What Is the Sunshine Act? A Guide to Open Payments

The Sunshine Act is the common name for the Physician Payments Sunshine Act, a federal law that makes drug and device company payments to clinicians public.

Congress passed it in 2010 as Section 6002 of the Affordable Care Act, and the Centers for Medicare & Medicaid Services (CMS) runs it as the Open Payments program. The law requires disclosure but does not prohibit industry payments, and CMS states that a published payment does not by itself signify an inappropriate relationship.

Other laws use similar names. The Government in the Sunshine Act of 1976 covers open federal agency meetings, and the Sunshine Protection Act concerns daylight saving time. Neither deals with payments to clinicians.

Manufacturers and group purchasing organizations file the reports, and clinicians are the subjects of them, so your practice does not submit anything to CMS. Your organization still has an oversight role: tracking which industry relationships your clinicians have, confirming they follow internal policy, and keeping records that show each one was reviewed.

Two kinds of companies report under the Physician Payments Sunshine Act. Applicable manufacturers make a drug, device, biological, or medical supply covered by Medicare, Medicaid, or the Children’s Health Insurance Program (CHIP). Under 42 CFR 403.902, a company under common ownership with a manufacturer also counts when it helps produce, market, sell, or distribute those products.

Group purchasing organizations (GPOs) report their payments to clinicians and any ownership interests that physicians or their families hold in the GPO.

In Open Payments, “physician” includes licensed doctors of medicine and osteopathy, dentists, podiatrists, optometrists, and chiropractors, but not medical residents. CMS’s Program Year 2025 publication includes records for 667,898 physicians and 1,327 teaching hospitals.

The 2018 SUPPORT Act added physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, anesthesiologist assistants, and certified nurse-midwives. According to the CMS Open Payments glossary, the expansion took effect in January 2021. Program Year 2025 data includes records for 362,261 of these clinicians.

Penalties apply only to reporting entities. Under 42 CFR 403.912, a company that fails to report completely, accurately, and on time faces $1,000 to $10,000 per payment, up to $150,000 a year, and up to $1,000,000 a year for knowing failures. HHS adjusts these amounts for inflation.

Clinicians face no penalties under the Sunshine Act itself, although other laws, such as the federal Anti-Kickback Statute, still apply to the underlying payments.

Open Payments tracks three categories: general payments, research payments, and ownership or investment interests.

For Program Year 2025, CMS excluded individual payments under $13.46 unless a company’s total payments to the same clinician exceeded $134.54 for the year. CMS adjusts both amounts annually.

General payments cover everyday contact such as consulting fees, honoraria, speaking fees, meals, travel, education, and gifts. CMS lists every type of payment it tracks.

General payments totaled $3.92 billion in Program Year 2025 and are the entries most practices see most often.

Research payments are tied to a written research agreement or study protocol, such as clinical trial funding. They totaled $9.50 billion in Program Year 2025, the largest category.

This category covers stock, partnership shares, and similar interests that a physician or an immediate family member holds in a manufacturer or GPO. It totaled $1.25 billion in Program Year 2025. Under 42 CFR 403.902, interests in publicly traded securities and mutual funds are excluded.

Practices sometimes overlook this category, but a spouse’s stake in a device company still appears in the public record.

Your clinicians’ Open Payments records are public, and anyone can search them by name on the CMS website.

Patients, journalists, researchers, health plans, and hospital credentialing teams all use the search tool, which holds program years 2019 through 2025.

Most entries are small and routine. Reviewing them matters because a company might attribute a payment to the wrong clinician, and CMS publishes what companies attest to until someone disputes it.

Disclosure does not make a payment lawful. The federal Anti-Kickback Statute prohibits knowingly offering or accepting anything of value to induce referrals of federal healthcare program business. Your own documentation, such as a written agreement and fair market value support, shows whether an arrangement was appropriate.

Pulling that documentation together is faster when disclosures, agreements, and related training records sit in one compliance program. See how Compliancy Group connects those records.

Open Payments runs on a fixed annual cycle, and the main review window for clinicians opens on April 1 each year.

The table shows each phase as CMS describes it.

Use the table to set compliance calendar reminders for April 1 and early July.

If you dispute a record between April 1 and May 15 and the company does not resolve it by May 30, CMS publishes the record and labels it disputed. Disputes started later do not appear in the June publication.

For Program Year 2025 data, the post-publication window closes on December 31, 2026, and CMS plans to refresh the data in early 2027.

For a provider organization, Sunshine Act compliance comes down to oversight. Treat Open Payments as one input alongside your own disclosures, policies, and records.

Assign each step below to a named person, such as the practice manager or compliance officer.

Clinicians register through the CMS Enterprise Portal and the Open Payments System, and can nominate an authorized representative, such as a practice manager, to review and dispute records for them. Register well before April 1.

During the April 1 to May 15 window, compare every record with your internal log and each clinician’s conflict of interest disclosure. A payment missing from a disclosure deserves a conversation with the clinician, since it can point to a relationship your organization has not reviewed. Dispute inaccurate records in the Open Payments System, then contact the reporting company.

Check again after the June publication, since you have until December 31 to raise new disputes.

Log sponsored meals, consulting and speaking agreements, honoraria, travel, and equipment loans with the date, company, attendees, and amount. A shared spreadsheet works for many small practices, though records tend to scatter as headcount grows.

A written conflict of interest (COI) policy should require every employed clinician to disclose industry relationships, including consulting, speaking, research, and family ownership interests, at hire and at least once a year.

Have the compliance officer review each disclosure and decide whether a relationship needs management, such as a fair market value review of a consulting agreement or recusal from purchasing decisions involving that company. Keep disclosures and review notes with the attested policy version, which supports two of the OIG’s seven elements of an effective compliance program: written policies and procedures, and auditing and monitoring.

The steps above work best when policies, attestations, and review records stay connected over time. You can add your conflict of interest policy to The Guard’s policy management and track which staff attested to each version.

The Guard, Compliancy Group’s healthcare compliance software, connects that policy work with training records, incident reports, and exclusion screening.

When a disclosure raises a question your team has not handled before, advisory services give you access to compliance experts.

We work with physician practices, hospitals, and healthcare organizations of every size.

Compliancy Group does not pull, reconcile, or dispute Open Payments data or file manufacturer reports.

Open Payments shows what companies reported about your clinicians. Your organization still needs its own record of who disclosed each relationship, how compliance reviewed it, and which policy applied, so you can answer a patient, a credentialing team, or an auditor.

Compliancy Group is the platform for healthcare compliance programs. It keeps conflict of interest policies, attestations, training, and incident records in one connected system, with advisors available when a relationship needs a second opinion.

See how that program would work for your organization.

Request a Demo