Senators Charles Grassley (R-Iowa) and Herb Kohl (DWisconsin) recently re-introduced the Physician Payments Sunshine Act (“Sunshine”).¹ The 2009 Sunshine Act requires manufacturers to report annually to the U.S. Department of Health and Human Services (HHS) payments to physicians in excess of $100 per year. Unlike previous versions of Sunshine that were stalled in order to accumulate and incorporate industry recommendations, the current, more aggressive version is expected to sail through Congress this year, in some form, on the strong political winds of healthcare reform. To avoid getting burned by Sunshine, pharmaceutical and medical device manufacturers need to take immediate steps to develop a Sunshine preparedness plan.

If passed, Sunshine would require manufacturers of any drug, device, biological, or medical supply that is eligible for Medicare, Medicaid, or State Children’s Health Insurance Program (SCHIP) coverage to disclose, on an annual basis, any payment or other transfer of value to a physician, medical practice, or group practice that exceeds $100 per year. The first report would be due March 31, 2011.² Sunshine defines payment broadly to include one or more transfers having an aggregate value of more than $100 per year, including food, entertainment, travel expenses, education, gifts, charitable contributions, grants, consulting fees, honoraria, research, royalty or license, other compensation, profit distributions, and ownership/investment interest held by physicians or their immediate family members (but excludes publicly traded securities or mutual funds as long as such were purchased by the physician and not provided by the manufacturer) and other transfer as defined by the HHS Secretary.³ Manufacturers would not be required to report educational materials that directly benefit patients, product samples for patient use that may not be sold, or in-kind contributions used for charity care.⁴ Additionally, under the proposed legislation, manufacturers would be allowed to delay reporting payments made pursuant to a product development agreement for services provided in conjunction with the development of a new drug, device, biological, or medical supply or in connection with a clinical trial until the first report after FDA approval or two years, whichever is earlier.⁵ HHS would then make all of the reported information available via the internet in a searchable, user-friendly format.⁶

Sunshine includes fines ranging from $1,000 to $10,000 for each payment that is not reported (up to $150,000 annually) and additional penalties of $10,000 to $100,000 for each payment for intentionally violating reporting requirements (up to $1 million annually).⁷ Actual fines and penalties under Sunshine are not the biggest risk, since presumably the reports will be scrutinized for potential violations of federal and state laws by government investigators and qui tam hopefuls who should benefit from the “searchable, user-friendly format” to reduce greatly their fact-gathering burden.

Regrettably, Sunshine does not incorporate the crucial state law preemption provisions that the industry had secured in prior Sunshine drafts.⁸ Instead, as introduced, Sunshine only preempts duplicate state reporting requirements but allows states to impose additional reporting obligations.⁹ Some states have already adopted disclosure laws that impose additional requirements beyond Sunshine, and additional states are slated to introduce disclosure legislation this year.¹⁰ The inadequate preemption provisions make Sunshine seriously flawed and significantly increase the complexity of the compliance systems that will be required to track contradictory state and federal reporting requirements. For instance, Massachusetts state law reporting requirements begin July 1, 2010, and extend far beyond Sunshine’s application to physicians by requiring disclosure of payments to anyone authorized to prescribe, dispense, or purchase drugs or medical devices licensed in Massachusetts as well as officers, employees, agents, or contractors of the prescriber who, in the course and scope of their employment, support the provision of healthcare.¹¹ The breadth of this statute may extend to hospitals, nursing homes, pharmacists, and health benefit plan administrators, as well as healthcare professionals who are licensed in Massachusetts but practice in other states. States like Massachusetts will create a much bigger burden than Sunshine and emphasize the need for well thought out, flexible data collection systems.

In defense of the Sunshine drafters, the goal of transparency is laudable. Tracking of monetary transfers between manufactures and physicians seems like a reasonable request to provide a mechanism to evaluate monetary transfers to ensure that healthcare decisions are not influenced by improper payments. After all, how hard can it be to track payments? Unfortunately, Compliance Officers who have implemented effective tracking systems know that implementation of such systems is time consuming, labor intensive, and expensive. Ironically, companies with the most experience in implementing such systems are companies who were forced to implement tracking systems pursuant to Corporate Integrity Agreements (CIA) or Deferred Prosecution Agreements (DPA) with the government. Under such circumstances, it is relatively easy to convince senior management that significant resources must be allocated to comply with the CIA/DPA. In today’s economic downturn, it may be more difficult to obtain the widespread support and financial commitment needed to implement an effective process to comply with Sunshine. However, failure to properly plan and integrate data collection processes into daily operations may create a superficial system that not only fails to capture essential information necessary for state disclosure law compliance (leading to fines, penalties, and reputational damage), but one that will require costly re-engineering of the process at a later date. Leadership and appropriate financial support are crucial to navigate safely through Sunshine and prepare for increasing state disclosure obligations.

The Business Travel Forecast for Healthcare Professionals is Treacherous

To illustrate the complexity of the tracking, let’s evaluate a typical interaction between a medical device company and a physician engaged to promote training and education on the safe and effective use of its products.

Dr. Don Doright was engaged by Good Care Device Company to provide training and education on the safe and effective use of Good Care’s device. The program was designed to teach physicians how to implant the device safely according to FDA labeling.

Dr. Doright lives in Phoenix but agreed to fly to Good Care’s corporate headquarters in Minot, North Dakota, to teach a training program. Dr. Doright will be paid $400 per hour for his services. He arrived in Minot and took a taxi to the Good Care facility. Two hundred physicians registered for Good Care’s training program, but due to an unseasonably late snow creating hazardous driving conditions, only 150 arrived on the day of the program. The program lasted for six hours, and modest meals were provided. Dr. Doright provided the training and participated in a subsequent question and answer session. Although he planned to fly back to Phoenix immediately after the program, his afternoon flight was cancelled due to weather, so he was provided a hotel room by Good Care and rescheduled on a flight home to Phoenix the following morning. Some additional physicians who attended the program were provided hotel and airfare since the program was not within driving distance for all attendees.

Before we discuss the practical steps that are needed to collect the data to comply with Sunshine or similar state disclosure laws, note that Sunshine does not prohibit any otherwise legal payment to a physician. Therefore, Sunshine does not require that any existing arrangements be restructured; it simply requires disclosure.

Of course, the challenge is that developing a disclosure system that is sustainable over time is anything but simple. For example, to accomplish the reporting required by Sunshine to track the interaction between Dr. Doright and Good Care outlined above, Good Care will need to develop a system that includes the following:

• An event identification number specific to the training and education program, to be assigned to all airfare, lodging, and any other transfer of value provided at the program, the purpose being to ensure the costs for the program are reconciled to the event file.
• A unique identification number for Dr. Doright, all faculty, and each physician attending the training program.
• A procedure/work instruction to reconcile all meals, airfare, lodging, and transportation and assignment of each transfer of value to the unique identification numbers assigned to each physician for this specific event.
• A check point to ensure that Dr. Doright has an active consulting agreement and a method to track any payment for the consulting activity to ensure the consulting payment will be captured and reported.
• A procedure to address any no shows for meals and a reconciliation process to ensure each transfer of value is accurately captured. Specifically, if 200 plates of food were charged based on the number of expected attendees, but only 150 attendees showed up for the meal, an accounting process must be in place to either adjust the price per person or account for the no shows. Since no one’s plate of chicken got bigger because of the no shows, it would seem reasonable to account for the no shows separately rather than to increase the price per head reported as a payment for Sunshine purposes. On the other hand, if the event planner negotiated steak for the 150 actual attendees, for the budgeted price of chicken for the 200 expected guests, the system must collect and report the higher price per head. A process must be in place to deal with all potential variances consistently. Such as if a vegetarian attendee stepped out to grab his own vegetarian sandwich, will the system report no monetary transfer for this attendee or allocate all attendees the food and beverage cost for the program whether or not they accept the meal, thus, technically over-reporting the value of payments to the attendees?
• A system to ensure that all payments were processed with appropriate triggers to be tracked in the disclosure database. The system used must be capable of producing reports by a physician-unique identifier that details the type of value transfers and provides aggregate totals by type of interaction.

This example illustrates that, while disclosures of payments to physicians may sound simple, implementation of reliable systems to collect the information to be disclosed is complex. It will require re-engineering of processes and significant training of personnel across all areas of the organization to ensure that the processes are followed.

How will your organization prepare for Sunshine?

The best answer is to integrate the data collection process into daily operations of the business rather than retroactive collection of data by compliance personnel. Every business unit and employee must take responsibility for compliance, and those closest to the business function are in the best position to design workable processes. For instance, to properly track payments, a limited number of company employees may need to make travel arrangements directly. Past policies of reimbursing physicians and employees for certain types of expenses on personal credit cards may need to be halted. Undoubtedly, serious information technology solutions need to be considered to aggregate data. While a simple spreadsheet-type database may seem like the quickest path to disclosure compliance, it is not sustainable over time for most companies, considering the volume of entries that will be required and that state law requirements will continue to expand. Our example was one training and education program; large companies with multiple products may have hundreds of these programs each year.

Sunshine compliance will require aggregation of data from multiple operating departments. The following chart illustrates the complexity of the flow of information and the variety of operational departments that may need to contribute data to the disclosure data base.

Successful implementation of a long-term disclosure strategy will require assembling a cross-functional team that includes (at a minimum) business partners from the following areas:

• Compliance
• Legal
• Information Technology
• Medical Education/Training and Education Department/Event Management
• Customer Contact Management
• Sales
• Marketing
• Finance
• Accounts Payable (including employee expense processing)
• Communications
• Research and Development
• Clinical
• Office of Medical Affairs

After the team designs the disclosure reporting database, completeness testing and data integrity testing will need to be developed and performed to ensure the universe of data captured is complete and accurate. For instance, once a company believes that it has developed a system to collect all of the information required for Sunshine and state law compliance, auditing should be conducted on expenses in the accounting data that are not included in the disclosure database to be sure that the excluded data is indeed unrelated to payments to healthcare professionals. Additionally, companies will need to audit for appropriate inclusion criteria, to ensure transfers of value captured in the database are accurate. A company could bring unwarranted scrutiny on a healthcare professional if a payment is entered incorrectly as $100,000.00 instead of $100.00. There are potentially serious ramifications for both over-reporting and under-reporting of payment data. Compliance Officers also need solid auditing and monitoring processes to have confidence in the data prior to signing annual certifications required under some state laws.

While the scope of this article is to address Sunshine compliance, our Dr. Doright example should illustrate a need for compliance professionals to make mental lists of the many compliance procedures beyond the disclosure issues that are triggered by this common interaction:

• Does the organization have a prospective planning process that documents the need for the consulting services to be provided (were the services necessary)?
• Does the organization have an active consulting agreement for Dr. Doright that is compliant with the federal anti-kickback statute?
• Does the company have documentation containing the fair market value analysis of the consulting arrangements?
• Prior to payment for the consulting services, was there a reasonableness review, and was it approved by the individual who engaged the service(s)?
  • Was the number of hours for preparation reasonable?
  • Does the number of hours invoiced for the presentation match the agenda time?
  • Was the amount of travel time reasonable based on flight schedule or driving distance?
• Was the presentation reviewed and approved by the appropriate company representative to ensure it met all regulatory, trademark, legal requirements (on-label, etc.)?
• Did Dr. Doright alter the presentation on the plane while traveling to the meeting without approval of the company’s coordinator/regulatory reviewer?
• Does the company have a process to ensure that the presentation was not altered?
• Did Dr. Doright deviate from the approved FDA indications during the presentation?
• Was airfare the lowest logical fare?
• Was the meeting location appropriate?
• Was the hotel for the overnight stay an approved hotel?
• Were any inappropriate expenses included in the hotel bill?
• Was the meal within reasonable limits?
• Were all expenses captured and submitted?
• Was the provision of this consulting agreement unduly influenced by sales rather than educational needs?

Perhaps prompting the additional substantive compliance questions that will arise while implementing a Sunshine compliant disclosure program will be the “silver lining” to Sunshine. Transparency is good for public trust in the industry and will level the playing field for organizations that strive to operate within legal boundaries. Essentially, Sunshine is forcing companies to invest in more effective compliance processes to track and monitor their relationships with physicians and other healthcare providers. For the first time in the history of the industry, most companies will have access to databases to evaluate the total costs of training and education programs and will aggregate costs across departments to know the total company compensation to a particular healthcare provider or entity. Presumably, better data will lead to better decisions, and in that regard, perhaps, with thoughtful preparation, Sunshine will be enlightening.¹² However, if Congress fails to re-incorporate meaningful state preemption provisions into the final version of Sunshine, even with diligent preparation, manufacturers are in for a stormy course through frequently shifting state disclosure requirements.

---

[1] Physician Payments Sunshine Act of 2009, S. 201, 111th Cong. (2009).

[2] Physician Payments Sunshine Act of 2009, S. 301, 111th Cong. (2009), §1128G(a)(1)(A).

[3] Id. at §1128G(a)(1)(A)(vi), §1128(g)(10).

[4] Id.

[5] Id. at §1128G(e).

[6] Id. at §1128G(c)(1)(c).

[7] Id. at §1128G(b)(1-2).

[8] See Proposed Physician Payment Sunshine Act of 2008 at §2.

[9] Physician Payments Sunshine Act of 2009, S. 201, 111th Cong. (2009), §1128G(d)(3).

[10] See generally, Cal. Health & Safety Code §§119400 –119402; D.C. Code Ann. §§48-833.01–48-833.09; Maine Rev. Stat. Ann. tit. 22, §2698-A; Minn. Stat. §§151.461, 151.47; Nev. Rev. Stat. §639.570; Vt. Stat. Ann. tit. 22, §4632; W. Va. Code §5A-3C-13.

[11] 105 Mass. Code Regs. §§970.000 –970.101.

[12] It is not the intent of this article to set forth all of the provisions of the Act or to outline a method of compliance.

Finis