Who files an Iowa school district's gag-clause attestation by Dec. 31, and who answers for it

In February 2023, the U.S. departments of Labor, Health and Human Services and the Treasury published an example of a contract term that federal law forbids in an employer health plan. It was one line in an agreement with a third-party administrator: if the plan sponsor's access to cost and quality information about providers "is only at the discretion of the TPA, that contractual provision would be considered a prohibited gag clause."¹

In January 2025, the departments said what a plan should do when it finds a term like that and the vendor won't take it out. The plan still files, and it has to name the clause: plans "must identify the non-compliant provision as part of their attestation" when they file.²

The next attestation is due Dec. 31, 2026.³ It reaches Iowa school district medical plans, insured or self-funded: the federal filing instructions cover "non-Federal governmental plans, such as those sponsored by states, counties, school districts, and municipalities."⁴ What a district has to do between now and then depends on how its plan is funded. An insurer's filing can cover a fully insured plan. A self-funded district can have its claims administrator file under a written agreement, but the legal duty stays with the plan, and if the district sponsors the plan alone, any federal penalty falls on the district.⁵

What a gag clause is, and what a district attests to

The attestation says the plan complies with the federal ban on gag clauses. Under that ban, a group health plan may not enter an agreement with a provider or network, or with a third-party administrator or other service provider offering access to a network of providers, if the agreement would directly or indirectly keep it from doing three things: giving "provider-specific cost or quality of care information or data" to the plan sponsor, enrollees and referring providers; getting "de-identified claims and encounter information or data" electronically when it asks; and sharing either with a business associate. The same section requires each plan to attest every year that it complies.⁶

The January 2025 guidance described terms that fail. If a TPA signs its own agreement with a network that restricts the plan's data, the plan is in violation, because its contract with the TPA now restricts it indirectly. The departments expect plan contracts to bar TPAs from making those downstream deals. A term that lets the plan share de-identified claims data with a business associate only at a vendor's discretion is prohibited. So are unreasonable limits on access to claims data, such as rationing how often the plan can review claims or offering the data "only on the TPA's or service provider's physical premises" unless the data is otherwise available to the plan electronically.²

Who files: the carrier, the TPA or the district?

For a fully insured plan, the plan and the insurer each owe an attestation. But "when the issuer of a fully-insured group health plan submits" one on the plan's behalf, the departments treat both as having filed.¹

Self-insured and partially self-insured plans can hand the job to a vendor, but only through a written agreement under which a service provider, such as a TPA, attests for them. If they do, "the legal requirement to provide a timely attestation remains with the plan."¹ If the TPA doesn't file, "the plan violates the requirement to provide an attestation of compliance." A plan with more than one TPA can have each attest for the benefits it administers, so one vendor's filing may not cover the whole plan.⁴

A district's audit won't settle any of this. In audits for the year ended June 30, 2025, Marshalltown describes a "partially self-funded health and dental insurance plan" with stop-loss coverage for claims above $75,000 per person.⁷ Ankeny uses its fund "for the purposes of providing self-insurance for dental claims."⁸ Clarke's "is used to account for health insurance."⁹ None of the three names a TPA or says whether the district has attested. Where a fund covers dental only, or an audit doesn't say what it pays for, ask what kind of coverage it is: a plan offering only excepted benefits doesn't attest, whatever its size.¹

Plans that "consist solely of health reimbursement arrangements (HRAs)" won't face enforcement of the requirement, the departments have said.¹

If nobody files, who pays a federal penalty depends on how many employers sponsor the plan. HHS enforces these requirements for "group health plans that are non-Federal governmental plans" and the statute's penalty is up to "$100 for each day for each individual" affected, which an HHS inflation-adjusted table lists at $188.¹⁰ For a plan with a single sponsor, "the employer is liable for such penalty." A plan "sponsored by 2 or more employers" is liable itself. An insurer answers for its own failure to file.⁵

Districts in a risk pool need to know which side of that line they are on. Under Iowa's insurance rules, public entities that "pool risk through a joint exercise of power under Iowa Code chapter 28E" must register with the insurance commissioner, and the application includes copies of the pool's contracts with third-party administrators.¹¹ Whether a pool is one plan with many sponsors, or each member district keeps its own plan, depends on the pool's documents. A member district should ask the pool which it is, and who is attesting.

Iowa's September filing is a different one

Iowa already asks most self-funded districts about their administrator. Within 90 days after the fiscal year ends, the governing body of a self-insurance plan files a certificate with the state insurance commissioner stating "That the governing body has contracted or otherwise arranged with a third-party administrator" who holds a current state registration. Filing late costs $15 a day. Plans limited to deductibles, coinsurance, drug costs, short-term disability, vision or dental benefits, with claims at or under 2% of the general fund budget, are exempt.¹² For the fiscal year that ended June 30, 2026, that window closed Sept. 28. Chapter 509A is the same chapter that lets school retirees stay on the district plan until 65.

That certificate goes to the state. The federal attestation goes to CMS.³ Neither the Iowa Code nor the federal guidance treats one filing as a substitute for the other.

Before Dec. 31, and at the July renewal

A fully insured district has one question for its carrier: is it filing the 2026 attestation on behalf of the district's plan? The departments' relief applies when the issuer actually files for the plan, so get the answer in writing.¹

A self-funded district should find the written term in which its TPA agrees to attest for the plan. If there isn't one, the district can add it by amendment or file through the CMS webform itself.^1,3 Ask the TPA, too, whether any of its own network agreements limit the plan's data; a restriction there counts against the district's plan.²

If a vendor won't remove a clause, the district still attests. It can use the webform's "Additional Information" box to name the clause, the vendor and what the district did to get it removed. That satisfies the filing requirement, but the clause can still be treated as a violation; the departments say they "will take into account good-faith efforts to self-report a prohibited gag clause" in any enforcement action.²

The attestation covers the period since the last one.¹ The next contract decides what next year's can say. For a district that renews on July 1, the 2027-28 administrative services agreement is where the board can strike language that leaves the district's access to its own claims data to the TPA's discretion, bar restrictive downstream agreements, and put in writing who attests each December. A clause kept out of the agreement, and out of the TPA's own network deals, is one the district never has to disclose.