An Open Payments reporting program is the yearly process by which applicable manufacturers of drugs, devices, biologicals and medical supplies report to CMS their payments to physicians, other listed practitioners and teaching hospitals, and manufacturers and group purchasing organizations report physician ownership interests, under 42 CFR Part 403, Subpart I (the Sunshine Act regulation). Integral Healthcare Solutions (IHS) drafts the procedures, categorization rules, calendar and dispute, correction and records workflows for entities whose counsel has decided they must report.
Last updated: November 2026
What does 42 CFR Part 403 Subpart I require?
Subpart I applies to applicable manufacturers and applicable group purchasing organizations (section 403.900). IHS read these sections on November 5, 2026, in the current eCFR text dated November 4, 2026 (Title 42 last amended October 8, 2026): 42 CFR Part 403, Subpart I.
| Section | What it asks, in IHS's words | What answers it |
|---|---|---|
| 403.902 | Reporters are applicable manufacturers and applicable group purchasing organizations (GPOs) operating in the United States. Covered recipients are physicians and five other listed practitioner types, such as physician assistants and nurse practitioners, who are not bona fide employees of the reporting manufacturer, plus teaching hospitals. | Applicability memo by counsel |
| 403.904 | A manufacturer reports direct and indirect payments or other transfers of value to covered recipients during the preceding calendar year, including those “provided to a third party at the request of or designated by the applicable manufacturer on behalf of a covered recipient.” Each record carries an amount, date, form and one of 18 mutually exclusive nature-of-payment categories. A manufacturer whose covered products made up less than 10 percent of gross revenue in the prior fiscal year reports only payments related to covered products. | Data-capture procedure, categorization worksheet |
| 403.906 | Manufacturers and GPOs report ownership and investment interests in themselves held by a physician or a physician's immediate family member during the preceding calendar year, and direct and indirect payments to those physician owners or investors, including to third parties on their behalf. | Ownership register |
| 403.908 | An entity with reportable items registers with CMS within 90 days of the end of the calendar year for which a report is required, and reports are filed electronically by the 90th day of each calendar year. Each report and each correction carries an attestation by the CEO, CFO, chief compliance officer or another officer that the information is timely, accurate and complete to the best of his or her knowledge and belief. Reporters, covered recipients and physician owners or investors have at least 45 days to review and submit corrections before CMS publishes, and in no case may that period prevent publication. | Annual calendar, attestation file, dispute workflow |
| 403.912 | Civil money penalties for each payment or ownership interest not reported timely, accurately or completely, and records kept at least 5 years from the date of publication on the website. | Records schedule |
| 403.914 | For manufacturer payments to covered recipients, Subpart I preempts state or local laws requiring a manufacturer to disclose the type of information Subpart I requires; reporting required for public health or health oversight purposes continues. | State-law list for counsel |
CMS reports that Program Year 2025 data includes 17.07 million published records totaling 14.67 billion dollars (CMS Open Payments, opened November 5, 2026).
Who needs it and what triggers it?
These events usually start the work:
- A first product meets the covered-product definition in section 403.902, such as a drug that by law requires a prescription to be dispensed and for which payment is available under Medicare, Medicaid or CHIP.
- The annual cycle. On CMS's calendar, data collected January 1 to December 31 is submitted February 1 to March 31, reviewed and disputed April 1 to May 15, corrected May 15 to 30, and published on or by June 30.
- A covered recipient disputes a record, or your team finds an error in a filed report.
- Enforcement. On August 10, 2026, the Department of Justice announced that Veloxis Pharmaceuticals agreed to pay a 1.55 million dollar civil penalty to CMS to resolve allegations that it knowingly failed to report certain payments to physicians, which DOJ called “the largest Sunshine Act recovery since the law was passed in 2010” (DOJ press release, opened November 5, 2026).
- A proposal. CMS's April 10, 2026 fact sheet on proposed rule CMS-0062-P says CMS proposes a definition of “Failure to Report” in section 403.902, as the foundation for a civil money penalty on a manufacturer or GPO that fails to grant timely access, within 30 calendar days of the audit request, to documents for an Open Payments program audit (CMS fact sheet, opened November 5, 2026). The eCFR text of section 403.902 dated November 4, 2026 contains no such definition.
Teaching hospitals are covered recipients, so they do not report the payments they receive. CMS's reporting entities page (opened November 5, 2026) lists hospitals, hospital-based pharmacies and laboratories as exempt if they manufacture a covered product solely for use by or within the entity itself or by its own patients.
How IHS helps
IHS turns Subpart I into a yearly process: a gap assessment, a map of the systems where payments to covered recipients start, drafting of what is missing, a mock audit that pulls the source documents behind sampled records, and support through the first cycle.
What IHS drafts
- A data-capture procedure covering indirect payments and payments to third parties at the request of, or designated on behalf of, a covered recipient.
- A categorization worksheet for forms and natures of payment, with the threshold and exclusion logic in section 403.904(h) and the group-meal allocation rule in section 403.904(g).
- An annual calendar, a dispute and correction workflow, a delayed-publication tracker for research payments (section 403.910) and a records-retention schedule.
What you supply
Counsel's determination of whether you report and what is reportable, payment and ownership data, system access, the attesting officer and the submission itself.
The real limit
IHS drafts. IHS does not register, submit, attest, resolve disputes with recipients or communicate with CMS, and gives no opinion under the Anti-Kickback Statute. IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. This program is part of IHS's Compliance Services practice line.
What to have ready
- Counsel's memo on manufacturer or GPO status, including common-ownership affiliates (section 403.902).
- Prior-year gross revenue from covered products, if the 10 percent limit may apply (section 403.904(b)(1)).
- Last year's payments by recipient, including through third parties (section 403.904(a)).
- Your recipient master file with NPI, license and specialty data (section 403.904(c)).
- Research agreements and protocols (sections 403.904(f) and 403.910).
- Physician and immediate family ownership interests (section 403.906).
- Registration record, prior submissions and attestations (section 403.908).
- Dispute log, correction history and records-retention schedule (sections 403.908(g), 403.912(e)).
With the list in hand, the free introductory call is where IHS walks through it with you.
How does it compare with other ways to report?
Common approaches, often combined:
| Approach | What it covers | Where IHS fits |
|---|---|---|
| In-house process | Staff collect and format the data. | IHS drafts the written procedure. |
| Aggregate spend software or an outsourced service | A vendor collects spend and builds the submission file. | IHS writes the rules the vendor follows; your officer still attests. |
| Law firm | Applicability opinions, state law, enforcement defense. | IHS works alongside counsel and gives no legal opinion. |
State disclosure laws are a separate question for counsel (section 403.914). More services are on the Compliance Services page.
What does Open Payments compliance cost?
Subpart I sets no filing fee, and CMS publishes none on the Open Payments pages we reviewed; the cost the rule sets is the penalty for failing to report. Section 403.912 sets a civil money penalty for each payment or ownership interest not reported timely, accurately or completely, with an annual cap and higher amounts for knowing failures, adjusted annually under 45 CFR part 102. The 2025 column of the HHS adjustment table at 45 CFR 102.3 lists 1,443 to 14,432 dollars per item with a 216,490 dollar annual cap for section 403.912(a), and 14,432 to 144,329 dollars with a 1,443,275 dollar cap for section 403.912(b). Factors to be considered in setting the amount include how long the failure lasted, the amount not reported, the level of culpability and the diligence used in correcting errors (section 403.912(d)).
IHS scopes each engagement after a free introductory call.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm, and your counsel decides who must report and what is reportable.
- It is not a guarantee of any CMS, OIG or DOJ outcome.
Frequently asked questions
Do physicians or hospitals have to report to Open Payments?
Not as covered recipients. Subpart I places reporting on applicable manufacturers and applicable group purchasing organizations (section 403.900). Covered recipients may review the data reported about them and dispute it (section 403.908(g)); CMS describes that review as voluntary.
Who is an applicable manufacturer?
Section 403.902 names two kinds of US-operating entity: one that produces, prepares, propagates, compounds or converts a covered drug, device, biological or medical supply, unless the product is solely for use by or within the entity itself or by its own patients; and one under common ownership with such an entity that assists it with a covered product. Distributors and wholesalers without title to a covered product are excluded unless they fit the second kind. Your counsel decides whether you meet the definition.
What are the reporting thresholds for 2026 and 2027?
CMS's data collection page (opened November 5, 2026) lists 13.82 dollars per small payment and 138.13 dollars per year to one covered recipient for Program Year 2026, and 14.31 and 143.01 dollars for 2027. A payment under the first amount is excluded unless the year's total to that recipient exceeds the second, in which case all payments are reported. Under section 403.904(h)(2)(iii), small payments at large-scale conferences, similar large-scale events and events open to the public need not be reported or counted toward the aggregate, even when the aggregate is exceeded.
When are Open Payments reports due?
Section 403.908(a) sets electronic submission by the 90th day of each calendar year, covering the preceding calendar year (sections 403.904(a) and 403.906(a)). An entity with reportable items registers with CMS within 90 days of the end of the calendar year for which a report is required (section 403.908(c)).
What happens when a physician disputes a record?
The dispute goes to the reporting entity to be resolved between the parties; CMS does not mediate. To be corrected before publication, the reporting entity must notify CMS of resolved disputes no later than 15 days after the 45-day review period ends (section 403.908(g)(4)(i)). If the dispute is still unresolved then, CMS publishes the reporting entity's version and marks it as disputed (section 403.908(g)(4)(iii)).
How do we correct an error after we submit?
Section 403.908(h)(1) requires corrected information to be submitted to CMS immediately upon confirmation of the error or omission. Section 403.904(a)(3) bars removing, deleting or altering a reported record unless an error is discovered or the record is believed to meet a reporting exception.
Can research payments be kept from publication?
Some can be delayed under section 403.910: payments under a research or development agreement (a written agreement, a research protocol or both) for research on or development of a new product or a new application of an existing one, or a clinical investigation of a new product. They are still reported to CMS in the next annual report, but CMS posts them at the first annual publication date after the earlier of FDA approval, licensure or clearance, or four calendar years after the payment. If the report does not indicate eligibility, CMS posts all payments in the first year of public reporting.
Does IHS submit our report or attest for us?
No. IHS does not register, submit, attest, resolve disputes or communicate with CMS. Your team submits, and one of your officers signs the attestation.