Short answer: A self-funded or level-funded plan can have its TPA, PBM or other service provider attest for it under a written agreement, but the legal duty stays with the plan, so the employer should confirm in writing that each filing was made by December 31.
Every group health plan, including self-insured and partially self-insured plans, must submit an annual Gag Clause Prohibition Compliance Attestation through CMS. The first was due December 31, 2023, and each later one is due by December 31 and covers the period since the last attestation.
The Departments’ FAQs say a self-insured plan may satisfy the requirement through a written agreement for its service provider to attest on its behalf, but the legal requirement to attest on time remains with the plan. A fully insured plan is treated as covered when the insurer attests for it; that shortcut is not automatic for self-funded plans.
Practical steps: identify every vendor with provider or network agreements (medical TPA, PBM, behavioral health), get a written commitment from each to attest, and ask for the submission confirmation. Nothing is sent to employees.