiums; however, it should report the total dollar amount actually paid for the reference year, rather than the amounts used to set the COBRA rate.

Conclusion In our experience, carriers, TPAs, PBMs, and other vendors have varying requirements and expectations of what they need from plan sponsors to successfully complete the reporting, and some may even be delegating some of the reporting responsibility to the plan sponsor.  For example, if your insurance company, TPA, or PBM sent you a survey or questionnaire to collect information about plan numbers, premium, or funding types, it is likely that they are reporting the P2 and D1 files on your behalf.  Therefore, it is important to respond to any requests for information you may receive from the carrier, TPA, PBM, or other vendor and to coordinate with them to understand their expectations to ensure all reporting is completed in full on behalf of the plan.  If your vendor sent you a letter telling you to create a HIOS account or stating that they will not submit P2 and D1 on your behalf, that means you must submit P2 and D1 directly to CMS (or engage a third party to submit them for you).

When the Consolidated Appropriations Act, 2021 (the “CAA”) was enacted on December 27, 2020, it included a provision that prohibits group health plans and health insurance carriers from entering into certain agreements that, either directly or indirectly, restrict the release of certain information related to provider networks and de-identified encounter data, among other things. Such restrictions are commonly referred to as “gag clauses.”  The CAA also requires plans and carriers to attest annually that their agreements do not include such impermissible gag clauses.

On August 20, 2021, the DOL, IRS, and HHS (the “Agencies”) jointly released an FAQ which explained that the prohibition on gag clauses was self-implementing, meaning that regulations would not be released anytime soon and that plans and carriers should use a reasonable, good faith interpretation of the statute in the meantime.  The FAQ also stated that the attestation requirement would be delayed until further guidance was released.

In February 23, 2023, the Agencies released new FAQs, which provide information for completing and submitting the attestation, the first of which is due on December 31, 2023. 

The following provides general information about gag clauses and completing the Gag Clause Prohibition Compliance Attestation (GCPCA).

What is a Gag Clause?

Under the CAA, a gag clause is defined as:

1. restrictions on the disclosure of provider-specific cost or quality of care information or data to parties such as the plan sponsor, participants, beneficiaries, or referring providers;
2. restrictions on electronic access to de-identified claims and encounter information or data for each participant, beneficiary, or enrollee upon request and consistent with HIPAA, GINA and ADA privacy regulations, including, on a per claim basis—
   1. Financial information, such as the allowed amount, or any other claim-related financial obligations included in the provider contract;
   2. Provider information, including name and clinical designation;
   3. Service codes; or
   4. Any other data element included in claim or encounter transactions; or
3. restrictions on sharing information or data described in (1) and (2), or directing that such information or data be shared, with a business associate.

The gag clause provisions of the CAA (specifically Code section 9824, ERISA section 724, and PHSA §2799A-9(a)(1)), generally prohibit plans and carriers from entering into agreements with providers, TPAs, or other service providers that include such provisions.

Where would I Typically Find a Gag Clause?

Gag clauses in this context might be found in agreements between a plan or carrier and any of the following parties:

• a health care provider;
• a network or association of providers;
• a third-party administration (“TPA”) or pharmacy benefits manager (“PBM”); or
• another service provider offering access to a network of providers.

Thus, a group health plan should confirm that its carrier, TPA and/or PBM agreements do not contain prohibited clauses. These clauses would typically be found in confidentiality or other privacy provisions of the agreements, though it is important for the agreements to be thoroughly reviewed.  We would suggest working with your counsel to review the agreement to determine whether it impermissibly restricts access to specific information that would be otherwise covered under the gag clause provisions, or whether there is language that only restricts access to such information in conformity with the gag clause requirements of the CAA or other applicable state or federal law.

To which plans do the gag clause restrictions apply? 

All group health plans (excluding FSAs, HRAs or other excepted benefits such as dental or vision) and insurance carriers are subject to these prohibitions.  This includes self-funded and fully insured plans and grandfathered plans, as well as non-ERISA plans sponsored by non-federal governmental employers (i.e., state and local governmental employers), and church plans subject to the Internal Revenue Code.

What is the attestation requirement?

The CAA required group health plans and health insurance carriers to attest annually to the government that they have no “gag clauses” in their contracts. Plans and carriers must complete the GCPCA form electronically using the form provided by the Agencies.

When is the attestation/GCPCA form due?

The first attestation is due no later than December 31, 2023, and covers the period beginning December 27, 2020, or the effective date of the applicable group health plan or health insurance coverage (if later), through the date of attestation. Subsequent attestations, covering the period since the last preceding attestation, are due by December 31 of each year thereafter.

Who is responsible for completing the attestation for our group health plan?

That depends on whether the plan is fully insured or self-funded and your contractual arrangement with the carrier or TPA. While both the carrier and group health plan are required to submit a GCPCA with respect to a fully insured plan, a carrier may submit a GCPCA with respect to a fully insured plan that will satisfy the plan’s obligation.  We expect that most carriers will agree to complete the attestation for their fully insured plans.  Self-funded plans can contract with their TPA and/or their PBM to complete the attestation on behalf of the plan; however, the plan is ultimately responsible for ensuring the attestation is timely completed.  It is important to communicate with your carrier or TPA before the December 31, 2023 deadline to determine who will be completing the attestation on behalf of the plan.  We recommend ensuring that responsibility for completing the GCPCA is assigned well before the December 31^st deadline so there are no surprises. The Agencies released an instruction manual for the webform to assist with completing the attestation, when ready for filing.

Are there penalties if our group health plan does not complete the attestation?

There are no specific penalties outlined in the CAA; however, in the FAQs, the Agencies indicate that failing to submit the attestation by the deadline may subject the plan or carrier to enforcement action.  In such cases, it’s possible for the Agencies to assess a penalty of up to $100 per day per affected individual.

Where can I find more information on gag clauses and completing the attestation? The FAQs are a good place to start, as well as the HIOS GCPCA User Manual, which explains how to use the GCPCA module within the Health Insurance Oversight System (“HIOS”).