Sunshine Act: Draft decree for the Sanità Trasparente electronic register published

The Italian Ministry of Health has made available the draft decree and technical specifications envisaged in Article 5, par. 7, Law No. 62 of May 31, 2022, better known as the Sunshine Act, drafted after consultation with the Agency for Digital Italy (AgID), the National Authority for Anti-Corruption (ANAC), and the Guarantor for the Protection of Personal Data.

The decree establishes the structure and technical characteristics of the public Sanità Trasparente electronic register, as well as the modalities for manufacturing companies that are subject to the obligations of the Sunshine Act to transmit notifications, based on a number of directives: (i) ease of access; (ii) simplicity of consultation; (iii) comprehensibility of the data; and (iv) provision of functions for simple and advanced searches and data extraction.

A public consultation has been opened on the draft decree. The consultation will close on September 17. The aim is to gather opinions and requests from the interested parties—in addition to manufacturing companies, healthcare organizations, and those operating in the healthcare sector, as established in Law 62/2022. The completion of an ad hoc questionnaire available on the partecipa.gov.it platform is envisaged.

Therefore, albeit with a significant delay,^[1] this path should lead to the register becoming fully operational and then to the applicability of all the transparency obligations provided by the Sunshine Act. We must remember that these obligations could impose significant burdens on companies required to make the relevant disclosures, given the wide range of cases of transfers of value and relationships of interest that will have to be disclosed.

Transparency obligations

The Sunshine Act—which came into force on June 26, 2022, but is not yet implemented—introduces obligations regarding transparency surrounding relationships of interest between manufacturing companies and healthcare organizations and individuals operating in the healthcare sector. This is similar to what is already happening in other countries and is also happening in Italy—albeit on a voluntary basis—under the EFPIA (European Federation of Pharmaceutical Industries and Associations) and Farmindustria Codes of Conduct and the related provisions on the transparency of direct and indirect transfers of value in favor of HCOs and HCPs, which are binding only upon member companies.

The transparency obligations provided by the Sunshine Act will be fulfilled via communication to a public electronic register by the parties required to do so, a particularly broad category that includes manufacturing companies that “directly or in the role of intermediary or affiliated company” engage in an “activity geared to the production or marketing of medicines, equipment, goods, or services, including non-healthcare products, such as nutritional products, that can be marketed in the human and veterinary health sectors, or to the organization of conferences and congresses concerning the same subjects.” In light of this definition, all companies in any way involved in the marketing cycles of products or services, including non-healthcare products, that may be marketed in the health and veterinary sectors will be bound by transparency obligations. It is clear that many companies, with the exception of those engaged in the production or provision of goods and services that are absolutely incompatible with healthcare, will fall within the scope of the Sunshine Act’s transparency obligations.

With regard to transparency obligations, manufacturers are obligated to report to the electronic register data on disbursements made and relations with healthcare sector entities and health organizations,^[2] specifically:

1. agreements and disbursements of money, goods, services, or other benefits;^[3]
2. agreements that produce direct or indirect benefits, consisting of participation in conferences, training events, committees, advisory bodies, or scientific committees or in the establishment of consultancy, teaching, or research relationships;
3. shares and bonds of manufacturing enterprises held by healthcare sector entities and health organizations and the proceeds therefrom, as well as the consideration paid by the enterprises to these entities arising from industrial or intellectual property rights.

The data to be disclosed are identified in Art. 3(4) of the Sunshine Act and reiterated in Annex A of the draft decree (technical specifications) and include (i) the identification data of the companies and of the beneficiaries/parties to the agreements/shares/bonds; (ii) the dates, nature, and causes of the disbursements and agreements and the amounts involved.

Data transmission

At the procedural level, the data collected by a manufacturing company are transmitted to the electronic register in electronic format by the end of the six-month period following the reference year (for the data referred to in points 1 and 2 above) and by January 31 of the year following the reference year (for the data referred to in point 3 above) by one or more persons specifically delegated by the legal representative of the manufacturing company. A manufacturing company based abroad shall appoint a representative in Italy to handle communication to the register.

Under the decree available for consultation:

• the procedures for exercising delegation are available on the website of the Ministry of Health;
• transmission will take place through the NSIS (New Health Information System) portal after authentication of the company’s delegate, who will be given a special user profile to use to operate on the platform.

It is interesting to note that under Section 5(6) of the Sunshine Act, the consent of persons operating in the health sector and health organizations for “the disclosure and processing of data” is deemed to have been given, by law, at the time that the relevant conventions or agreements are entered into, or upon the acceptance of disbursements, as well as with the acquisition of shares, bonds, and income from industrial or intellectual property rights. In any case, such persons shall be informed by the transmitting company about the processing of the data.

This mechanism appears unique with regard to the personal data of the data subjects, given that one could legitimately expect the processing to fall under Article 6(1)(c) GDPR (processing necessary to comply with a legal obligation to which the data controller, i.e., the manufacturing company for the purposes of transmitting the data to the register, is subject), rather than as a case of implied consent  considering that by definition consent must be freely given and that the data subject should have the right to revoke it at any time.

Publication of data and accessibility of the register

All data to be reported by manufacturers will be published in the Sanità Trasparente (Transparent Health) electronic register by the Ministry of Health. The relevant publication timeframes are indicated in Article 5 of the draft decree as follows:

• within the first week following the transmission deadline, for the data referred to in points 1 and 2 above (conventions, disbursements, and agreements);
• no later than the first week of March following the transmission deadline, for the data referred to in item 3 above (shares and capital stock, bonds, and proceeds).

The register and the related data will be freely accessible for consultation through functions that allow users to conduct simple searches and advanced searches (i.e., with different reference parameters) and can also be extracted according to open data standards. However, under the draft decree, there are some conditions and limits: (i) the principle of minimization of personal data pursuant to Article 5 of the GDPR; (ii) the limits on data extraction provided in Article 52(2) of Legislative Decree No. 82 of March 7, 2005; (iii) the limits on data reuse provided in Legislative Decree No. 36/2006 for the reuse of documents in the public sector as well as, in the case of information relating to natural persons, the principle of purpose limitation pursuant to Articles 5(1) and 6(4) of the GDPR (with the express exclusion of cases where reuse would be detrimental to the protection of privacy and the integrity of individuals).

Additionally, under the Sunshine Act, the Ministry of Health is expected to publish a dedicated section of the electronic register covering sanctions imposed on manufacturing companies that fail to make disclosures for transparency purposes or provide false or incomplete information—sanctions provided in Article 6 of the Sunshine Act.^[4]

Register reporting obligations

The consultation opened by the Ministry of Health on the draft decree certainly represents a step toward full application of the Sunshine Act. As noted above, the consultation will close on Sunday, September 17. A final report on this phase will be made public by October 8, 2023, according to the ministry. The final version of the ministerial decree then should see the light of day, with possible corrections and amendments in response to requests and suggestions from stakeholders.

Once these steps have been completed, it will be necessary to wait for the establishment and full operation of the register, which will be announced by means of a special notice published in the Official Gazette, as provided in Article 5, paragraph 1, of the Sunshine Act. Only after that date will it be necessary to calculate the terms for applicability of the reporting obligations to be borne by manufacturing companies according to the different timeframes provided by Article 9 of the Sunshine Act.

Therefore, there are still many steps between the current status and full operation of the new rules on the transparency of financial relations and relations of interest in the healthcare sector. However, our advice for companies that fall into the broad category of manufacturing companies is to take advantage of the remaining time and not to be caught unprepared, especially in view of the potentially significant number of relationships that will fall within the scope of the transparency obligations.

How should companies approach this? First, by carrying out reconnaissance of all their existing relationships—and considering which will presumably continue until they fall within the scope of the Sunshine Act—that are relevant for the purposes of transparency disclosures by dividing them into the two macro-areas into which disclosures are divided and to which different sections of the electronic register correspond (i.e., conventions, disbursements, and agreements in Section A of the register, and shares and capital stock, bonds and proceeds in Section B).

[1] According to Article 5 of Law No. 62/2022, the decree in question was to be approved within three months of the Sunshine Act coming into effect (on June 26, 2022), while the electronic register was to have been set up in the following three months.

[2] Pursuant to Article 2, Law No. 62/2022 “subjects operating in the health sector” are defined as all “subjects belonging to the health or administrative area and other subjects operating, in any capacity whatsoever, within a public or private health organization, and who, regardless of the position held, exercise responsibilities in the management and allocation of resources or intervene in decision-making processes concerning drugs, devices, technologies, and other goods, including non-health goods, as well as research, experimentation, and sponsorship”; health organizations are defined as “local health companies, hospital companies, university hospital companies, institutes for hospitalization and scientific care, and any public or private legal entity providing health services, university departments, specialization schools, public and private research institutes, associations, and societies, scientific organizations in the health sector, the professional orders of the health professions and the associations of health professionals, including those without legal personality, public and private entities that organize continuing medical education activities, as well as the societies, patient associations, foundations, and other entities established or controlled by the entities referred to in this letter or that control or own them or that act as intermediaries for the aforesaid health organizations.”

[3] Pursuant to Article 3, Law No. 62/2022, only if they have (i) a unit value of more than EUR 100 or a total annual value of more than EUR 1,000 (for health organizations); (ii) a unit value of more than EUR 1,000 or a total annual value of more than EUR 2,500 (for health organizations).

[4] The following administrative penalties are provided: (i) EUR 1,000, plus the amount of the disbursement increased twentyfold, for manufacturing undertakings that fail to report agreements and disbursements; (ii) EUR 5,000 to EUR 50,000 for manufacturing undertakings that fail to report shares, bonds, and income from industrial or intellectual property rights. In the case of communications containing false information, the penalties range from a minimum of EUR 5,000 up to EUR 100,000. In any case, there is a 50 percent reduction in penalties for manufacturing undertakings with an annual turnover of less than EUR 1 million, provided that such undertakings are not controlled, affiliated with, or bound by supply or subcontracting relationships with other manufacturing undertakings.