Sunshine Act: introducing a transparent healthcare system

The purpose of the law is to prevent and combat corruption and to guarantee the transparency of economic relations between companies whose core business concerns medicines, diagnostic instruments, equipment, goods and services –also including non-health products/services – and entities operating in the health sector or health organisations. 

In particular, companies that have relationships with individuals working in the health sector (both medical staff and administrative roles)   or health organisations will be obliged to electronically publish all direct and indirect transfers of value to health organisations and health sector professionals by entering a large amount of data in a special "Transparent Healthcare" register managed by the Ministry of Health.

In the event of: 
•    a failure to report; 
•    incomplete information being submitted; or
•    false information being submitted, 
the law provides for heavy administrative fines. 

The law will come into effect once the Ministry of Health has created and established the new register by means of a specific decree.

To this end, on 18 August 2023, the draft implementing decree for the establishment of the register and the related technical specifications were published on the website of the Ministry of Health and a public consultation procedure was launched. Interested parties can send their comments on the drafts submitted by 17 September 2023   using the questionnaire made available by the Ministry on its website at the link.

Subjects affected by the legislation

Those affected by the legislation are:

•    Manufacturing companies, being "any entity, including those belonging to the Third Sector, which, directly or in the role of intermediary or associated company, carries out an activity directed to the production or marketing of medicines, devices, equipment, goods or services, including non-medical products, including nutritional products, marketable in the field of human and veterinary health, or to the organisation of events and congresses concerning the same objects".
If the manufacturing company is based abroad, the transparency reporting requirement must be met through its representative in Italy.

•    Professionals operating in the health sector, being: "persons belonging to the health or administrative area and other persons operating, in any capacity whatsoever, within a public or private health organisation, and who, regardless of the position held, exercise responsibility for the management and allocation of resources or intervene in decision-making processes concerning medicines, devices, technologies and other goods, including non-health goods, as well as research, experimentation and sponsorship. Professionals registered in the compulsory National Register of Members of Selection Boards in procedures for the awarding of public contracts, referred to in article 78 of the Code referred to in Legislative Decree No. 50 of 18 April 2016, managed by the National Anti-Corruption Authority, and selectable for public procedures for the purchase and production of goods and services in the health sector, are equated to persons working in the health sector".

•    Healthcare organisations, being "Local Health Authorities, hospital companies, university hospital companies, scientific research hospitals (IRCCSs) and any public or private legal entity providing healthcare services, university departments, specialisation schools, public and private research institutes, scientific associations and societies, professional orders of the healthcare professions and associations and scientific societies between healthcare professionals also not having legal personality, public and private entities that organise continuing medical education activities, as well as companies, patients' associations, foundations and the other entities established or controlled by the aforementioned entities or that control or own them or act as intermediaries for the aforementioned healthcare organisations". 

Information that must be published 

The information to be disclosed by the company in the register is:

• Agreements and disbursements in cash, goods, services or other benefits made by a company in favour of: 

- a professional operating in the health sector, when they have a unit value greater than €100 or a total annual value greater than €1,000; or

- a health organisation, when they have a unit value of more than €1,000 or a total annual value of more than €2,500. 
If the annual value limits are exceeded during the year, the communication must be made within the six-month period following that in which the excess occurred.

• Agreements between companies and professionals operating in the health sector or health organisations, which produce direct or indirect benefits, consisting of the participation in conferences, training events, committees, advisory bodies or scientific committees or in the establishment of consultancy, teaching or research relationships. In this case, the disclosure of disbursements made and agreements and conventions entered into in each half-year must be made by the end of the following half-year.
• Shareholdings, bonds and income from industrial or intellectual property rights of health sector companies or health organisations. In this case, the obligation to publish arises within 31 January in each year with respect to the previous calendar year.

The data to be entered in the register includes:

•    the identification data of the beneficiary, that is, the professional or entity operating in the health sector or health organisation benefiting from disbursements in cash, goods, services or other benefits, made by the company;
•    the date of the disbursement or the reference period of the convention or agreement; 
•    the nature and cause of the disbursement;
•    the amount or value of the disbursement (for goods, services or other utilities the market value must be indicated);
•    the identification data of the intermediary, that is, the person who, on behalf of the company, defined the terms of the disbursement or the terms of the convention or agreement, or in any case, has maintained the relationship with the beneficiary;
•    the registration number of the beneficiary with its professional association. 

The register 

The register is managed by the Ministry of Health and is organised in three distinct sections:
•    publicity of disbursements, conventions and agreements in favour of professionals and health care organisations (Section A);
•    data on shareholdings, bonds and income from industrial or intellectual property rights (Section B); and
•    sanctions applied (Section C).

The persons responsible for transmitting data to the register are delegated by the legal representative of the company or, in the case of a company based abroad, its representative in Italy.

Delegation and access to the platform will take place through digital identity tools. The person responsible will be assigned a special user profile on the platform and will access the services of the Ministry of Health through standard devices (for example, National Services Card, Electronic Identity Card, SPID).

The register will be freely accessible for consultation and data may be extracted for publication according to the standards of 'open data', with the exception of personal data, in accordance with the provisions of article 52, paragraph 2, of Legislative Decree no. 82 of 7 March 2005.

The data published in the register may, therefore, be reused only under the conditions provided for by the regulations on the reuse of documents in the public sector, pursuant to Legislative Decree no. 36 of 24 January 2006.

However, in the case of information relating to natural persons, the reuse of the published data must take place on terms compatible with the original purposes for which the data was collected by the Ministry of Health and, in particular, in accordance with the principle of purpose limitation set out in article 5(1)(b) and article 6(4) of Regulation (EU) 2016/679 (GDPR), excluding cases where publication would be detrimental to the protection of the privacy and integrity of individuals. 

Supervision and sanctions

Companies will be responsible for the veracity of the data entered in the register.

In the event of violation of the law, sanctions are provided as follows:

•    failure to make the communication referred to in article 3 within the prescribed time limit: €1,000 plus twenty times the amount of the disbursement to which the omission relates for each communication omitted;    
•    failure to make the communication referred to in article 4(1) within the specified time limit: €5,000 to €50,000;
•    false information in the communications referred to in articles 3 and 4: from €5,000 to €100,000.

Incomplete information in communications must be supplemented within ninety days, under penalty of the above sanctions.
The Ministry of Health exercises supervisory functions over the implementation of the law using the Carabinieri Command for the Protection of Health, and applies the administrative sanctions indicated above.
The orders imposing sanctions are published in Section C of the register. In addition, the Ministry of Health is required to publish (in open format) these orders on the front page of the website for a period of not less than ninety days, indicating the names of the relevant companies. 

Critical issues 

The text of the law and the draft implementing decree present a number of critical issues. There are several interpretative doubts and, in some cases, there are also inconsistencies in the texts that need clarification.

In our opinion, the following need to be clarified:

•    whether the definition of "company" also includes companies that do not produce or market products (e.g. companies that carry out research activities alone) and are affiliated to companies that produce or market products;
•    the scope of application of the law should also be defined in the case of foreign entities;
•    whether companies that organise events and congresses in the health sector should be considered as obliged to comply with the reporting and transparency obligations as 'obliged companies'. In addition the position of CME (continuing medical education) providers also requires clarification in particular as to whether they are to be considers as "health care organisations";
•    the meaning of "other utility" and "market value" as the cost or perceived value of the good, service or utility;
•    which subjects within a healthcare organisation (public or private) have decision-making, management and resource allocation powers in the fields of medicines, devices, technologies and other goods (including non-health goods), or in research, experimentation and sponsorship activities in the healthcare sector, and which subjects on the other hand, participate in the decision-making process; and
•    the responsibilities of the company employee delegated by the legal representative for the transmission of data to the register and those of the legal representative itself (including taking into account labour law profiles). 

Finally, generalised access to data (open data) could lead to a risk of uncontrolled dissemination and indexing of data to the detriment of manufacturers.

It is hoped that with the public consultation called by the Ministry of Health, these critical issues and doubts of interpretation can be resolved.