You have roughly ten weeks. Applicable manufacturers and group purchasing organizations submit their prior-calendar-year data to CMS by March 31, the review and dispute window opens on April 1 and runs 45 days, and CMS publishes the whole file to a public, searchable database by June 30. If nobody at your practice is registered in the CMS Open Payments system when that window opens, your physicians and advanced practice clinicians will find out what a manufacturer said it paid them at the same moment a reporter, a payer, or a patient does.

This is a practice-operations guide, not a clinical or legal one. It covers the calendar, the role assignments, the records you retain, and — the part most administrators skip — the HIPAA and vendor exposure that sits underneath every relationship that generates an Open Payments record in the first place.

Does Your Practice Report Anything to CMS Open Payments?

No. Your practice files nothing. The reporting obligation sits entirely with applicable manufacturers of drugs, devices, biologicals, and medical supplies covered by Medicare, Medicaid, or CHIP, and with applicable group purchasing organizations. They report payments and other transfers of value made to covered recipients.

Covered recipients — your clinicians — have no filing duty and no penalty exposure under the statute. Review and dispute is voluntary. It is also the only mechanism you have to correct a record before it goes public, which is why practices treat it as mandatory internally even though CMS does not.

Civil monetary penalties apply to the reporting entity, not the recipient. The statute sets per-payment amounts with annual caps, higher for knowing failures, and those base figures are adjusted for inflation each year.

The Four Dates Your Compliance Calendar Needs

  • January 1 – December 31: the data collection year. Everything a rep hands your clinicians in this window is potentially reportable.
  • By March 31: manufacturers and GPOs submit and attest to the prior year's data.
  • April 1 through mid-May (45 days): the review and dispute period for covered recipients, followed by a short correction period during which reporting entities resolve what was flagged.
  • By June 30: CMS publishes. The record is public, permanent in effect, and indexed by search engines.

One more date matters and gets missed: CMS refreshes the published data at least annually, typically in January. Disputes you initiate after the 45-day window but before the end of the calendar year are flagged as disputed at publication and can be corrected in the next refresh. Missing May does not mean waiting a full year — it means living with a "disputed" flag on a public record for six months.

Who counts as a covered recipient

Physicians as defined by the statute — MD, DO, dentists, podiatrists, optometrists, and chiropractors — plus teaching hospitals. Since the 2021 collection year, the list also includes physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, anesthesiologist assistants, and certified nurse-midwives.

If your practice added an NP or PA line in the last few years and your conflict-of-interest process still only covers physicians, it is out of date. Residents are excluded. Physician ownership and investment interests, including those held by immediate family members, are reported separately from payments.

A Six-Week Review Workflow You Can Assign to Real People

Week 1: registration and authorized representatives

Covered recipients register through the CMS identity management system before they can see their data. Registration is the bottleneck every year — it involves identity proofing, and it is not something you complete on a Friday afternoon in mid-May.

The system lets a covered recipient nominate an authorized representative to review data on their behalf. Use it. Designate your compliance lead or practice administrator, get the nominations processed in the first quarter, and keep a roster of which clinicians have an active representative and which do not. Track separation events too — a physician who left in October still has a payment record publishing in June.

Weeks 2–3: build the internal ledger before you look at the CMS file

Reviewing CMS data cold is useless. You need something to compare it against. Pull together, for the collection year:

  • Vendor and rep sign-in logs, by date and location
  • Catered meal records — invoices, headcounts, and which clinicians actually attended
  • Executed consulting, speaking, and advisory board agreements, with payment schedules
  • Travel authorizations and reimbursements tied to manufacturer events
  • Research agreements, sub-award budgets, and any per-subject payments
  • Royalty and license agreements, and any ownership or investment disclosures on file

Meals are where disputes cluster. Manufacturers allocate the per-person value of catered food across attendees, and their headcount is often the rep's estimate. If your front desk keeps a dated sign-in log and your practice manager keeps the invoice, you have evidence. If neither exists, you have an argument.

Weeks 4–5: reconcile, then dispute with specifics

Work line by line. The common defects are mundane: name and credential mismatches, payments attributed to the wrong clinician with a similar name, an NPI or state license number that belongs to someone else, a covered product listed that your practice does not use, and duplicated records for a single event.

Disputes go to the reporting entity, not to CMS — CMS does not adjudicate. Write the dispute like a claims appeal: the specific record ID, what is wrong, what the correct value is, and what document supports it. Vague disputes get closed unchanged.

Week 6: document the outcome

Log every dispute, the response, and whether the record was corrected, withdrawn, or left standing. That log is your defense the following year when the same manufacturer makes the same error, and it is the first thing a board or a payer will ask for if a published figure ever becomes a question.

Where CMS Open Payments Collides With HIPAA

The published data contains no PHI. It is about your clinicians, not your patients, and nothing in the Open Payments file triggers a Privacy Rule obligation on its own.

The exposure runs the other direction. Every relationship that produces an Open Payments record also produces a person, a company, or a data flow inside your practice — and those are where the privacy failures live.

The rep who is in the room

A sales representative who drops off lunch in the break room is not a business associate. A representative who is present during a procedure, who programs or calibrates a device using patient parameters, or who accesses your systems to pull utilization data is a different situation entirely.

Your policy should define, in writing, where non-employees may go, what escort is required, whether a workforce member must be present at any workstation the rep can see, and what happens to a sign-in sheet at the end of the day. Sign-in sheets kept on the counter next to a schedule printout are a small breach waiting for a bad afternoon.

Speaker decks and case presentations

Speaking fees are one of the largest categories in the database, and speaker programs run on case material. If a clinician in your practice builds a deck from their own patients for a manufacturer-sponsored talk, the practice — not the manufacturer — owns the de-identification problem.

Safe Harbor requires removal of all eighteen identifier categories, and dates, rare diagnoses, and small-geography detail routinely survive a casual scrub. HHS publishes guidance on both de-identification methods; the practical control is a second reviewer who is not the presenter, signing off before the deck leaves the building.

Research payments carry data obligations the payment record does not show

Research payments appear in a separate publication with the study name and principal investigator. What the record does not show is what patient data moved to the sponsor and under what instrument — authorization, a limited data set with a data use agreement, or a waiver. Your research coordinator and your privacy officer should be reconciling the study list against the executed data agreements once a year, ideally during the same weeks you are reviewing payment records.

The BAA gap you find every year

Run your vendor list against the manufacturers appearing in your clinicians' Open Payments records. You will usually find at least one company that is doing more than selling — running a patient support or adherence program, hosting a device data portal your staff logs into, operating a registry you submit to, or receiving identifiable outcomes data under a "consulting" arrangement.

Those are business associate functions. HHS explains the analysis in its business associate guidance, and the test is what the entity does with PHI on your behalf, not what the contract is titled. When you find a gap, close it before the relationship generates another year of records — you can generate a signature-ready Business Associate Agreement through a short guided wizard and export it as PDF or DOCX the same day, rather than waiting on a redline cycle with the manufacturer's legal department.

Records-Handling Rules for the Open Payments File

Reporting entities must retain their supporting documentation for at least five years from the date of publication. Mirror that retention internally. Your ledger, dispute log, agreements, and sign-in records should live for the same period, in a location your privacy officer controls.

Keep the internal conflict-of-interest file separate from anything containing PHI, and separate from personnel files if your state treats those differently. The published CMS data is public; your clinicians' internal disclosures — including family ownership interests — are not, and staff should not have casual access to them. Assign explicit permissions and review them annually alongside the rest of your access controls.

What Billing and Charge Capture Staff Need to Know

Two Open Payments categories touch your revenue cycle directly: long-term medical supply or device loans, and items provided at no cost or reduced cost. Your billing lead needs a written cross-check confirming the practice does not charge a payer for supplies or devices it did not purchase, and that warranty credits and replacements are handled according to your documented policy.

This is a documentation and internal-controls question, not a coding-selection question. Practices establish it by writing down who verifies acquisition cost, what source document supports each supply charge, and who signs off before the claim goes out. Keep code selection where it belongs — with the clinician's documentation and your certified coding staff applying current payer guidance — and keep the Open Payments cross-check as an administrative control on top of it.

Six Failure Points That Cost Practices the Window

  1. Nobody registered. Identity proofing takes longer than you think. Do it in February.
  2. Departed clinicians. Their records still publish. Decide now who reviews them.
  3. No headcount evidence. Without a sign-in log, meal allocations are undisputable in practice.
  4. Advanced practice clinicians left out. Your COI form and your review roster both need updating.
  5. Duplicate identity records. Multiple state licenses and name variants split a clinician's data across entries.
  6. No dispute log. The same manufacturer repeats the same error, and you start from zero every April.

Your January Setup, in Five Lines

Confirm the covered-recipient roster including advanced practice clinicians. Verify or complete CMS registrations and authorized representative nominations. Reopen the vendor and rep sign-in log for the new collection year. Reconcile the manufacturer list against executed BAAs and data use agreements. Calendar April 1 and the correction deadline as hard tasks with named owners.

Start the registrations and the roster this month. Then work the vendor list — if the reconciliation turns up manufacturers touching PHI without a signed agreement, build and export the BAA in an afternoon, and keep the rest of your risk analysis and policy set current on the same annual cycle. You can verify the current dates, thresholds, and program rules directly at CMS Open Payments, and search published records at the CMS Open Payments data site.