Sunshine Act compliance: Requirements, thresholds, and deadlines

Sunshine Act compliance means reporting payments and transfers of value to physicians, certain non-physician practitioners, and teaching hospitals to the Centers for Medicare & Medicaid Services (CMS) through Open Payments. Applicable manufacturers and group purchasing organizations (GPOs) file once a year, and the submission usually lands with a finance or compliance lead.

For program year 2026, you need to know what counts, where the de minimis thresholds sit, and when each deadline hits.

What is the Sunshine Act?

The Physician Payments Sunshine Act is Section 6002 of the 2010 Affordable Care Act, which requires drug and device makers to disclose payments to providers. CMS runs it as the Open Payments program. The SUPPORT Act of 2018 expanded it to cover several types of non-physician practitioners.

The law exists so patients and researchers can see the money that flows between industry and the people who prescribe and recommend products. CMS posts every reported record on the public Open Payments search site, searchable by provider name.

State laws can add their own disclosure rules on top of the federal one. The federal law preempts state laws only where they require the same type of information from manufacturers. States can still demand different data, reports from other parties, or public health filings.

Your federal filing won't satisfy those state rules for you.

Sunshine Act vs. Open Payments

The Sunshine Act is the statute, and Open Payments is the CMS program and database that carry it out. You'll see both terms in guidance, contracts, and audit requests.

When a colleague says "Open Payments deadline" and another says "Sunshine Act deadline," they mean the same filing.

Sunshine Act reporting requirements

You must report if you're a covered entity making payments or transfers of value to covered recipients above the de minimis thresholds. Each part of that test has its own definition, and missing any one of them changes what you file.

Who must comply: Covered entities

An applicable manufacturer is any entity operating in the US that makes a covered drug, device, biological, or medical supply. A product is covered when Medicare, Medicaid, or CHIP pays for it. Drugs and biologics must also require a prescription, and devices must require FDA premarket approval or notification.

The rules reach past the manufacturer itself. Affiliates under common ownership, foreign manufacturers selling in the US, and GPOs all report. Physician-owned distributors (PODs) are a subset of manufacturers and GPOs.

If the 10% rule applies, you still register and file, only for fewer payments.

Who you report on: Covered recipients

Covered recipients are physicians, teaching hospitals, and five types of non-physician practitioners defined in 42 CFR 403.902. The SUPPORT Act added the non-physician practitioners, with reporting on them starting with 2021 data.

• Physicians: MDs and DOs, dentists, podiatrists, optometrists, and chiropractors
• Physician assistants: PAs in any specialty
• Nurse practitioners: NPs in any specialty
• Clinical nurse specialists: CNSs in any specialty
• Anesthesia providers: Certified registered nurse anesthetists and anesthesiologist assistants
• Certified nurse-midwives: CNMs in any practice setting
• Teaching hospitals: Hospitals on the CMS teaching hospital list for the program year

Two groups fall outside the definition. Medical residents aren't covered recipients, and neither are covered recipients who are bona fide employees of your company. Paying your own staff physician a salary creates no Open Payments record.

What's reportable: Natures of payment

You report direct and indirect payments and transfers of value, including payments to a third party at a covered recipient's request. Research payments go in a separate file, and you can ask CMS to delay their publication. Physician ownership and investment interests get their own report.

CMS sorts payments into 18 nature-of-payment categories, and every record needs one. CMS treats its own examples as illustrative, so match each payment to the category that fits its purpose.

Several items stay out of your file entirely under 42 CFR 403.904(i). Product samples for patient use, including coupons and vouchers, are excluded. So are educational materials that directly benefit patients, device loans of 90 days or less, discounts and rebates, and publicly traded stock or mutual funds.

A wrong category puts an inaccurate record on a public site under your company's name.

De minimis thresholds for 2026

For program year 2026, CMS excludes individual payments under $13.82 unless a recipient's annual total exceeds $138.13. Program year 2026 runs Jan 1–Dec 31, 2026. Once a recipient crosses the aggregate, every payment to that recipient is reportable, including the small ones.

CMS adjusts both thresholds each year using the Consumer Price Index. You add up payments across all nature-of-payment categories when you test the aggregate. CMS has already posted the upcoming 2027 thresholds of $14.31 and $143.01.

Twelve $12 lunches for one physician add up to $144, which makes every one of them reportable.

Sunshine Act meal limits and travel rules

Under the Sunshine Act, you value each meal per covered recipient who ate, and the de minimis thresholds apply. Federal law sets no dollar cap on meals. Your limits come from industry codes such as PhRMA and AdvaMed and from your own life sciences expense policy.

Meals, travel, and lodging make up most reported transactions, so the valuation rules matter. Under 42 CFR 403.904(g), you split a group meal's cost across everyone who ate when you can't identify each person's cost. To value and attribute a group meal:

1. Record the total cost of the meal from the receipt.
2. Count everyone who ate, including attendees who aren't covered recipients.
3. Divide the total cost by that headcount to get the per-person value.
4. Assign the per-person value to each covered recipient who ate, and skip anyone who didn't partake.
5. Add each value to that recipient's year-to-date total and check it against the thresholds.

Some meals don't need a record at all. Buffet meals, snacks, soft drinks, and coffee generally available at large-scale conferences are exempt. Sub-threshold payments at large-scale or public events also don't count toward a recipient's aggregate.

Travel and lodging you pay for a covered recipient go under the Travel and lodging category, attributed to that recipient.

Indirect payments count too. If you require or direct a third party to pay a covered recipient, you report it. You also report payments made to a third party at a recipient's request or on their behalf.

You're excused from reporting an indirect payment only if you don't know the recipient's identity. CMS tests that knowledge through the end of the second quarter of the following year. Meal data is only as good as the attendee list, so your reps need to tag every HCP who attended when they pay.

Sunshine Act reporting deadlines and the annual calendar

You typically submit and attest prior-year data between Feb 1 and March 31. The cycle starts with data collection over the calendar year and ends with corrections after CMS publishes. CMS posts the exact dates for each cycle on its Open Payments program timeline, so confirm them there before you plan.

A dispute that misses the correction window goes public marked as disputed, so build the window into your Q2 calendar.

How to handle disputes and post-submission corrections

Disputes and corrections follow a fixed order: monitor, resolve, resubmit, and document. CMS doesn't mediate any of it, so your team owns each step.

1. Monitor disputes during the review period

Covered recipients typically review and dispute records from April 1 through May 15. Assign one owner to watch for new disputes in the Open Payments system during that window. Pull the receipt, attendee list, and coding for each disputed record as soon as it arrives.

2. Resolve with the covered recipient and correct the record

You settle each dispute directly with the physician or teaching hospital. If the recipient is right, correct the record during the correction window, which typically runs through about May 30. If you can't agree, the record still publishes and carries a disputed flag.

3. Resubmit and re-attest corrected data

Every correction goes back into the Open Payments system as a resubmission, followed by a new attestation. Recipients can typically raise disputes through Dec 31. Changes made after the correction window show up in the early-year refresh or the next annual publication.

4. Document the reason for any record deletion

Since program year 2023 data, CMS disallows record deletions without a substantiated reason. You can remove a record only if it was an error or meets a reporting exception. Keep audit-ready support for every record, deleted or not.

If you can't show why a record changed, you'll have a hard time defending it in an audit.

Penalties for Sunshine Act noncompliance

Civil monetary penalties apply per unreported payment, with separate annual caps for failures you didn't know about and for knowing failures. HHS normally adjusts these amounts for inflation each year. HHS made no adjustment for 2026, so the 2025 inflation-adjusted amounts still apply.

A knowing failure includes deliberate ignorance and reckless disregard, and no intent to defraud is required. Penalty amounts depend on how long the failure lasted, the amount involved, and your level of culpability. CMS can also audit reporting entities, so your Sunshine Act compliance records should show how you identified each recipient and categorized each payment.

Poor records can turn an honest miss into reckless disregard, which lands in the knowing tier.

Where spend controls fit in Sunshine Act compliance

Your expense platform can capture and code each HCP payment as it happens. Filing and legal calls stay in the CMS system with your compliance team. Splitting Sunshine Act compliance this way sends clean data into a process your compliance team still controls.

Attestation, dispute resolution, and legal judgment stay with your compliance team. With clean capture, they start Q1 with finished records to review.

Capture Sunshine Act data at the point of spend with Ramp Expense Management

Most Open Payments cleanup starts with a meal that a rep paid for without recording who attended. Rebuilding attendee lists and NPIs from receipts months later slows your Q1 review and invites matching errors.

Ramp Expense Management captures Sunshine Act data on each expense as your reps spend. Ramp added Sunshine Act tracking so reps tag HCP attendees from an NPPES-powered provider registry that Ramp updates weekly. Reps then code nature of payment, form of payment, and related products per expense.

Finance tracks year-to-date transfers of value per HCP across card and reimbursement spend, then exports CMS-formatted CSV files at year-end.

With Ramp, Sunshine Act data capture looks like this:

• Enforce HCP policy before spend: Policy Agent, an always-on AI reviewer trained on your real policy, checks meal and HCP spend before it happens.
• Capture receipts automatically: Reps send receipts by text, email, Slack, or the mobile app, and each one attaches to its transaction.
• Review only real exceptions: Policy Agent reviews every expense and sends your team only the genuine exceptions.

Your compliance team still handles the CMS submission, attestation, and disputes. Ramp prepares the data for life sciences finance teams, and your team files it.

See how Ramp prepares your Open Payments data on the platform more than 85,000 businesses use to save over $1 billion a month.