Regulatory Focus™ > News Articles > Long-Awaited Sunshine Act Regulation Released

Long-Awaited Sunshine Act Regulation Released

Posted 04 February 2013 | By

The US Centers for Medicare and Medicaid Services (CMS) have released a long-awaited rule that would require all pharmaceutical, medical device and biopharmaceutical companies to report transfers of value to the US government in the hopes of increasing transparency.


The rules, the Physician Payment Sunshine Act-better known as the Sunshine Act-are a core part of the 2010 Patient Protection and Affordable Care Act. Championed by Sens. Charles Grassley (R-IA) and Herb Kohl (D-WI), the Sunshine Act is intended to save the government money by making relationships between companies and healthcare providers more transparent to the public.

The rules were supposed to be in place for implementation in 2011, but numerous-and unexplained-delays left the regulation languishing at CMS and the Office of Information and Regulatory Affairs (OIRA) despite numerous calls to expedite its passage.

According to the basic logic behind the act, doctors might be more loath to accept gifts from industry if transfers of value were known to the public, and therefore less likely to prescribe a costly branded drug over its cheaper and bioequivalent generic competitor.

Whether or not that logic holds up to real-world conditions is yet to be seen, but now industry is getting its final look at the regulation, which will by all accounts dramatically alter how it interacts with healthcare providers.

Who is Covered under the Regulations

Few industry-related entities will escape the reach of the Sunshine Act. Covered entities include group purchasing organizations (GPOs), drug manufacturers, drug compounders that sell outside their facility, device manufacturers and biologics manufacturers.

Companies for which products covered under the Sunshine Act only compose less than 10% of gross revenue will only be required to report payments made in relation to those specific drug products, and not all others from the company. The same requirements will apply to contract manufacturers, contract marketers or other contracted entities, all of which will only be required to disclose payments made that are related to a specific product.

Distributors, re-packagers, re-labelers, kit assemblers and wholesalers will not be covered by the regulation.

What needs to be Reported

The Sunshine Act regulations cover an expansive amount of potential interactions between industry and healthcare providers.

Any "payments or other transfers of value" given to a physician or an immediate family members-spouse, natural or adopted child/parent/sibling, in-laws, grandparents, grandchild, or step-family-of a physician will need to be reported.

Reports must be submitted to CMS by 31 March 2014 and by the 90th day of every year thereafter, and must contain:

  • the name of the covered recipient
  • the address of the covered recipient
  • identifiers for physician covered recipients (including their specialty, National provider Identifier, and state professional license numbers)
  • the amount of the transfer of value
  • the date (or dates) of the transfer of value
  • the form of the transfer of value
  • an explanation of the nature of the transfer of value
  • the product (including the branded name, generic name, national drug code number and therapeutic area) the transfer of value is related to (as many as five products)
  • whether the payment is eligible for delayed publication
  • any third-party payments made at the request of a covered recipient
  • any payments made in the form of investment interests
  • any other information the manufacturer wishes to disclose, including an explanation of the payment.

Companies will also need to provide an in-depth explanation of what the payment was for. CMS' regulation provides 16 categories of payment: consulting fee, compensation for services, honoraria, gift, entertainment, meals, travel and lodging, education, research, charitable contribution, royalty or license, current or prospective ownership or investment interest, faculty compensation for unaccredited and non-certified continuing medical education (CME), faculty compensation for accredited CME, grants and facility fees for teaching hospitals.

Food and beverage reporting is also a tricky case, CMS wrote. "When allocating the cost of food and beverage among covered recipients in a group setting where the cost of each individual recipient's meal is not separately identifiable, such as a platter provided to physicians in a group practice setting, applicable manufacturers must calculate the value per person," it said. This is done by taking the value of the meal and dividing it by the number of persons who participated in the meal.

Reports may be consolidated to include all payments and transfers, but this is not required. This can prove useful for any companies with a large number of subsidiaries held under common ownership, such as Johnson & Johnson. The reporting entity assumes liability for the accuracy of those payments, however.

Payments made in relation to a joint venture, such as a product co-marketed by two companies, should be included in the report of the company that actually made the payment, and only be made once.

Attestations, Review and Publication

Importantly, all reports must include an attestation by the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Compliance Officer (CCO) or "other officer of the applicable manufacturer or applicable group purchasing organization that the information reported is timely, accurate and complete to the best of his or her knowledge or belief."

These statements could be used as the basis for legal action under the Responsible Corporate Officer (RCO) doctrine, sometimes referred to as the Park Doctrine, which holds that illegal actions conducted under the watch of a corporate officer are technically the responsibility of that officer, even if they don't have personal knowledge of it. The RCO has been used to some extent by the US Department of Health and Human Services (DHHS) and the Department of Justice (DOJ) in recent years, though to inconsistent amounts of success.

After submission, the reports are made available to physicians for a 45-day review period during which they can challenge any information contained within it. This notification will be done using a listserve, and physicians will be able to log in to a "secure website" that will show only information pertinent to that specific physician. They may then electronically certify that the information is accurate or initiate a dispute to be resolved "between the parties." Challenged data may not be available until the next review cycle, CMS said, and may not be used to delay publication of the report. Payments may be published and marked as being "disputed" in the report.

Any information that a manufacturer comes across that is either incorrect or omitted must be submitted to CMS "immediately upon confirmation or the error or omission," CMS wrote.

Payments made in relation to research, including clinical research, must be reported, but are eligible for a publication delay of up to four years or the date of the investigational product's approval (whichever comes first). Manufacturers must continue to indicate in each report whether a product is eligible for delayed publication.

Failure to notify CMS about the approval of a product will open a product to "civil monetary penalties," potentially making it one of the first activities regulatory affairs professionals will need to do after a product's approval.

Reporting Exceptions

As comprehensive as the list is, there are a number of notable exemptions and caveats. Payments made for research, for example, must be reported, but under "special rules." The payments should be reported to CMS separately from other, more routine payments, and include information about the research, the product being investigated, and (if sponsors wish) the identifying number.

There is also an exemption for payment made to support CME as long as it meets a three-part test:

It is an event accredited by the Accreditation Council for Continuing Medical Education, the American Academy of Family Physicians, The American Dental Association, the American Medical Association, or the American Osteopathic Association.

  1. The manufacturer does not pay the recipient speaker directly.
  2. The manufacturer does not select the covered recipient speaker.
  3. Payments not meeting all three parts of the test will be required to report the CME.

Payments made that are less than $10 will be exempt from reporting requirements, though will be reportable if they exceed $100 in a single calendar year, CMS said. This value will be pegged to the consumer price index (CPI), and CMS will announce the new reporting numbers each year at least 90 days before the start of the reporting period.

If these payments are "provided at large-scale conferences and similar large-scale events," they do not need to be reported for purposes of the $100 aggregate threshold, "even if the aggregate total for a covered recipient exceeds the aggregate threshold for the calendar year," CMS wrote.

Manufacturers will also not need to report payments if they are unaware of the eventual covered recipient and remain unaware throughout the remainder of the calendar year.

Other exemptions include product samples and coupons intended solely for patient use, educational materials for patients, the loan of a medical device or investigational medical device (under 90 days) to allow the patient to try the device out, discounts or rebates, items donated for the provision of charity care, service provided under a contractual warranty, transfers given to a physician when they are themselves a patient (and not acting as a physician), a dividend from stock in the manufacturer, or payments made "solely in the context of a personal, non-business-related relationship."

Another notable exception is the exemption of any transfer of value if the payment is "for the services of the covered recipient with respect to an administrative proceeding, legal defense, prosecution or settlement or judgment of a civil or criminal action and arbitration." It remains unclear whether this applies only to active litigation or to prospective litigation as well.

Costs of Compliance

The Sunshine Act rule also establishes fines for those who fail to report or adequately report payments to physicians. Section 402.105 establishes that CMS or the Office of the Inspector General (OIG) may impose fines of up to $10,000 (but not less than $1,000) per failure to report, with those penalties not to exceed $150,000 per annual submission report.

Those fines can dramatically increase to $100,000 per failure (but not less than $10,000) if is a "knowing failure" to report. The total penalties are not to exceed $1 million per annual submission in such cases. CMS defines "knowing failure" as an entity with "actual knowledge of the information," one acting with "deliberate ignorance of the truth or falsity of the information," or acting in "reckless disregard of the truth or falsity of information." These will, notably, not require "proof of a specific intent to defraud," CMS wrote.

These penalties are aggregated separately, but cannot exceed $1.15 million per year.

Penalties will be based on a number of factors, including the length of time the violation occurred, the amount that the organization failed the report, the level of culpability, the nature of the information, and how the error was discovered (and by whom).

All records should be kept for at least five years to facilitate audits by DHHS, OIG, CMS, or other designees.

Companies will be given notice, an opportunity for a hearing, and the ability to appeal any decision, CMS said.

The rule's implementation costs are expected to be steep as well. CMS' own estimates show that the first year will likely cost companies $269 million in compliance costs, with the second year and every year thereafter costing $180 million to the broader industry. These estimates "might well be 25% higher or lower," CMS added. Manufacturers will assume approximately $183 million in costs the first year and an additional $1.15 million in infrastructure costs ($194 million total), while the remainder of the costs will be borne by GPOs, third parties, physicians and teaching hospitals.

The cost for manufacturers assumes several things, including:

  • an hourly compliance rate of $47.55 ($35.75 base rate, plus an additional 33% for fringe benefits)
  • 150 large manufacturers and 1,000 small manufacturers
  • 1,040 hours to conduct compliance activities in each organization, with an additional 4,160 hours of support staff time at an hourly rate of $26
  • 780 hours to conduct compliance activities in each organization, with an additional 3,120 hours of support staff time at an hourly rate of $26 for each subsequent year

CMS said it believes this system will eventually become more automated, requiring less staff time to conduct. This is also an average cost, and CMS noted that manufacturers will likely need more resources to conduct compliance activities than smaller manufacturers.

Smaller companies could feel the pinch of the regulations more than larger companies in that they are less able to scale infrastructure costs, and the fines, which are set and not relative to market size or cap, could eat up a larger proportion of a company's profits if they run afoul of the law.

The high costs of compliance per year, particularly for large companies, relative to the yearly maximum fines--$1.15 million in total-also raise the prospect that some companies may determine that it is cheaper not to comply with the Sunshine Act. This consideration might still be outweighed by a hesitancy to open up a company to a more comprehensive investigation or legal action, both of which could become costly and uncover additional violations.

But companies will likely benefit from at least one part of the law: uniformity. Section 403.914 of the regulation states that it preempts all state laws on the same topic, making it easier for companies to remain in compliance regardless of the state they operate in. This could prove useful in states like Massachusetts, Minnesota and Vermont, where laws require similar reporting and were used as the basis for the Sunshine Act.

For CMS, the benefits of the regulation outweigh its costs. "Public reporting of the extent and nature of relationships between physicians, teaching hospitals and industry manufacturers through increased transparency will permit patients to make better informed decisions when choosing health care professionals and making treatment decisions, and deter inappropriate financial relationships," CMS wrote in the final rule.

Potential Problems

The regulation raises other questions and potential issues as well.

Under section 403.902, Definitions, it explains that "related to a covered drug, device, biological or medical supply means that a payment or other transfer of value is made in reference to or in connection with one or more covered drugs, devices, biological or medical supplies." Determining which payments are made in "reference" or "connection" to a particular product, or whether they are separate by some other virtue, will likely be a source of conflict between industry and government auditors.

Other problems may relate to the amount of information known about the investments of certain physicians. How would a company-perhaps one operating in a rare disease space-know which doctors or their family members are connected to a charitable research foundation they contributed to? Those payments could be seen under the regulation as being either a direct or indirect payment, and thus reportable to CMS. This could be particularly difficult in larger companies, where two or more separate branches might be working with the same physician for different reasons (e.g. one for sales, another for consulting purposes).

Implementation Date

The new rules are found in 42 CFR 402 and 42 CFR 403, and will come into effect 60 days after the regulation's final publication in the Federal Register, expected to occur on 8 February 2013. That would mean implementation would occur on 9 April 2013. Reporting, however, would not begin until 1 August 2013.

That 60-day implementation window is just one-third of the amount of time called for by some in industry, which asked for 180 days to understand the law before implementing its provisions.

The regulation may be found in the Federal Register, starting at page 251 in the PDF.

Regulatory Focus newsletters

All the biggest regulatory news and happenings.