The Centers for Medicare and Medicaid Services (CMS) published proposed regulations today under the Physician Payment Sunshine Act (Act or Sunshine Act).  The Sunshine Act is a provision of the 2010 Patient Protection and Affordable Care Act .that requires drug, medical device, biological and medical supply manufacturers to track and report payments made to physicians and teaching hospitals.  The Act also requires those manufacturers and group purchasing organizations (GPOs) to disclose any financial or ownership interest that physicians or their immediate family members have with those entities.

CMS intends to push back the date by which companies are required to start collecting data on the relevant payments.  Under the Sunshine Act, data collection, set to begin by January 1, 2012, will probably be delayed until mid or late 2012 at the earliest.  The Department of Health and Human Services (HHS) will be accepting comments on the proposed regulations until February 17, 2012.  After the final regulations are issued, CMS is considering giving manufacturers an additional 90 days before they need to begin tracking payment information. 

In its proposed regulations, CMS provides definitions and guidance on a number of key provisions of the Act and is asking for additional feedback through the notice and comment process.  Significant aspects of the guidance are included below.

Manufacturers

Manufacturers subject to the Act include any entities involved in the production or manufacturing of any drugs, medical devices, biologicals or medical supplies for sale in the United States (including foreign manufacturers), if those products are covered by Medicare, Medicaid, or the Children’s Health Insurance Program (CHIP).  Over-the-counter drugs are not included in this definition.  Entities that are under a “common ownership” with those manufacturers are also covered by the Act.  CMS is accepting comments on how “common ownership” should be defined, and how the reporting obligations will be allocated when a company contracts with an outside entity to manufacture its products.

Group Purchasing Organizations (GPOs)

GPOs that purchase or arrange for the purchase of drugs or medical supplies are covered by the Act.  In its proposed regulations, CMS defines a GPO as any entity that operates in the United States and “purchases, arranges for, or negotiates the purchase” of a covered drug, device, biological or medical supply not solely for the entity itself.”  In doing so, CMS has made it clear that physician groups and hospitals that negotiate drug or medical device sales for their own use are not subject to the Act.

Covered Recipients

All physicians (except those employed by the manufacturer itself) and teaching hospitals are potential covered recipients under the Act.  Teaching hospitals will include all institutions that receive Medicare payments for graduate medical education.  CMS will publish an annual list of covered teaching hospitals.  Manufacturers would be required to report the recipient’s (a) name; (b) business address; (c) National Provider Identification (NPI) number; (d) specialty; (d) form of payment (which CMS has limited to cash, in-kind items and stock); and (e) nature of payment. 

Nature of Payment

The reporting obligations cover any “transfer of value” to physicians and teaching hospitals that amounts to $10 or more (or such lesser amounts, if they aggregate to more than $100 over the course of a year).  The nature of payment falls into a number of categories that are listed in the Act (such as consulting fees, research, gifts, entertainment, food, travel, education and charitable contributions).  The proposed regulations explain how the most appropriate category should be identified for inclusion in the report.  For payments that fall into multiple categories (such as when a physician is paid for a speaking engagement, as well as travel and meal expenses), CMS proposes that each payment should be disclosed separately.

CMS also proposes a narrow definition for the “research” category, which would be limited to payments made pursuant to a written research agreement and protocol.  For “indirect” payments, such as when a non-physician entity receives the payment but is only sponsoring physician research investigators, the reporting entity must include both the covered recipient and the entity that is actually paid.

Exclusions

The Act contains 13 benefits categories that are excluded from the reporting obligations, including payments made through a third party where the manufacturer is unaware of the identity of a covered recipient.  CMS proposes that a manufacturer cannot act with deliberate or reckless disregard about the fact that payments are going to a covered recipient and that knowledge by the manufacturer’s agent of the identity of a covered recipient would be attributed to the manufacturer.  CMS is also soliciting comments on how to define the exclusion of educational items that directly benefit patients or that are intended for patient use.

Ownership or Investment Interests

Manufacturers and GPOs will be required to report any physicians or immediate family members of physicians that have an ownership or investment interest in the reporting entity.  The proposed regulations state that this ownership or interest will be defined in a similar manner as the physician self-referral (Stark law) regulations (which would include stock, partnership shares, limited liability membership, loans, bonds, etc.).  An ownership interest includes “indirect” interests through debt, equity or other means.  An ownership or investment interest in a publicly traded security or mutual fund is not covered by the Act.  CMS will require physician information to be publicly disclosed and is seeking comments on whether reporting entities should also be required to disclose the names of immediate family members covered by this rule, given privacy concerns.

Report Submission

Report submission will be handled electronically through a system implemented by CMS.  Once CMS aggregates the data that has been submitted, reporting entities and covered recipients will have 45 days to log in and review the data before it becomes public.  CMS is also considering requiring all manufacturers and GPOs to register with CMS regardless of whether they have any payments to report.  In addition, an executive from each reporting entity would have to submit an attestation that, to the best of his or her knowledge, the entity has nothing to report.  But CMS is “seeking input on whether requiring registration for all entities and an attestation from entities with no reportable information would be more burdensome than beneficial.” 

Penalties

CMS and the HHS Office of Inspector General will have audit authority to ensure compliance with the Sunshine Act.  Manufacturers must maintain all records used in their compliance program in order to respond to an audit.  Under the Act, reporting entities are subject to civil fines of $1,000 to $100,000 per violation, up to a total of $150,000 per year.  For “knowing” failures to report on an annual submission, the maximum penalty is $1 million.

Practical Implications for Compliance

As these proposed regulations make clear, compliance with the Sunshine Act will require manufacturers and GPOs to have an intimate knowledge of the detailed regulations and dedicated compliance resources.  CMS appears be considering the significant burden that these regulations will impose on the industry and estimates that for large multinational companies an average of 10 full-time employees will need to be devoted to Sunshine Act compliance.  The proposed regulations should serve as a warning sign as it would be easy to run afoul of the Act’s provisions if a robust compliance program is not in place.  Reporting obligations and the potential for audits will not only expose companies to civil monetary penalties under the Act, but could lead to government investigations under other civil or criminal laws.  For example, a Sunshine Act audit could uncover evidence that a drug manufacturer is engaging in “off-label” marketing, an area of significant government enforcement in recent years.  In addition, the potential “attestation” requirements of executives could bolster Food and Drug Administration (FDA) and Department of Justice efforts to hold corporate officers individually responsible under FDA laws.  Although CMS’ delay in requiring data collection will provide companies with more time to develop compliance programs, the complexity of CMS’ proposal demonstrates that the time to ramp up compliance initiatives is now.

© 2011 Perkins Coie LLP