CMS Issues Final Physician Payment Sunshine Rule

by Holland & Knight LLP

In an action that will have broad implications for drug and device manufacturers, researchers, distributors, teaching hospitals and physicians, on February 1, the Centers for Medicare and Medicaid Services (CMS) publicly released its long-awaited final regulation to implement the "Physician Sunshine Payment" provisions of the Affordable Care Act. Those provisions require applicable manufacturers of drugs, devices, biologicals, or medical supplies covered under Medicare, Medicaid, or the Children's Health Insurance Program (CHIP) to report annually to CMS certain payments or other transfers of value to physicians and teaching hospitals. They also require applicable manufacturers and applicable group purchasing organizations (GPOs) to report certain information regarding ownership or investment interests held by physicians or the immediate family members of physicians in such entities.

Under the regulation, manufacturers are required to collect data beginning on Aug. 1, 2013, and report it to CMS by March 31, 2014, and annually thereafter. CMS will organize and publish this data in a searchable database on its website. It will also submit an annual report to Congress and each state summarizing this information starting on April 1, 2015.

The statutory provisions establishing reporting requirements were enacted because of suspicions among policy makers that payments made by drug and device manufacturers to physicians and teaching hospitals influence research, education and clinical decision-making in nefarious ways. Importantly, the regulation does not prohibit any relationships between manufacturers, physicians and hospitals. Rather, it creates extensive data reporting and publication requirements with severe sanctions for noncompliance.

CMS issued a proposed rule in late 2011; the final rule changes and in some cases clarifies the terms of that proposal. The final rule will significantly impact how manufacturers, physicians, teaching hospitals and other stakeholders will interact.

The following is a synopsis of some of the rule's key provisions.

Who Must Report

The regulation requires reporting by "applicable manufacturers," those that engage in

(1) ... the production, preparation, propagation, compounding, or conversion of a covered drug, device, biological, or medical supply for sale or distribution in the United States, or in a territory, possession, or commonwealth of the United States; or are (2) Under common ownership with an entity in paragraph (1) of this definition, which provides assistance or support to such entity with respect to the production, preparation, propagation, compounding, conversion, marketing, promotion, sale, or distribution of a covered drug, device, biological, or medical supply for sale or distribution in the United States.

"Covered" products are those for which payment is available under Medicare, Medicaid or CHIP either separately, such as through a formulary or fee schedule payment, or as part of a bundled payment, and which requires a prescription to be dispensed (for a drug or biological) or premarket approval by or notification to the Food and Drug Administration (FDA) (for a device or medical supplies that are devices).

According to CMS, manufacturers of a covered drug, device, biological, or medical supply are deemed to be applicable manufacturers if their products are sold or distributed in the United States — regardless of where the covered drug, device, biological, or medical supply is actually produced or where the entity is actually located or incorporated. Further, the regulation states that the proposed definition includes entities that hold FDA approval, licensure, or clearance for a covered drug, device, biological, or medical supply as well as those that manufacture any covered product even if the manufacturer does not hold the FDA license, approval or clearance. Entities that only manufacture raw materials or components, which are not themselves covered products, will not be required to report unless they meet the definition related to common ownership with an applicable manufacturer.

The regulation also says that wholesalers and distributors (including repackagers and relabelers) that hold the title to a covered drug, device, biological or medical supply are considered "manufacturers" and must report.

Manufacturers with less than 10 percent of total (gross) revenues from covered drugs, devices, biologicals or medical supplies are only required to report payments or other transfers of value related to the covered products. However, these entities must register with CMS and attest that less than 10 percent of total revenues are from covered products.

What Must Be Reported

All payments or transfers of value made by an applicable manufacturer to a "covered recipient" or to an entity or individual at the request of, or designated on behalf of, a covered recipient must be reported.

Covered recipients include physicians, except those who are bona fide employees of the applicable manufacturer reporting the payment, as well as teaching hospitals (those hospitals that received Medicare medical education payments). CMS will publish a list of these teaching hospitals every year.

The regulation preamble notes that CMS interprets "value" as "discernible economic value on the open market in the United States." Therefore, payments or transfers of value that do not have "discernible" economic value for the covered recipient still must be reported. In addition, they must be reported even if the covered recipient does not formally request the payment or transfer of value.

Categories of information required to be reported for each payment or transfer of value are noted in the statute but the regulation adds a few details. They include:

  • physician's name (including middle initial if known)
  • business address (defined as the "primary practice" location)
  • date of payment (manufacturers have flexibility to report payments made over multiple dates either separately or as a single line item for the first payment date)
  • name of the covered product associated with the payment

The regulation also codifies the form of payment categories listed in the statute such as:

  • cash or cash equivalent
  • in-kind items or services
  • stock, a stock option, or any other ownership interest, dividend, profit, or other return on investment
  • any other form of payment or other transfer of value

Nature of payment categories are listed in the statute and include:

  • consulting fees
  • compensation for services other than consulting
  • honoraria
  • gifts
  • entertainment
  • food
  • education
  • research
  • grants
  • compensation for serving as faculty or as a speaker for a continuing medical education program

Special Rules for Research

The regulation contains new rules for research payments. Specifically, the regulation adopts the definition of research used in other federal regulations found at 42 CFR Part 50 which defines research as "a systematic investigation designed to develop or contribute to generalizable knowledge relating broadly to public health ... [t]his term encompasses basic and applied research and product development." In the preamble, CMS notes that this definition includes pre-clinical research and FDA Phases I-IV research, as well as investigator-initiated studies.

Any payments related to research as defined by the regulation are reportable. This requirement includes payments to principal investigators who meet the definition of "physician" even if they do not regularly treat patients.

Payments within this category must be subject to either a written agreement or contract or a research protocol. CMS also says that this may include "an unbroken chain of agreements" that link the manufacturer with the covered recipient such as through clinical research organizations.

The information required to be reported for each research-related payment ultimately paid to a covered recipient includes:

  • the name of the research institution/entity or individual receiving payment (regardless of whether a covered recipient)
  • the covered recipient (and associated information)
  • the name of the study
  • principal investigator(s)
  • the total amount of the research payment

CMS modifies these requirements for pre-clinical research (including lab and animal research carried out prior to beginning studies in humans). For this research, manufacturers only have to report the name of the research institution, principal investigator(s) and the total amount of the payment. The total research payment amount includes the "aggregated amount of any payments for services included in the written agreement/research protocol." CMS says that it will publish information about research studies separately from all other payments provided to the covered recipient.

New Rules for Continuing Medical Education

The regulation adds a new section regarding payments for continuing medical education (CME). Specifically, the regulation status that a payment made to a speaker at a CME program is not reportable if all of the following conditions are met:

  • The program meets accreditation or certification requirements and standards of accrediting bodies such as the American Council for Continuing Medical Education.
  • The applicable manufacturer does not select the covered recipient speaker or provide the vendor with a "distinct, identifiable set of individuals" to be considered as speakers for the program.
  • The applicable manufacturer does not directly pay the covered recipient speaker.

Manufacturers are not responsible for reporting payments made to CME vendors that are used to subsidize attendees' tuition fees for CME events. However, payments or other transfers of value associated with attendance of an event (such as travel and meals) must be reported.

Payments or other transfers of value related to unaccredited and non-certified programs should be reported as required for any other payment.


The regulation elaborates on the specific exclusions listed in the statute. For example, payments or transfers of value less than $10 do not need to be reported except when the total annual value of payments or other transfers of value to a covered recipient exceeds $100. Note that these de minimus thresholds apply for calendar year 2013. For 2014 and subsequent years, the thresholds are increased by the same percentage increase in the CPI for all urban consumers for the 12-month period ending with June of the previous year. CMS will publish these values annually. The regulation specifies that payments or transfers of value below the threshold provided at large-scale conferences and events — such as distribution of pens or other items — as well as at events open to the public, do not need to be reported and are not included for purposes of meeting the aggregate threshold.

In addition, educational materials and items that "directly benefit patients or are intended to be used with patients" are not reportable. The regulation preamble explains that this exclusion encompasses materials, "such as wall models and anatomical models" that are intended to be used with a patient but does not include journal reprints or textbooks that may have "downstream benefits" for patients. The exclusion is limited to educational materials only, not marketing or promotional materials.

Relationship to State Law

The statute preempts state or local laws requiring reporting of the same type of information concerning payments or other transfers of value. No state or local government can require separate reporting of any information regarding a payment or transfer of value that is required to be reported under the federal law unless that information is for public health purposes. Preemption determinations will be analyzed on a case-by-case basis.

Penalties and Enforcement

The regulation specifies that CMS or Office of Inspector General (OIG) may impose penalties of up to $10,000 for each failure to report up to a total of $150,000 per annual submission and up to $100,000 for each knowing failure to report up to $1 million per annual submission. Total annual civil monetary penalties imposed are aggregated separately.

The regulation specifies the factors to be considered when CMS or OIG determines the amount of civil monetary penalty. The agencies may audit, inspect, or evaluate any records, documents, or other evidence that pertains to reporting requirements under these provisions.

In addition, the monetary penalties apply to the organization that files the reports to CMS. Therefore, if companies under common ownership file a consolidated report, it is the company filing the report that will be liable for any non-compliance.


The new regulation is extensive and detailed. It will dramatically affect activities by manufacturers, teaching hospitals, physicians, researchers and other stakeholders. CMS notes that certain guidance and reporting templates are still under consideration and not yet available. Nonetheless, organizations are required to begin collecting data later this year and reporting that data soon thereafter. Since the penalties for non-compliance are severe, organizations should take immediate steps to identify the steps they need to take to comply with this regulation.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Holland & Knight LLP | Attorney Advertising

Written by:

Holland & Knight LLP

Holland & Knight LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.