As the second Sunshine Act/Open Payments reporting period winds down, one question on the mind of many Sunshine Act participants is this: when will CMS begin enforcement of the Sunshine Act? The answer, it turns out, is that enforcement efforts are underway.
Before I examine those efforts, however, I would like to discuss the reporting requirements and penalties under the Sunshine Act.
The Sunshine Act requires two types of entities to file annual reports with CMS. Medical device and pharmaceutical manufacturers that meet certain definitional standards (applicable manufacturers) are required to report payments and other transfers of value given to a physician or teaching hospital during a reporting year. In addition, an applicable manufacturer must report certain ownership or investment interests held by physicians, or immediate family members of physicians, in the applicable manufacturer.
Group purchasing organizations that meet certain definitional standards (applicable group GPOs) are required to report ownership or investment interests held by physicians or their immediate family members in the applicable GPO. An applicable GPO also must report payments and other transfers of value it made to those physicians or their immediate family members if the physicians or their immediate family members held their ownership or investment interests at any time during the reporting year.
Applicable manufacturers and applicable GPOs are required to submit their information in a “timely, accurate, and complete” manner. Failure to comply can subject the applicable manufacturer or applicable GPO to a civil monetary penalty (CMP) of $1,000 to $10,000 for each payment or transfer of value, or ownership or investment interest, not reported, subject to a cap of $150,000. “Knowing” failure to comply leads to a CMP of $10,000 to $100,000 for each payment or transfer of value, or ownership or investment interest, not reported, subject to a cap of $1,000,000. The total combined maximum penalty for a reporting entity in a reporting year is $1,150,000.
CMS is focusing its initial enforcement plan on the 2013 reporting year (which included only the last five months of the 2013 calendar year).
CMS could have chosen one or two scofflaws that failed to file and made an example of those entities by imposing the maximum CMP. Instead, CMS appears to have decided that encouraging compliance may yield better results in the long run. To that end, CMS has contacted applicable manufacturers and applicable GPOs that should have submitted data for the 2013 reporting year, but failed to do so. CMS is working with these non-reporting entities to increase their submission compliance.
The next step will be targeted audits to identify additional applicable manufacturers and applicable GPOs that did not submit data for the 2013 reporting year. The goal will be to increase the submission compliance for those entities.
In subsequent years, CMS will notify non-compliant applicable manufacturers and applicable GPOs that they failed to report data in a timely, accurate, and/or complete manner. Presumably, assessment of CMPs will follow depending on the level of non-compliance.
As of today, CMS has not reported the imposition of a CMP in connection with an enforcement action against an applicable manufacturer or an applicable GPO.
CMS will post 2014 data on June 30, 2015, which is less than three weeks away. I will keep you up to date on Sunshine Act developments between now and then.
Note: If some of the terms I use in this post are not familiar, you can review my blog entry of April 16, 2014 for a list of Sunshine Act definitions. Here is a link to that entry: