The Italian Ministry of Health has made available the draft decree and technical specifications envisaged in Article 5, par. 7, Law No. 62 of May 31, 2022, better known as the Sunshine Act, drafted after consultation with the Agency for Digital Italy (AgID), the National Authority for Anti-Corruption (ANAC), and the Guarantor for the Protection of Personal Data.
The decree establishes the structure and technical characteristics of the public Sanità Trasparente electronic register, as well as the modalities for manufacturing companies that are subject to the obligations of the Sunshine Act to transmit notifications, based on a number of directives: (i) ease of access; (ii) simplicity of consultation; (iii) comprehensibility of the data; and (iv) provision of functions for simple and advanced searches and data extraction.
A public consultation has been opened on the draft decree. The consultation will close on September 17. The aim is to gather opinions and requests from the interested parties—in addition to manufacturing companies, healthcare organizations, and those operating in the healthcare sector, as established in Law 62/2022. The completion of an ad hoc questionnaire available on the partecipa.gov.it platform is envisaged.
Therefore, albeit with a significant delay,[1] this path should lead to the register becoming fully operational and then to the applicability of all the transparency obligations provided by the Sunshine Act. We must remember that these obligations could impose significant burdens on companies required to make the relevant disclosures, given the wide range of cases of transfers of value and relationships of interest that will have to be disclosed.
TRANSPARENCY OBLIGATIONS
The Sunshine Act—which came into force on June 26, 2022, but is not yet implemented—introduces obligations regarding transparency surrounding relationships of interest between manufacturing companies and healthcare organizations and individuals operating in the healthcare sector. This is similar to what is already happening in other countries and is also happening in Italy—albeit on a voluntary basis—under the EFPIA (European Federation of Pharmaceutical Industries and Associations) and Farmindustria Codes of Conduct and the related provisions on the transparency of direct and indirect transfers of value in favor of HCOs and HCPs, which are binding only upon member companies.
The transparency obligations provided by the Sunshine Act will be fulfilled via communication to a public electronic register by the parties required to do so, a particularly broad category that includes manufacturing companies that “directly or in the role of intermediary or affiliated company” engage in an “activity geared to the production or marketing of medicines, equipment, goods, or services, including non-healthcare products, such as nutritional products, that can be marketed in the human and veterinary health sectors, or to the organization of conferences and congresses concerning the same subjects.” In light of this definition, all companies in any way involved in the marketing cycles of products or services, including non-healthcare products, that may be marketed in the health and veterinary sectors will be bound by transparency obligations. It is clear that many companies, with the exception of those engaged in the production or provision of goods and services that are absolutely incompatible with healthcare, will fall within the scope of the Sunshine Act’s transparency obligations.
With regard to transparency obligations, manufacturers are obligated to report to the electronic register data on disbursements made and relations with healthcare sector entities and health organizations,[2] specifically:
- agreements and disbursements of money, goods, services, or other benefits;[3]
- agreements that produce direct or indirect benefits, consisting of participation in conferences, training events, committees, advisory bodies, or scientific committees or in the establishment of consultancy, teaching, or research relationships;
- shares and bonds of manufacturing enterprises held by healthcare sector entities and health organizations and the proceeds therefrom, as well as the consideration paid by the enterprises to these entities arising from industrial or intellectual property rights.
The data to be disclosed are identified in Art. 3(4) of the Sunshine Act and reiterated in Annex A of the draft decree (technical specifications) and include (i) the identification data of the companies and of the beneficiaries/parties to the agreements/shares/bonds; (ii) the dates, nature, and causes of the disbursements and agreements and the amounts involved.
DATA TRANSMISSION
At the procedural level, the data collected by a manufacturing company are transmitted to the electronic register in electronic format by the end of the six-month period following the reference year (for the data referred to in points 1 and 2 above) and by January 31 of the year following the reference year (for the data referred to in point 3 above) by one or more persons specifically delegated by the legal representative of the manufacturing company. A manufacturing company based abroad shall appoint a representative in Italy to handle communication to the register.
Under the decree available for consultation:
- the procedures for exercising delegation are available on the website of the Ministry of Health;
- transmission will take place through the NSIS (New Health Information System) portal after authentication of the company’s delegate, who will be given a special user profile to use to operate on the platform.
It is interesting to note that under Section 5(6) of the Sunshine Act, the consent of persons operating in the health sector and health organizations for “the disclosure and processing of data” is deemed to have been given, by law, at the time that the relevant conventions or agreements are entered into, or upon the acceptance of disbursements, as well as with the acquisition of shares, bonds, and income from industrial or intellectual property rights. In any case, such persons shall be informed by the transmitting company about the processing of the data.
This mechanism appears unique with regard to the personal data of the data subjects, given that one could legitimately expect the processing to fall under Article 6(1)(c) GDPR (processing necessary to comply with a legal obligation to which the data controller, i.e., the manufacturing company for the purposes of transmitting the data to the register, is subject), rather than as a case of implied consent considering that by definition consent must be freely given and that the data subject should have the right to revoke it at any time.
PUBLICATION OF DATA AND ACCESSIBILITY OF THE REGISTER
All data to be reported by manufacturers will be published in the Sanità Trasparente (Transparent Health) electronic register by the Ministry of Health. The relevant publication timeframes are indicated in Article 5 of the draft decree as follows:
- within the first week following the transmission deadline, for the data referred to in points 1 and 2 above (conventions, disbursements, and agreements);
- no later than the first week of March following the transmission deadline, for the data referred to in item 3 above (shares and capital stock, bonds, and proceeds).
The register and the related data will be freely accessible for consultation through functions that allow users to conduct simple searches and advanced searches (i.e., with different reference parameters) and can also be extracted according to open data standards. However, under the draft decree, there are some conditions and limits: (i) the principle of minimization of personal data pursuant to Article 5 of the GDPR; (ii) the limits on data extraction provided in Article 52(2) of Legislative Decree No. 82 of March 7, 2005; (iii) the limits on data reuse provided in Legislative Decree No. 36/2006 for the reuse of documents in the public sector as well as, in the case of information relating to natural persons, the principle of purpose limitation pursuant to Articles 5(1) and 6(4) of the GDPR (with the express exclusion of cases where reuse would be detrimental to the protection of privacy and the integrity of individuals).
Additionally, under the Sunshine Act, the Ministry of Health is expected to publish a dedicated section of the electronic register covering sanctions imposed on manufacturing companies that fail to make disclosures for transparency purposes or provide false or incomplete information—sanctions provided in Article 6 of the Sunshine Act.[4]
REGISTER REPORTING OBLIGATIONS
The consultation opened by the Ministry of Health on the draft decree certainly represents a step toward full application of the Sunshine Act. As noted above, the consultation will close on Sunday, September 17. A final report on this phase will be made public by October 8, 2023, according to the ministry. The final version of the ministerial decree then should see the light of day, with possible corrections and amendments in response to requests and suggestions from stakeholders.
Once these steps have been completed, it will be necessary to wait for the establishment and full operation of the register, which will be announced by means of a special notice published in the Official Gazette, as provided in Article 5, paragraph 1, of the Sunshine Act. Only after that date will it be necessary to calculate the terms for applicability of the reporting obligations to be borne by manufacturing companies according to the different timeframes provided by Article 9 of the Sunshine Act.
Therefore, there are still many steps between the current status and full operation of the new rules on the transparency of financial relations and relations of interest in the healthcare sector. However, our advice for companies that fall into the broad category of manufacturing companies is to take advantage of the remaining time and not to be caught unprepared, especially in view of the potentially significant number of relationships that will fall within the scope of the transparency obligations.
How should companies approach this? First, by carrying out reconnaissance of all their existing relationships—and considering which will presumably continue until they fall within the scope of the Sunshine Act—that are relevant for the purposes of transparency disclosures by dividing them into the two macro-areas into which disclosures are divided and to which different sections of the electronic register correspond (i.e., conventions, disbursements, and agreements in Section A of the register, and shares and capital stock, bonds and proceeds in Section B).
