Sunshine Act Reporting for Pharma and Medtech: 2026 Rules, Data and Software

Sunshine Act reporting: the short answer

Sunshine Act reporting is the annual submission every US drug, device, biologic and medical supply manufacturer makes to the CMS Open Payments program, listing each payment or other transfer of value to physicians, certain non-physician practitioners and teaching hospitals in the previous calendar year. For Program Year 2026, any single payment of $13.82 or more is reportable, smaller payments become reportable once a recipient's total passes $138.13 for the year, and the file is due by March 31, 2027, signed off by a company officer. CMS publishes it on June 30, 2027.

The rules are not the hard part. The hard part is the data. A single physician's year can include in-office lunches logged by reps in the CRM, a speaker fee paid through accounts payable, flights booked on a corporate card, a meal at a congress booked by an agency, and a research payment routed through a CRO. Each sits in a different system, under a different name, often without the NPI or state licence number CMS requires. Sunshine Act reporting is really a once-a-year master data and reconciliation project with a federal deadline and an officer's signature at the end.

This guide covers what the 2026 rules require, a worked example of how the thresholds play out for real recipients, the data pipeline behind a clean submission, the three ways mid-sized companies run aggregate spend reporting, a month-by-month calendar, and the mistakes that show up in enforcement. It is written for compliance, finance and commercial operations leads at mid-sized and emerging pharma, biotech and medtech companies. It is not legal advice: your counsel decides how the rules apply to your arrangements.

Open Payments in numbers

What does Sunshine Act reporting require in 2026?

The Physician Payments Sunshine Act, section 6002 of the Affordable Care Act, created what CMS now runs as Open Payments. The regulations sit in 42 CFR Part 403, Subpart I. Here is what they mean in practice for a manufacturer.

Who reports. Applicable manufacturers of covered drugs, devices, biologicals and medical supplies that are reimbursable under Medicare, Medicaid or CHIP, plus entities under common ownership that help them, and applicable group purchasing organisations. A company with even one covered product on the US market is usually in scope for its payments to covered recipients.

Who is reported on. Physicians and teaching hospitals from the start, and since Program Year 2021 also physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists and certified nurse-midwives. That 2021 expansion is still a common source of gaps, because older CRM and expense setups only flag physicians.

What is reported. Three record types: general payments (meals, travel, consulting, speaker fees, honoraria, gifts, education, grants, royalties and similar), research payments, and ownership or investment interests held by physicians or their immediate family. For each general payment, 42 CFR 403.904 requires the recipient's name, business address, specialty, NPI and state licence number, the amount, the date, the form of payment, the nature of payment from CMS's fixed category list, and the brand name of the related product where there is one.

The small payment rule. A payment under $13.82 in 2026 does not have to be reported unless that recipient's small payments for the year add up to more than $138.13. Both figures move every year with the consumer price index, so a threshold hard-coded into last year's spreadsheet is already wrong.

Exclusions. Product samples for patient use, patient education materials, short-term trial loans of devices, payments to bona fide employees and payments to people who are not covered recipients are among the categories excluded. Each exclusion has conditions, so record why a payment was excluded, not just that it was.

Deadline, attestation and disputes. Under 42 CFR 403.908 the report is due by the 90th day of the year, which CMS sets as March 31. The CEO, CFO, chief compliance officer or another officer must attest that the data is timely, accurate and complete. Recipients then get at least 45 days to review and dispute, and the manufacturer has a further 15 days to correct, before publication.

Records and penalties. CMS requires supporting records to be kept for at least five years from publication. Failing to report carries a civil monetary penalty of $1,000 to $10,000 per payment, capped at $150,000 a year, and knowingly failing to report carries $10,000 to $100,000 per payment, capped at $1,000,000, with all amounts adjusted annually for inflation under 45 CFR part 102. Several states, including Vermont, Massachusetts and Minnesota, add their own disclosure rules or gift limits on top of the federal program.

A worked example: how the 2026 thresholds play out

Take three recipients from one mid-sized specialty brand's 2026 data. The figures are illustrative, but the rules applied are the 2026 thresholds above.

Dr. A, an oncologist on the target list. Reps logged 13 in-office lunches in the CRM, each costing $11.20 per head. Every one is below the $13.82 per-payment threshold. But 13 times $11.20 is $145.60, which is above $138.13, so all 13 lunches become reportable. If the CRM stores the lunch as a single event cost rather than a per-attendee value, nobody will notice this until the data is aggregated by NPI across the year.

Dr. B, a community physician. Five in-office lunches at $11.20 each, $56 in total, and nothing else. Every payment is under $13.82 and the small payments never pass $138.13, so nothing is reported for Dr. B in 2026. Your system should still keep the five records and the reason they were not reported, because next year's totals may cross the line.

NP C, a nurse practitioner who speaks for the brand. One speaker programme fee of $1,500 paid through accounts payable, $420 of flights and hotel booked through the travel agency, and a share of a dinner at the programme. The dinner cost $600 for six people: four covered recipients and two of your employees. CMS's approach to group meals divides the total by everyone who ate, so each attendee is allocated $100, and NP C's $100 is reportable as food and beverage. Reporting only what each person ordered, or dividing by the four clinicians only, are both mistakes. NP C ends up with three reportable records from three different systems, and none of them will match unless the AP vendor record, the travel booking and the CRM attendee list all carry the same NPI.

The point of the example: thresholds are applied per recipient across the whole year, so you cannot decide what to report at the moment a payment is made. You need every transfer of value, from every source, joined to one clean recipient record, before any rule can be applied.

Where aggregate spend data actually comes from

• CRM: calls, meals and samples

  In-office meals, attendee lists and sample activity logged by the field in Veeva Vault CRM, Salesforce or similar.

  • Per-attendee meal values
  • Attendee NPIs, not free-text names
  • Sample exclusions documented

• Accounts payable and ERP

  Consulting, speaker and advisory board fees, royalties, grants and charitable contributions paid as invoices.

  • Vendor record linked to the HCP
  • Payment date, not invoice date
  • Nature of payment mapped once

• Expenses and corporate cards

  Meals and travel paid by employees on cards and claimed through expense software such as Concur or Ramp.

  • HCP attendee captured on the claim
  • Receipts kept five years
  • Split meals allocated correctly

• Events and speaker bureaus

  Programme costs, travel and venue spend from your events team or an agency running speaker programmes.

  • Agency files on a fixed template
  • Monthly, not once a year
  • Attendance signed and stored

• Research and clinical vendors

  Investigator payments and research funding routed through CROs and sites, reported as research payments.

  • Principal investigator NPIs
  • Study and product linked
  • Delayed publication flags where eligible

• The recipient master

  One clean record per covered recipient with NPI, state licence, specialty and address, matched against reference data.

  • NPPES or vendor reference data
  • PAs, NPs and CRNAs flagged
  • Duplicates merged before reporting

How to build a Sunshine Act reporting pipeline that holds up

Aggregate spend reporting: managed service, software or build

Managed service

Specialist aggregate spend providers take your source files, run validation, prepare the CMS submission and handle state reports. This suits a company with a small compliance team and a few dozen to a few hundred covered recipients. You still own the source data and the attestation, so a vendor cannot fix an AP system that never captured an NPI.

Aggregate spend software

Several expense and ERP vendors, including Ramp, Zoho Expense, Concur add-ons and QAD Strategic, now sell Sunshine Act features, and dedicated aggregate spend platforms cover federal and state reporting in one tool. These work well when most spend already flows through that one system. They struggle when CRM meals, agency events and research payments live elsewhere and must be fed in by hand. Vendors rarely publish list prices, so compare quotes on recipient volume, number of sources and state reports included.

Build on your data stack

If you already run a commercial data warehouse with a clean HCP master, the transfer-of-value table is one more subject area: same recipient keys, same pipelines, same monitoring. The submission file becomes a scheduled output, and the same data feeds compliance dashboards, speaker programme analytics and fair market value checks. It needs a data team or partner who will own it every year, not a one-off project.

How to choose Sunshine Act compliance software

Whichever route you take, judge it on the data, not the demo. Ask every vendor or partner these questions and get the answers in writing.

• How does each of our sources get in? Name your CRM, ERP, expense tool, events agencies and CROs, and ask which have standard connectors, which need file templates and which need manual entry. Manual entry is where errors start.
• How are recipients matched? Ask what reference data they match against, how unmatched records are handled, and whether PAs, NPs, CRNAs, clinical nurse specialists and nurse-midwives are flagged as covered recipients by default.
• Are thresholds and meal allocation applied automatically? The 2026 values should not be typed in by your team, and group meals should be divided by all attendees.
• What does the dispute workflow look like? You need to see each dispute, the evidence, the correction and the date, inside the 15-day window.
• Which state reports are included? If you have spend in Vermont, Massachusetts, Minnesota or other states with their own rules, confirm they are covered, not quoted later.
• Can we export everything to our own warehouse? Your transfer-of-value history is evidence you must keep for at least five years. Make sure you can get all of it out, at any time, without a services fee.

A tool that answers these well takes the year-end scramble out of February. A tool that only answers them for spend already inside it will move the manual work somewhere else rather than remove it.

The Sunshine Act reporting calendar for Program Year 2026

Common mistakes, and when not to buy anything

The first Sunshine Act enforcement action shows how ordinary the failure can be. In October 2020 the Department of Justice announced a $9.2 million settlement with Medtronic USA, of which about $1.11 million resolved Open Payments reporting violations. According to Mintz's summary, over nine years Medtronic paid more than $87,000 for over 130 social events at a restaurant owned by a physician, but reported only the food and drink each physician personally consumed, not the payments to the physician's business.

The common errors in aggregate spend data follow the same pattern, and several appear on MedDeviceGuide's 2026 list of typical audit findings:

• Missing or wrong NPIs, so payments to one clinician sit under three spellings of their name.
• Non-physician practitioners not flagged, five years after they became covered recipients.
• Meals divided by the wrong headcount, or recorded as a single event cost with no attendees.
• Inconsistent nature of payment, because each source maps categories its own way.
• Thresholds hard-coded from a previous year.
• Third-party spend left out, especially agency-run speaker programmes and CRO payments.
• No reconciliation between the CMS file and the general ledger, leaving the attesting officer signing on trust.

When not to buy software or start a project. If you are a pre-commercial biotech with a handful of consultants paid through AP, a well-kept spreadsheet with validated NPIs, a category map and an annual review by counsel may be enough for now. Revisit it when you hire a field team, launch speaker programmes or start paying for meals at scale. Likewise, if nearly all of your HCP spend already flows through one expense or ERP system that has a Sunshine module, turning that on may beat a separate build. The case for a pipeline on your own data stack is strongest when spend is spread across several systems and agencies, or when you already need a clean HCP master for commercial analytics.

Where Greenwolf fits

Greenwolf builds the data layer underneath Sunshine Act reporting. We do not give legal advice and we do not file on your behalf. We connect your CRM, ERP, expense, events and research sources into one transfer-of-value table in your own warehouse, build the HCP and teaching hospital master it depends on, apply the current year's thresholds and meal allocation, reconcile it to the ledger and produce a submission-ready output with an exception queue your compliance team can work through. The same data then feeds a pharma compliance dashboard that shows spend by recipient, programme and month, so problems surface in June rather than in February.

If your HCP records are the weak point, start with customer master data management; our comparison of Veeva OpenData and IQVIA OneKey explains the reference data options. If your field data sits in Veeva, our Veeva CRM data integration work brings calls, meals and attendee lists into the warehouse. Companies building a broader pharma commercial data warehouse can add aggregate spend as one more subject area, and the wider picture of our pharma work is on the specialty pharmacy analytics hub. Our founder came up through pharma commercial operations consulting at ZS, so this work starts from how compliance, finance and the field actually record spend.

Questions about Sunshine Act reporting