Sunshine Act / Open Payments Handling for Research Vendors

What does the Sunshine Act actually require?

The Physician Payments Sunshine Act (Section 6002 of the Affordable Care Act, codified at 42 U.S.C. § 1320a-7h) requires applicable manufacturers — manufacturers of drugs, medical devices, biologicals, and medical supplies covered under Medicare, Medicaid, or CHIP — to report transfers of value to physicians, certain advanced practice providers, and teaching hospitals to the Centers for Medicare & Medicaid Services (CMS). The data is published annually on the Open Payments website, where patients and the public can search physician-by-physician for industry payments received.

The reporting threshold:

• $10 per single transaction
• $100 aggregate annually per recipient

Below these thresholds, reporting is not required (though many manufacturers report anyway for audit trail simplicity). Above these thresholds, the manufacturer must report each transfer with specific details: recipient name, NPI, state license number, specialty, address, payment date, payment amount, payment form, payment purpose, and any related drug or device.

Why does the Sunshine Act matter for research vendors paying physician honoraria?

When a pharma sponsor commissions research that involves paying physician panelists honoraria, the chain of payment is:

Sponsor pays research vendor → research vendor pays physician

This creates an “indirect payment” that may be subject to Open Payments reporting. The applicable manufacturer is the sponsor, not the research vendor. The reporting obligation rests with the sponsor. But the sponsor needs the data captured by the research vendor to comply.

CMS’s indirect-payment provision (42 CFR § 403.904(c)(8)) requires reporting when:

1. The applicable manufacturer requires, instructs, directs, or causes the third party to provide the payment, AND
2. The applicable manufacturer knows the identity of the covered recipient

Both conditions must be met for the indirect payment to trigger reporting. If the sponsor doesn’t know the participant identity (default-blinded studies), the reporting obligation typically doesn’t apply.

Default-blinded vs. unblinded studies

Default-blinded studies (most market research)

In a default-blinded study, the research vendor maintains panelist identity confidentiality. The sponsor receives de-identified deliverables — transcripts with all 18 HIPAA identifiers removed, including names, addresses, NPIs, license numbers. The sponsor literally does not know which specific physicians participated.

Under CMS’s indirect-payment provision, default-blinded studies typically don’t trigger Open Payments reporting because the sponsor doesn’t know participant identity. The research vendor is paying physicians, but the sponsor isn’t directing payment to specific identified individuals — they’re paying the vendor for a research deliverable.

This is the standard structure for most pharma market research:

• Buying-process studies (sponsor wants to understand decision drivers; doesn’t need to know which specific physicians)
• Message validation (sponsor wants to test creative; doesn’t need to know which specific physicians provided feedback)
• Concept testing (sponsor wants to validate concepts; doesn’t need to know individual identities)
• Brand health tracking (sponsor wants quantified scores; individual identities not needed)

Unblinded studies (advisory boards, KOL panels)

In an unblinded study, the sponsor knows participant identity. This is structural for advisory boards and KOL panels — the sponsor wants to engage specific named experts, learn from them by name, and continue relationships with them post-engagement.

Unblinded engagements typically trigger Open Payments reporting because both indirect-payment conditions are met: the sponsor directs payment to specific identified individuals, and the sponsor knows participant identity. The research vendor must provide:

• Recipient name (full legal name)
• NPI (10-digit National Provider Identifier from NPPES Registry)
• State license number (for licensure verification)
• Primary specialty (specialty taxonomy code or description)
• Address (work address typical)
• Payment date (date of honorarium disbursement)
• Payment amount (USD, gross of any taxes)
• Payment form (cash equivalent, gift card, check, ACH, etc.)
• Payment purpose (typically “Compensation for services other than consulting” or “Consulting fee”)
• Related drug or device (if the research is product-specific)

This data must be provided to the sponsor in CMS-compatible format (typically a CSV or spreadsheet matching the Open Payments data submission template) by January-February of the year following the payment, giving the sponsor time to compile and submit to CMS by March 31.

What healthcare-purpose-built vendors do

Healthcare-purpose-built research vendors capture Sunshine Act data at panelist intake — NPI, license, specialty, address — regardless of whether the engagement is blinded or unblinded. The data is captured once, stored under BAA-governed handling, and exported in CMS format on demand for unblinded engagements.

Carevoices’ panelist intake captures all required Sunshine Act fields:

• Full legal name (required for IRS 1099 reporting and Open Payments)
• NPI (auto-validated against the public NPPES Registry)
• State license number (cross-checked against state board databases)
• Primary specialty (selected from CMS taxonomy)
• Work address (validated for completeness)
• W-9 information (for IRS 1099 reporting)
• Payment routing (Stripe Connect bank verification)

For default-blinded engagements, this data stays under BAA-governed handling and is not shared with sponsor. For unblinded engagements (advisory boards, KOL panels), CMS-format export is generated on demand and provided to sponsor for Open Payments filing.

What do generic AI research tools miss about Sunshine Act compliance?

Generic AI research tools were built consumer-first. They don’t capture NPI, state license, or specialty at intake because consumer brands don’t need that data. Adding the capture infrastructure requires:

• NPPES Registry integration for NPI validation
• State board database integration for license verification
• Specialty taxonomy mapping (CMS-standard taxonomy)
• Address validation
• W-9 collection for IRS 1099 reporting
• Stripe Connect integration for payment routing
• CMS-format export pipeline

Most generic AI research tools haven’t made these investments because their consumer-brand customer base doesn’t need them. When pharma sponsors evaluate generic AI research tools for unblinded engagements (advisory boards, KOL panels), the Sunshine Act gap surfaces and disqualifies the vendor — the sponsor cannot file Open Payments reports without the underlying data, and the vendor can’t provide it.

Practical implementation for sponsors

For pharma sponsors evaluating research vendors for healthcare engagements, the Sunshine Act check is part of standard procurement:

1. For blinded engagements (most market research): Confirm the vendor maintains panelist identity confidentiality and that BAA terms support default-blinded structure. Sunshine Act reporting typically doesn’t apply.

2. For unblinded engagements (advisory boards, KOL panels): Confirm the vendor captures NPI, license, specialty, address at panelist intake and can produce CMS-format export by January-February. Vendors lacking this infrastructure cannot support unblinded engagements without significant retrofit.

3. For mixed engagements: Some research engagements have blinded and unblinded components (e.g., quantitative survey blinded, qualitative interviews unblinded). Confirm the vendor can structure data handling per-component to maintain compliance posture.

4. For multi-year engagements: Confirm the vendor’s Sunshine Act data export aligns with sponsor’s existing aggregate spend reporting infrastructure. Some sponsors have pharma-specific tools (Veeva PromoMats, ProcessUnity, similar) that ingest research vendor data — confirm format compatibility.

What the future looks like

CMS expanded Open Payments coverage in 2021 (effective 2022 reporting cycle) to include additional advanced practice providers — physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, certified nurse midwives. The expansion increased reporting volume materially.

Further expansion is plausible in 2027-2028 as healthcare advocacy groups push for broader transparency. Carevoices monitors the regulatory landscape and updates panelist intake to capture data fields likely to come within scope. Pharma sponsors should expect Sunshine Act-equivalent reporting to expand to additional categories of healthcare professionals over time, and structure vendor relationships accordingly.

For now, the practical implication is consistent: capture the Sunshine Act fields at intake regardless of engagement type. When the data is captured, supporting any engagement structure (blinded, unblinded, mixed) is straightforward. When the data isn’t captured, retrofit per-engagement is expensive and slow.