The Sunshine Act: A Tough Act to Follow?

Executive Summary

The Physician Payments Sunshine Act will require companies to record any physician payments or benefits provided in 2013 and to annually report this information to the Secretary of Health and Human Services (HHS) beginning March 31, 2014. This new requirement is expected to present formidable challenges since most companies currently use multiple systems to capture HCP payments and benefits.

For example, physician meals and other small expenses flow through a company’s expense reporting system while big ticket items (e.g.,research grants, consulting fees) are managed through accounts payable or other enterprise systems. In most companies, approximately 80% of HCP transactions are recorded in the expense system, although these transactions comprise only 20% of the total HCP spend.

Not surprisingly, the Sunshine Act is prompting considerable activity in the Life Sciences industry. Companies must understand the law and its exact requirements. They should balance compliance with the administrative burden. In addition, companies need to modify enterprise systems to ensure information is accurately captured and recorded.

Efforts to address this law require cross-functional coordination with Finance, Compliance, Meetings, IT, Legal, Sales, and Travel departments. Typical questions that arise during these initial discussions include:

  • What is the Sunshine Act and what are the company’s legal requirements?
  • How do we get started?
  • How do we organize and manage the large amounts of HCP data
  • What business processes and systems are involved?
  • How can we track the aggregate spend so the company does not exceed HCP thresholds?

Some companies may attempt to respond to these requirements with minimal effort and organizational change. Yet, failure to produce a scalable, auditable and repeatable process will result in confusion and will lead to errors, audit failures, and potential fines. Companies also need to consider how other global legislation and the FCPA (Foreign Corrupt Practices Act) will impact these processes. This paper summarizes a recommended approach and provides strategic guidance to help companies comply with the Sunshine Act.

This paper summarizes a recommended approach and provides strategic guidance to help companies comply with the Sunshine Act.

How Do We Get Started?

Acquis recommends a five-step process to successfully execute business process changes. Companies with existing HCP reporting solutions also benefit from a review of their reporting strategy to ensure the new laws are met most effectively.

  1. Understand & Interpret HCP Requirements: The first step is to understand the new HCP laws and how they differ from the company’s current process. Companies should engage the Legal and Audit departments to ensure company-specific requirements are also incorporated.
  2. Identify Business Owners & Align Requirements: The next step is to kick-off the project with the various business owners in order to confirm where and how HCP expenditures occur. It is essential to have a strong project team leader and executive support to ensure necessary buy-into implement system and process changes.
  3. Map Requirements to Applications: In the third step, business owners and key stakeholders explain how they currently track HCP spend, which systems are used, and what information is captured. Requirements need to be addressed from both a process and systems perspective
  4. Design & Update Business Processes & Systems: After business owners and key stakeholders determine company-specific requirements, legal obligations, and additional data needs, the project team leader works with appropriate team members to obtain approvals and execute necessary changes to business processes and systems. The design approach for system modifications and process updates should consider the full lifecycle of the process and minimize impacts to the user.
  5. Conduct User & Business Change Management: Finally, companies need to educate employees about the legal requirements and corporate responsibilities, and clarify expectations regarding employee compliance. Due to the number of processes that maybe impacted, a focus on strong collaboration between the various stakeholders is required from the beginning of the entire process.

The remaining sections of this document address the 5-step process in detail.

Step 1: Understand and Interpret HCP Requirements

What is the regulation?

On March 22, 2010, the Physician Payment Sunshine Provision legislation passed. The Act states that any drug, device, or medical supply manufacturer operating in the United States must report any payment or benefit given to a physician. Payments under $10 are excluded, but only if the total spent on that HCP is less than $100 annually. Companies must begin recording this information by August 1,2013. The first report must be filed with the Health and Human Services (HHS) Secretary by March 31, 2014 (subsequent reports will be due at the end of March each year). Companies need to act quickly to accommodate the planning, system and process changes, testing,and change management required. Reports must be electronic, easily downloadable, and searchable. The following table identifies the information that must be included in each report:

Penalties for non-compliance

Companies will incur a monetary penalty of $1,000-$10,000 for each payment not reported (not to exceed $150,000 annually). Intentionally failing to report will result in a penalty of $10,000-$100,000 for each payment (not to exceed $1,000,000 annually).

State laws

Adding to the report complexity, several states have additional laws that must be followed. The following table illustrates state-specific regulations:

Rules are changing: The need for Legal

Corporate legal departments can and should assist in reviewing applicable federal and state laws. Some companies may also be subject to specific rules or a Pharma code (voluntary or mandated by the state) that also impact required changes. For example, a state’s Pharma code may require a company to determine a spending threshold for each doctor. In that case, the company needs to determine aggregate spend by doctor and notify employees so they do not exceed the limits.

Even after all requirements are defined,the company should adopt a regular review cycle with Legal and Compliance to remain current with all regulatory changes.

Step 2: Identify Business Owners and Align Requirements

When does my company spend money on HCPs and which groups manage it?

When a company reviews HCP spend activity, it will discover that the business processes behind these interactions are supported by many different operating groups and business units. Some of the typical stakeholders and corresponding areas related to HCP compliance reporting include:

The individuals in the departments listed above can identify which activities involve the exchange of payment and goods to an HCP. Below is a sample list of spend activities:

How do we organize and kick-off the project?

The number of required stakeholders makes HCP compliance reporting a difficult initiative to manage. Therefore, the company should first create a steering committee with oversight of this effort to expedite decision-making and to ensure the use of a holistic strategy that addresses short-term and long-term risks and goals.

Next, the company should identify a project team leader, who will be responsible for coordination between all of the stakeholders. This individual is typically someone in the Finance or Compliance organization.

Finally, key individuals from the business organizations identified in Figure 2 should be assigned to the team under the direction of the project team leader. These individuals will be responsible for obtaining information from their departments. It is critical to involve a resource from IT at this stage since various systems will be impacted. In order to achieve the goal of transparency and reporting, the underlying solutions must be driven by efficient technology.

The project team leader and team members are responsible for reviewing the lifecycle/process of all HCP spend activities, identifying the applications that support these activities, and defining what type of spend will be consolidated and reported from each system. They also need to help develop and generate buy-in for a solution that meets the needs of the organization. Engaging the steering committee at this point is a critical step.

Acquis recommends creating a flexible solution that will accommodate changing laws and requirements. For global companies, HCP spend tracking requirements must also be addressed in international locations since they are quickly adopting HCP policies similar to those in the US. These companies must also consider data privacy issues that may arise in countries outside of the US.

Step 3: Map Requirements to Applications

What systems are behind the identified business processes?

There are many applications that support the business processes related to HCP spend.The goals of the review process are to understand what spend categories are captured in which systems and what key data fields will be used for reporting (e.g., expense type, transaction ID, transaction date,transaction amount, attendee data, etc.). Some of the key applications that typically relate to HCP reporting are:

Acquis recommends the following process as an effective way to illustrate the entire HCP spend cycle:

  • List all spend activities where the company interacts directly or indirectly through exchange of goods, information or materials with an HCP (e.g., a sales call)
  • List all spend types (e.g., travel, meals) associated with the identified activities
  • List the applications that track this spend (e.g., sales force automation, expense reporting system)
  • List the reportable data elements that appear in each system (e.g., attendees, product, transaction amount)

Below is an example:

Once the company has a view of all applications and data elements, it needs to understand how the data elements relate to the spend types. For example, can a meal be tied to multiple attendees or products? Can attendees be tied to specific products? In addition, the company needs to determine the gaps between the current state and the required future state. This type of information should be communicated to the technical team for design purposes.

Step 4: Design & Update Business Processes and Systems

Which systems does my company need to modify?

Companies will most likely need to modify applications that track spend to ensure that each application links the information back to the HCP “golden” record. The golden record contains the correct, complete, and unique information for each HCP. Many companies store the HCP golden record and consolidated data in a centralized reporting warehouse that acts as the system of record rather than tracking changes in the source applications.

At the most basic level, all companies shouldfollow the process below:

Use of a unique identification number is required for each attendee to accurately report the HCP spend. Frequently, companies use the Specialty and National Physician Index Number (NPI #) and /or a company assigned Unique Identification Number.

High level modifications to the applications usually involve the addition of data fields or lists to track attendees, creating the ability to link the spend to the appropriate HCP. More extensive functionality involves adding the ability to search, add and modify the attendee lists, and creating “play lists” for frequently used attendees.

How do companies typically associate HCP data with spend?

While every company may approach the solution differently, the fundamentals are the same. Companies need to update their business processes and systems to be able to aggregate all spend for each HCP.

While every company may approach the solution differently, the fundamentals are the same. Companies need to update their business processes and systems to be able to aggregate all spend for each HCP.

Regardless of the approach, an HCP “golden record” is the key to ensuring a company has accurate, reportable data. Although HCP lists can be purchased, the data also needs to be validated, updated, and maintained. Due to timeline constraints, most companies adopt a quick solution that allows them to link the spend directly to the HCP record. Companies simply import the list of attendee data into all relevant applications and the employee selects the attendee name in each system. In the figure below, the HCP / Attendee data is imported into meeting and event planning systems as well as expense reporting, accounts payable, and other systems.

The employee selects the appropriate attendees when planning the meeting or event, as well as when expensing and invoicing for the event. The spend data is then exported into a data warehouse for reporting.

Should my company purchase a listing of HCP professionals?

Every company needs a listing of HCP information (e.g., provider #, name, address) to associate with the spend data. There are many potential sources of HCP professional data, including data that is available internally:

  • Customer relationship management systems / sales force applications
  • Vendor data available through the accounts payable process
  • Attendee data in the expense management application

Many companies purchase a listing of HCP data from a vendor and merge it with their existing data to create a more accurate and complete list. A sample list of the major providers includes Cegedim Dendrite, HMS and IMS. Many of these suppliers not only provide HCP data but also compliance reporting and HCP data validation services.

What is the best way for employees to search the list of attendees?

The volume of HCP records greatly impacts the performance of some applications. Solutions can be applied to make this process easier for the employee. Some examples include:

  • Using pre-filters that identify data relevant to the transaction (e.g., sales rep territories associated with certain HCPs)
  • Adding fields that will help the search process (e.g., license number, profile number, prescriber ID)
  • Ensuring the information presented will assist with the search (e.g., HCP license and office addresses)
What if the HCP/Attendee list is not up to date or is missing records?

A process must be put in place to handle ad-hoc additions of attendee information that has not been validated for duplication, accuracy or a central unique ID. To address this, companies can adopt one of the following procedures:

Regardless of the option, the more data the employee provides (e.g., license number, prescriber ID), the easier it will be to add, update, and reconcile the data.

How should data issues be resolved?

Once the data has been captured, a verification process must occur to address the following:

  • HCP record issues: This can happen when there are manual additions or changes to an HCP’s information.A process to consolidate and verify the HCP information with the company data is required. The most efficient option is to require manual additions to undergo an automated verification process with the central list (e.g., a check to see if name and address match a central HCP record). If that is not feasible, the company should manually match the employee-added attendee to the correct company HCP ID. By maintaining across reference process that links the new record to the master HCP record, the verification process will be bypassed if the record is selected again.
  • Spend and HCP association errors: This can happen when the user makes a data entry mistake (e.g., the employee might enter the wrong number of attendees, or accounts payable booked an invoice to the wrong category/account code). An audit and error checking process should flag potential issues (e.g., the amount spent per attendee is high). The employee should be contacted and the data should be modified in the central reporting data warehouse. It is not necessary to feed the corrected data back into the source system, as the data warehouse acts as the system of record.
How will employees know what the aggregate spend is?

Many organizations try to calculate and publish the aggregate spend per HCP in the expense reporting system. However, at that point the transaction has already occurred. The amount also does not include spend from activities recorded in other systems or managed by other employees. The most effective way to notify employees of aggregate spend amounts is to make the information available prior to the meeting, event or activity. This data can be published via the Sales Force Application, company website, or an HCP Portal (e.g., a portal created for employees to view spend and correct errors).

How do we optimize and integrate the process?

There are two ways to link spend to the HCP. One is to tie the spend to the actual HCP record (as described above). A more efficient alternative is to link the spend with the business transaction/event/activity where the company interacted with the HCP. This means integrating spend tracking with a company’s Sales Force Application and Event Management Systems(illustrated in Figure 5 below).These front-end applications are the starting point before an HCP event occurs. Typically, the employee has already listed the HCPs they are planning to meet or who are planning to attend an event. Instead of requiring the employee to re-enter this data or research it again in downstream systems, the HCPs tied to a particular sales call or event are brought into the spend tracking system based on intelligent criteria (e.g., the date range of sales calls or a flagon the sales event indicating there will be expenses). A more detailed breakdown of the steps for the Sales Call transaction are as follows:

  • The employee enters information into a CRM system for a sales call (e.g., date of meeting, expected HCPs, products to be discussed, anticipated expenses)
  • The employee holds the sales meeting
  • The employee creates expense transactions that require HCP attendee information (e.g., lunch). The date of the transaction is used to recall sales activities from the CRM system. The information is sorted so the most likely match appears first (e.g., date is closest to transaction date, transaction city is closest to office city, sales call has expected expenses)
  • The employee selects the matching sales call, which links pre-defined details associated with that call (e.g., detailed list of HCPs and products discussed with each HCP)
  • The employee can also add or delete HCPs and products that were not part of the CRM sales call if changes occurred after the meeting was planned
  • The employee can also add a group of non-HCPs in one data field and track the count if detailed information is not required for reporting

A second, and more valuable way to optimize efficiencies is to create a centralized portal to handle any business transaction with an HCP and integrate the portal with all downstream systems (e.g., CRM, expense management application, accounts payable, event management) to leverage this information. The portal would capture each business transaction and alert employees about any legal or corporate policies for interactions with HCPs or government officials. Special routing or alerts can be put in place to remind employee of the interaction rules (e.g., aggregate spend compliance, Foreign Corrupt Practices Act). The centralized portal would also serve as the review, correction, and update tool for the business transaction and HCP data (e.g, only 10 out of the 12 HCPs attended the education event). However, this would require all data to be integrated with downstream systems, as well as system modifications to pull information back into the portal. While this solution would be powerful, it would require significant investment from the company in terms of time, money, and change management. This type of solution would only be the worth the investment if the legal rules and policies became difficult to manage thereby increasing the internal efforts and risks of non-compliance.

Step 5: Conduct User and Business Change Management

A key challenge for complying with the Sunshine Act is to effectively change employee behavior and to avoid any legal ramifications due to requirements not being met.

How do we get teams to work towards a common goal?

The first level of change management is amongst the different business groups, teams, and suppliers involved. Hold regular meetings to keep the stakeholders updated, but involve the project sponsors to help resolve issues. Strike a balance between updating all the different stakeholders and getting buy-in when appropriate.

While department owners may want to be involved in creating a solution, they should not get held up in discussions about how the system should work. Instead, they should provide detailed requirements so the project team leader, sponsors, and technical team can focus on creating scalable and user-friendly solutions.

All business units need to see the end–to-end picture and understand the reporting resource requirements and manual reconciliation efforts involved without centrally managed HCP data. Although it is necessary to balance the solution with the effort and implementation time involved, more time dedicated to creating a holistic and scalable solution will make it easier for companies to meet the requirements in the US and globally as new laws are enacted.

How do we change employee behavior and communicate impacts?

Employees need to know about the new regulations upfront and understand that the company is working hard to address the new rules to be in compliance. This will help set the stage for the changes to come.

Once the new processes are defined, a good solution is to provide regular compliance training for the entire organization so all employees are aware of the legal background, business drivers, and reasons for the additional processes and effort. In addition, many companies now integrate compliance/HCP tracking training with application training (e.g., expense reporting system).

These communications should come from the top down to communicate the importance of the initiative. It is also important for employees to understand the solutions were developed with cross-functional input. Documenting interactions with each HCP requires considerable effort so employees must understand the drivers for this initiative.