The Sunshine Act reporting requirements obligate drug, device, biological, and medical supply manufacturers, along with group purchasing organizations, to submit annual reports to the Centers for Medicare & Medicaid Services detailing payments and other transfers of value made to physicians and teaching hospitals, plus any physician ownership or investment interests in the company. Reports cover the prior calendar year, are due by March 31, and get published on the public Open Payments database by June 30. For 2026, individual payments as small as $13.82 can trigger reporting, and inflation-adjusted penalties for a knowing failure to report now reach $1,443,275 per annual submission.
Who Has to Report
Two categories of entities carry reporting obligations. The first is any company operating in the United States that manufactures a drug, device, biological product, or medical supply covered by Medicare, Medicaid, or CHIP. The second is any entity under common ownership with such a manufacturer that assists with production, marketing, or distribution. Distributors and wholesalers that never hold title to covered products fall outside the definition.1eCFR. 42 CFR 403.902 – Definitions
Group Purchasing Organizations also report, though their focus sits on physician ownership and investment interests rather than general payments. Both manufacturers and GPOs submit annual reports to CMS covering the prior calendar year.2Centers for Medicare & Medicaid Services. Transparency Reports and Reporting of Physician Ownership or Investment Interests Final Rule
Which Providers Are Covered Recipients
The law targets a defined list of providers. Licensed physicians qualify, including doctors of medicine, osteopathy, dentistry, podiatry, optometry, and chiropractic. Physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, and certified nurse-midwives are also covered. Teaching hospitals qualify if they received indirect or direct graduate medical education payments from Medicare during the most recent available calendar year.3Centers for Medicare & Medicaid Services. Open Payments Glossary and Acronyms
A covered recipient who is a bona fide employee of the reporting company is excluded. Salary and benefits paid to a physician on the manufacturer’s own payroll are not reportable. Once that physician moves from employee to consultant, payments become reportable.
What Must Be Reported
Every payment or transfer of value from a reporting entity to a covered recipient must be categorized and submitted. CMS maintains a fixed list of natures of payment, which includes consulting fees, food and beverage, travel and lodging, education, research funding, grants, honoraria, gifts, royalties, entertainment, charitable contributions, and speaking compensation. Each transaction is assigned to exactly one category.4Centers for Medicare & Medicaid Services. Open Payments Natures of Payment
For each transaction, the manufacturer collects and submits identifying data about the recipient: full name as it appears in the National Plan and Provider Enumeration System, primary business address, specialty, National Provider Identifier, and at least one state professional license number. The payment record itself requires the exact dollar amount, the date, the form of payment (cash, stock, in-kind), the nature of payment, and the marketed name of any related product.5eCFR. 42 CFR 403.904 – Reports of Payments or Other Transfers of Value
When a single payment benefits multiple recipients, the manufacturer distributes the amount among the individual providers who requested it, on whose behalf it was made, or who were intended to benefit.5eCFR. 42 CFR 403.904 – Reports of Payments or Other Transfers of Value
Payments That Do Not Have to Be Reported
Not every dollar changing hands triggers reporting. The most heavily used exclusion is the de minimis threshold. For Program Year 2026, individual payments below $13.82 are excluded. But once total payments to the same covered recipient during the calendar year exceed $138.13, every payment must be reported, including the ones that individually fell below the threshold.6Centers for Medicare & Medicaid Services. Data Collection for Open Payments Reporting Entities
Other excluded transfers include:
- Short-term device loans of 90 days or less for evaluation, and a 90-day supply of single-use disposable devices provided for evaluation.
- Educational materials and items that directly benefit patients or are intended for patient use, such as anatomical models used during consultations.
- Buffet meals at large events where food is available to all attendees and identifying individual physician recipients would be impractical.
- Warranty repairs, maintenance, or training provided under a contractual warranty tied to a purchase or lease.
- Payments related to lawsuits, settlements, arbitrations, and other legal proceedings involving the covered recipient.
The aggregation rule inside the de minimis threshold catches compliance teams. A $12 lunch provided monthly crosses the $138.13 aggregate on the twelfth meal, and every lunch from that year becomes reportable retroactively. Tracking small transfers throughout the year is essential.
Indirect Payments Through Third Parties
Routing a payment through an intermediary does not remove the reporting obligation. When a manufacturer requires, instructs, or directs a third party to provide a payment or transfer of value to a specific covered recipient, that payment is reportable. The obligation attaches even when the manufacturer does not know the identity of the specific physician in advance, so long as it could reasonably identify the recipient within the regulatory timeframe.5eCFR. 42 CFR 403.904 – Reports of Payments or Other Transfers of Value
This most often matters for funds moving through physician organizations, medical societies, or specialty pharmacies. If a manufacturer funds a speaker program and tells the organizing body which physicians to pay, the manufacturer reports those payments. Unrestricted donations to medical conferences, where the manufacturer places no conditions on how funds are used, generally sit outside the reporting requirement.
Physician Ownership and Investment Interests
Manufacturers and GPOs also report ownership or investment interests held by physicians or their immediate family members in the reporting entity. That includes stock, stock options, partnership shares, and any other form of equity.7Centers for Medicare & Medicaid Services. CMS Implements Certain Disclosure Provisions of the Affordable Care Act
For GPOs, this is the primary reporting obligation, because GPOs negotiate purchasing terms between manufacturers and providers, and a physician holding an equity interest in the negotiating entity creates the type of conflict the statute was written to expose.
Research Payments and Delayed Publication
Research payments follow different publication rules. When a manufacturer pays a covered recipient in connection with research on a drug, device, or biological product that has not yet received FDA approval, the payment is reported to CMS on the normal schedule but withheld from public view. CMS publishes it on the first annual publication date after whichever comes first: FDA approval of the product, or four years from the date of the payment.8eCFR. 42 CFR 403.910 – Delayed Publication
Manufacturers must actively flag these payments as eligible for delayed publication in the annual report. Missing the flag causes CMS to publish on the standard timeline. The manufacturer must also notify CMS in each subsequent submission that FDA approval is still pending; failing to update CMS after approval can be treated as a failure to report.
The Annual Timeline
The Open Payments calendar runs in five phases, and missing any window creates problems:
- January 1 – December 31: Reporting entities track payments and transfers of value throughout the calendar year.
- February 1 – March 31: Reporting entities upload the prior year’s data to CMS and complete attestation. This deadline does not move.
- April 1 – May 15: Covered recipients have 45 days to review the records attributed to them and initiate disputes.
- May 16 – May 30: Reporting entities have 15 days to correct disputed records before publication.
- By June 30: CMS publishes the finalized dataset on OpenPaymentsData.cms.gov.
CMS does not mediate disputes. Manufacturers and physicians resolve them directly. Anything unresolved at the end of the correction window gets published with a “disputed” flag attached.10Centers for Medicare & Medicaid Services. Dispute and Correction
How to Submit
Before any data goes in, the reporting entity must register in both the CMS Identity Management system and the Open Payments system. Each entity assigns individuals to four user roles: Officer, Submitter, Attester, and Compliance. One person can hold multiple roles, but every role must be filled before the system accepts a submission. An entity can register up to ten users, with no more than five Officers.11Centers for Medicare & Medicaid Services. Registration for Open Payments Reporting Entities
Data is prepared using the official CMS templates. The system accepts CSV and XML uploads, along with manual entry through the web interface for smaller submissions.12Centers for Medicare & Medicaid Services. Open Payments Technology Webinar Series – Data Submission After the upload runs a validation check, a designated official provides an electronic attestation certifying accuracy and completeness, and the system generates a tracking confirmation.13Centers for Medicare & Medicaid Services. Data Submission and Attestation for Open Payments Reporting Entities
Penalties for Missing or Incorrect Reports
The statute sets two penalty tiers. An ordinary failure to report carries $1,000 to $10,000 per unreported payment, capped at $150,000 per annual submission. A knowing failure runs $10,000 to $100,000 per unreported payment, capped at $1,000,000 per annual submission.14Office of the Law Revision Counsel. 42 USC 1320a-7h – Transparency Reports and Reporting of Physician Ownership or Investment Interests
Those are the base statutory numbers. Federal law requires annual inflation adjustments, and the 2026 figures are considerably higher. An ordinary failure now runs $1,443 to $14,432 per unreported payment, capped at $216,490 per annual submission. A knowing failure runs $14,432 to $144,329 per unreported payment, capped at $1,443,275 per annual submission.15GovInfo. Federal Register Volume 91 Issue 18 – Civil Monetary Penalties Inflation Adjustment
CMS can audit reporting entities at any time to verify the accuracy and completeness of a submission.16Centers for Medicare & Medicaid Services. Audits and Penalties for Open Payments Reporting Entities
Records to Keep
Reporting entities keep all documentation related to their Open Payments submissions for at least five years after CMS publishes the data. That includes records of individual payments, transfers of value, and ownership or investment interests.16Centers for Medicare & Medicaid Services. Audits and Penalties for Open Payments Reporting Entities Because CMS publishes on June 30 of the year following the payment, a payment made in January 2026 would not have its five-year retention clock start until mid-2027.