Physician Payment Sunshine Act Final Rule: 45 Day Review Period and Penalties
Applicable manufacturers, applicable group purchasing organizations, covered recipients, and physician owners or investors must have an opportunity to review and submit corrections to the information submitted for a period of not less than 45-days before CMS makes the information available to the public. In no case may this 45-day period for review and submission of corrections prevent the information from being made available to the public.
(2) Notification. CMS notifies the applicable manufacturers, applicable GPOs, covered recipients, and physician owners or investors when the reported information is ready for review.
(i) Applicable manufacturers and applicable group purchasing organizations are notified through the points of contact they identified during registration.
(ii) Physicians and teaching hospitals—
- Are notified using an online postings (including both on the CMS website and the Federal Register), and notifications on CMS's email list serves, and
- May also register with CMS to receive notification about the review processes directly (likely by email)
(iii) The 45-day review period begins on the date specified in the online notification.
In addition to these proposed methods, CMS stated that it will work with physician professional societies and provide the information to applicable manufacturers and applicable GPOs to provide voluntarily to covered recipients and physician owners or investors.
Length of Review and Correction Period
Although CMS finalized the 45-day review period, the agency agreed that there should be a distinct phase for correcting data to resolve disputes since it recognized that it is not practical to resolve disputes initiated at the end of the review and correction period, within the time allotted.
Thus, CMS finalized a 45-day review and correction period, during which covered recipients and physician owners and investors may register and then sign into the CMS secure website and review the data submitted by applicable manufacturers and applicable GPOs on their behalf and choose to dispute certain payments or other transfers of value, or ownership of investment interests. As soon as a dispute is initiated, applicable manufacturers or applicable GPOs may begin resolving the dispute and correcting the data.
Following the end of the review and correction period, applicable manufacturers and applicable GPOs will have an additional 15 days to correct data for purposes of resolving disputes, and after which they may submit (and provide attestation for) updated data to CMS to finalize their data submission. Undisputed data will be finalized for publication after the close of the annual 45-day review and correction period.
Regarding the 15-day period for resolving and correcting disputes following the 45-day review period, CMS recognized that 15 days is not much time for applicable manufacturers and applicable GPOs to resolve disputes submitted late in the review and correction period. CMS stated that the 15-day period to correct data and resolve disputes must be after the 45-day review and correction period. The agency is unable to extend the 15-day dispute resolution period because it would not allow CMS sufficient time to prepare for public posting and the agency cannot delay public posting for the review and correction period.
Only data changes initiated during the 45-day review and correction period and resolved by the end of the 15-day period for dispute resolution will be captured in the initial publication of the current reporting year of data on the public website. Disputes submitted earlier in the review and correction period will have more time to be resolved. In order to try to maximize the successful resolution of disputes and have more accurate data for publication, CMS plans to encourage covered recipients and physician owners and investors to register with the CMS system, review their data and if necessary, initiate disputes as soon as possible within the 45-day review and correction period to maximize the likelihood of successful resolution and accurate data available for publication.
CMS also noted that covered recipients and physicians owners and investors will have the opportunity to review and submit corrections for data updated by applicable manufacturers and applicable GPOs (either in response to a dispute, omission, or other error). There is no limit to the number of times a particular transaction can be reviewed and disputed.
Regarding the review and correction process, CMS finalized its proposal of facilitating the process on a CMS-secure website. CMS is working to develop a system to allow secure registration, data submission data review and submission of corrections processes. Applicable manufacturers and applicable GPOs will only be able to access and review the data they submitted or that was submitted for them within a consolidated report submitted by another covered entity; covered recipients and physician owners and investors will only be granted access to data regarding payments or other transfers of value and/or ownership or investment interests submitted on their behalf.
CMS agreed that it will need to validate the identities of individuals signing on to the website and plans to employ a system that will allow for secure user identification and authorization. CMS also plans to allow physicians and teaching hospitals to register prior to the start of the annual formal review and correction period to establish their profile, allowing them immediate access to the information at the beginning of the formal review and correction period. The secure user-based authentication requires that the actual individual register and interact with the system to ensure the utmost security of the data.
Beyond the process for accessing the information, CMS did not agree that more than 2 years of data should be available for review and correction because CMS wants to ensure that data is “finalized and no longer open to disputes and updates after a certain time period.”
Additionally, CMS agreed that all data from the previous reporting year, including data granted delayed publication should be available for review during the review and correction period following the reporting year. For example, a payment or transfer of value granted delayed publication, but made in 2014 and reported in 2015, would be made available to the covered recipient for review and correction in 2015, but would not be published until the appropriate time for release. CMS said that covered recipients and physician owners and investors, as well as applicable manufacturers and applicable GPOs will be better able to review and correct the data during the period of time immediately following the transaction, rather than years afterward when the data is about to be published.
Finally, CMS intends to provide additional information and guidance on the reporting requirements and timing of data review and correction to help applicable manufacturers, applicable GPOs, covered recipients and physician owners or investors understand how transactions should be reported.
(3) Process.
(i) An applicable manufacturer, applicable group purchasing organization, covered recipient or a physician owner or investor may log into a secure website to view only the information reported specifically about itself.
(ii) Covered recipients and physician owners or investors are able to review data submitted about them for the previous reporting year.
(iii) If the applicable manufacturer, applicable group purchasing organization, covered recipient, or physician owner or investor agrees with the information reported, the applicable manufacturer, applicable group purchasing organization, covered recipient, or physician owner or investor may electronically certify that the information reported is accurate.
(iv) If a covered recipient or physician owner or investor disagrees with the information reported, the covered recipient or physician owner or investor can initiate a dispute, which is sent to the appropriate applicable manufacturer or applicable group purchasing organization to be resolved between the parties.
(v) Covered recipients and physician owners or investors may initiate disputes at any time after the 45-day period begins, but before the end of the calendar year, but any changes resulting from disputes initiated outside the 45-day period, may not be made until the next time the data is refreshed.
(4) Data disputes.
(i) In order to be corrected prior to the publication of the data, applicable manufacturers and applicable group purchasing organizations must notify CMS of resolved disputes and changes to the information submitted by no later than 15 days after the end of the 45-day period (that is, 60 days after the 45-day review period begins).
(ii) Disputes which are not resolved by 15 days after the end of the review and correction period, may still be resolved, but any changes resulting from the disputes may be made until the next time the data is refreshed.
(iii) If the dispute is not resolved by 15 days after the end of the 45-day review and correction period, CMS publicly reports and aggregates the applicable manufacturer's or applicable group purchasing organization's version of the payment or other transfer of value, or ownership or investment interest data, but marks the payment or other transfer of value or ownership or investment interest as disputed.
Dispute Resolution
After reviewing the comments, CMS recognized that it has “a responsibility to facilitate the capability for correcting the data and resolving disputes among the parties.” However, CMS maintained that it should “not be actively engaged in mediating dispute resolutions” because the relationship exists between the applicable manufacturer or applicable GPO, and the covered recipient or physician owner or investor, not CMS.
CMS clarified that it will provide the opportunity for covered recipients, or physician owners or inventors to review and correct the data submitted on their behalf. CMS also “plans to monitor the rate of disputes and resolutions, including whether an applicable manufacturer or applicable GPO has an abnormally high number of disputes or has an abnormally high rate of unresolved disputes.”
When covered recipients and physician owners or investors register and sign on to the secure CMS website, all payments or other transfers of value, and all ownership or investment interests, submitted on their behalf will be available for review. The covered recipient or physician owner or investor will be responsible for reviewing each payment or other transfer of value, or ownership or investment interest, and will be able to initiate a dispute on a particular transaction, if he/she chooses. If a covered recipient or physician owner or investor decides to initiate a dispute, he or she will be directed to fill out electronic fields detailing the dispute, including the proposed corrections.
The system will automatically flag that the transaction was disputed and the system will notify the appropriate applicable manufacturer or applicable GPO of the dispute, detailing the information submitted by the disputing covered recipient or physician owner or investor. The applicable manufacturer or applicable GPO and physician or teaching hospital will then be responsible for resolving the dispute, after which the applicable manufacturer or applicable GPO will be responsible for submitting corrected data and re-attesting to the new data by the end of the 15-day resolution period.
If a dispute cannot be resolved in this time, the parties may and should continue to work to reach resolution and update the data. However, CMS will continue to move forward with publishing the original and attested data, but will mark it as disputed.
If an applicable manufacturer or applicable GPO submits updated data to resolve dispute(s), the applicable manufacturer or applicable GPO must re-attest to the timeliness, accuracy, and completeness of the data, as required during the original data submission. If an applicable manufacturer or applicable GPO does not update its data at the end of the correction period, then its original attestation will be used. CMS said the re-attestation is important to ensure that data changed during the review and correction period is accurate.
Recognizing that there may be situations when the “cost of initiating and resolving a dispute may not be worth the potential benefits,” CMS stated that it will “monitor the volume and terms of disputes and resolutions, and plan[s] to provide additional guidance regarding situations when the cost of resolving a dispute may outweigh the benefits.”
Finally, since CMS is neither requiring, nor managing the pre-submission review process, it does not believe there should be any connection between any pre-submission processes and the CMS processes for data submission and review and correction. For example, CMS will not restrict a physician who reviewed and approved a payment in the pre-submission review from disputing such payment or other transfer of value during the CMS process for review and correction, since CMS will not know whether the physician received an opportunity to pre-review the payments or the result of his/her pre-review.
(h) Errors or omissions.
(1) If an applicable manufacturer or applicable group purchasing organization discovers an error or omission in its annual report, it must submit corrected information to CMS immediately upon confirmation of the error or omission.
(2) Upon receipt, CMS notifies the affected covered recipient or physician owner or investor that the additional information has been submitted and is available for review.
CMS updates the website at least once annually with corrected information.
CMS recognized that “publishing both accounts of a disputed transaction would be misleading” and would “not be useful for end users of the data.” CMS also agreed that “any disputed transactions that have not yet been resolved should be labeled as such, but that only a single account of the transaction should be listed on the public website.”
However, CMS did “not agree that disputed transactions should not be published publicly until they are resolved,” because “this method would potentially create an incentive for covered recipients and physician owners or investors to dispute each transaction of the public website to prevent them from being made public.”
Instead, CMS stated that “publication of disputed transactions will incentivize the parties to resolve disputes in a timely manner” and that the interest “to only publish accurate and undisputed information will push all parties to actively resolve disputes.” Thus, CMS finalized “that on the public website, payments or other transfers of value or ownership or investment interests that cannot be resolved by the end of the 15-day resolution period will be marked as “disputed,” but the applicable manufacturer's or applicable GPO's most recent attested data subject to the dispute will be the only account of the information published.
CMS said that publishing the most recent attested account by the applicable manufacturer or applicable GPO (rather than the corrected account provided by the covered recipient or physician owner or investor during the review and correction period) is appropriate because applicable manufacturers and applicable GPOs are responsible for collecting, reporting, and attesting to the accuracy of the information and are subject to penalties for failure to report. The parties may continue to resolve disputes after the close of the resolution period and after the data has been published publicly, or may leave the data as disputed; however, CMS “discouraged leaving data as disputed and advocate for timely dispute resolution.”
CMS agreed that it has “a responsibility to allow for updates to the data more frequently than once a year during the formal 45-day review and correction period and 15-day resolution period, particularly given the short time period for the data to be reviewed and updated.” CMS noted that “some disputes will not be resolved in time for updated data to be included in the public data release for that reporting year, but will be resolved and require changes thereafter. These should not be incorrectly listed on the website for a whole year, when they have in fact been resolved.”
Nevertheless, CMS recognized that it does not have the “resources to make continual changes to the website and should not be required to continually update the data.” Accordingly, CMS said it will update the “current and a previous year's data at least once annually, beyond the initial data publication following the submission of the data.”
Similarly, CMS said “that covered recipients, and physician owners or investors should be allowed to review and dispute the contents of the public website throughout the year.” After registering with the CMS system, physicians and teaching hospitals, and physician owners and investors may sign in to the system to review or dispute officially submitted and attested transactions any time during the year. However, any disputes and subsequent updates initiated and resolved outside the 45-day review and correction period and 15-day resolution period “may not be reflected on the public website until the next update of the data.”
CMS said this “fairly allows covered recipients and physician owners or investors control over reviewing and correcting their data at all times, but does not require [CMS] to make continual changes to the published data. This system will also allow covered recipients and physician owners and investors the opportunity to easily and efficiently review (and dispute, if necessary) data updated and re-submitted by an applicable manufacturer or applicable GPO.
While CMS understood that applicable manufacturers, applicable GPOs, covered recipients, and physician owners or investor may want to investigate errors internally
before notifying CMS of errors or omissions, CMS said “that errors and changes need to be reported to [CMS] as soon as possible so that [CMS] has the most accurate
information possible.” CMS reiterated the responsibility that applicable manufacturers or applicable GPOs have to provide information to CMS “immediately after confirming that an update is needed or an error needs to be corrected; failure to do so may be considered incomplete reporting and may give rise to penalties.”
Penalties
(a) Failure to report.
(1) Any applicable manufacturer or applicable group purchasing organization that fails to timely, accurately or completely report the information required in accordance with the rules established under this subpart is subject to a civil monetary penalty of not less than $1,000, but not more than $10,000, for each payment or other transfer of value or ownership or investment interest not reported timely, accurately, or completely.
(2) The total amount (maximum) of civil monetary penalties (CMP) imposed on each applicable manufacturer or applicable group purchasing organization (regardless of whether the applicable manufacturer was a part of a consolidated report) with respect to failures to report in an annual submission of information will not exceed $150,000.
Of importance, CMS finalized that a CMP may be imposed for failure to report information in a timely, accurate, or complete manner. “This includes failure to report timely or accurately an entire transaction, as well as failure to report timely or accurately certain fields related to a transaction. For example, this could entail reporting an erroneous payment amount or not reporting that an ownership or investment interest was held by an immediate family member of a physician.”
(b) Knowing failure to report.
(1) Any applicable manufacturer or applicable group purchasing organization that knowingly fails to timely, accurately or completely report the information required in accordance with the rules established under this subpart is subject to a civil monetary penalty of not less than $10,000, but not more than $100,000, for each payment or other transfer of value or ownership or investment interest not reported timely, accurately, or completely.
(2) The total amount (maximum) of civil monetary penalties imposed on each applicable manufacturer or group purchasing organization (regardless of whether the applicable manufacturer was a part of a consolidated report) with respect to knowing failures to report in an annual submission of information will not exceed $1,000,000.
(c) Total annual civil monetary penalties. The amount of CMPs imposed on each applicable manufacturer or applicable group purchasing organization are—
(1) Aggregated separately;
(2) Subject to separate aggregate totals under paragraphs (a)(2) and (b)(2) of this section, with a maximum combined annual total of $1,150,000.
It is important to note that CMS revised the final regulation “to clarify that the penalties imposed for failures to report and knowing failures to report will be aggregated separately and are subject to separate aggregate totals, with a maximum combined annual total of $1,150,000. In addition, CMS finalized that the procedures in 42 CFR 402 subpart A and subpart B will apply with regard to imposition, appeal, and collection of CMPs.
(d) Determinations regarding the amount of civil monetary penalties. In determining the amount of the civil monetary penalty, factors to be considered include, but are not limited to, the following:
(1) The length of time the applicable manufacturer or applicable group purchasing organization failed to report, including the length of time the applicable manufacturer or applicable group purchasing organization knew of the payment or other transfer of value, or ownership or investment interest.
(2) Amount of the payment the applicable manufacturer or applicable group purchasing organization failed to report.
(3) Level of culpability.
(4) Nature and amount of information reported in error.
(5) Degree of diligence exercised in correcting information reported in error.
(e) Record retention and audits.
(1) Maintenance of records.
(i) Applicable manufacturers and applicable group purchasing organizations must maintain all books, contracts, records, documents, and other evidence sufficient to enable the audit, evaluation, and inspection of the applicable manufacturer's or applicable group purchasing organization's compliance with the requirement to timely, accurately or completely submit information in accordance with the rules established under this subpart.
(ii) The items described in paragraph (e)(1)(i) of this section must be maintained for a period of at least 5 years from the date the payment or other transfer of value, or ownership or investment interest is published publicly on the website.
CMS acknowledged that this policy “may require the records to be retained for up to 9 years” because of payments or other transfers of value eligible for delayed publication. In addition, CMS clarified that the “requirements set forth in this final rule are in addition to, and do not limit, any other applicable requirements that may obligate applicable manufacturers or applicable GPOs to retain and allow access to records.”
(2) Audit. HHS, CMS, OIG or their designees may audit, inspect, investigate and evaluate any books, contracts, records, documents, and other evidence of applicable manufacturers and applicable group purchasing organizations that pertain to their compliance with the requirement to timely, accurately or completely submit information in accordance with the rules established under this subpart.
CMS reiterated that it and the HHS OIG are authorized to impose CMPs and both agencies will have the ability to investigate failures to report timely, accurately or completely.
(3) These requirements are in addition to, and do not limit, any other applicable requirements that may obligate applicable manufacturers or applicable group purchasing organizations to retain and allow access to records.
For corrections made during the review and correction, and dispute resolution periods, CMS stated that it wants “applicable manufacturers and applicable GPOs to correct any errors they have submitted without fear of alerting CMS to errors that will be subject to penalties; however, CMS does not want to allow applicable manufacturers to submit grossly inaccurate or incomplete data by the original submission date without risk of sanction.” Accordingly, CMS is requiring applicable manufacturers and applicable GPOs to attest the timeliness, accuracy, and completeness of their original submission to CMS prior to the review and correction period.
Applicable manufacturers and applicable GPOs should make a good faith effort to ensure that the original data submitted to CMS is correct. CMS does not intend that errors corrected during the review and correction, and dispute resolution periods will be subject to penalties for failure to report in instances when the original submission was made in good faith.
Outside the period of time when applicable manufacturers and applicable GPOs will be required to re-attest after the submission of updated or new data, “any errors or omissions will be considered failures to report timely, accurately, or completely, and will be subject to penalties.”
Penalties for Consolidated Reports
For consolidated reports, CMS explained that the applicable manufacturer actually submitting the consolidated report and signing the attestation will be subject to the maximum penalties (based on unknowing and knowing failures to report) for each individual applicable manufacturer included in the consolidated report.
For example, an applicable manufacturer submitted a consolidated report for itself (Company A) and two other applicable manufacturers (Subsidiary B and C). CMS discovers six instances of a failure to report a payment or other transfer of value in Company A's submission (each penalized at $10,000), seven instances of a knowing failure to report in Subsidiary B's submission (each penalized at $100,000) and finally nine knowing instances of failure to report (each penalized at $100,000) in Subsidiary C's submission. Company A, as the submitter and attester of the data, would be subject to a penalty of $60,000 for Company A's failure to report, $700,000 for Subsidiary B and $900,000 for Subsidiary C.
Company A would be subject to the penalties for knowing failure to report from both Subsidiary B's and Subsidiary C's submissions even though the penalties together exceed $1,000,000, because CMS interprets “the maximum to apply individually to each applicable manufacturer's submission, even if the submission is contained within a consolidated report.” CMS reiterated that “each applicable manufacturer should be subject to the same maximum penalties regardless of whether it submits individually, or as a part of a consolidated report.”