Paying Doctors and Nurses for Research: Sunshine Act Reporting, EFPIA Disclosure and Fair Market Value

In the United States, market-research payments to physicians are generally excluded from Open Payments reporting when an intermediary pays the participant and the sponsoring manufacturer never learns their identity. In Europe, EFPIA disclosure is required only when the pharmaceutical company knows the identities of the people who took part. In both regimes the compliance mechanism is the same thing: the identity firewall between the sponsor and the respondent — not the size of the payment.

That single structural fact decides most of what follows. If you are running research with healthcare professionals and you have been worrying about how much you can pay them, you have been worrying about the second-most important question.

This guide covers the transparency-reporting and anti-kickback dimension of paying HCPs. It is a different body of law from participant incentive taxation, which is covered in research participant incentives and taxes, and from recruitment practice, covered in HCP research. None of this is legal advice; regulated-sector work needs your own compliance team's sign-off.

First: does any of this apply to you?

A great many teams researching clinicians are not covered by these rules at all, and burn weeks of compliance review discovering it.

United States. Open Payments obligations fall on an applicable manufacturer — broadly, a company that produces a drug, device, biological or medical supply for which payment is available under Medicare, Medicaid or CHIP — and on group purchasing organisations. A health-tech SaaS company, a digital-health startup selling to providers, an insurer or a hospital system is generally not an applicable manufacturer, and its research payments are not reportable under this regime. A medical-device or pharmaceutical manufacturer is, and its payments are.

Covered recipients are physicians, teaching hospitals, and — since 1 January 2021, under the SUPPORT Act — physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anaesthetists and anaesthesiologist assistants, and certified nurse-midwives. Registered nurses who do not hold one of those advanced credentials are not covered recipients.

Europe. The EFPIA Disclosure Code binds EFPIA member companies, their affiliated national association members, and anyone who has agreed to adhere to a national code of practice. It applies to prescription-only medicines, and to over-the-counter medicines only when dispensed on prescription.

If neither test catches you, the transparency-reporting sections below are informational. The fair-market-value and anti-kickback sections still matter, because those obligations attach to the payment itself rather than to a reporting regime.

The US position: the intermediary exclusion

The 2026 de minimis thresholds are $13.07 for an individual payment and $130.66 in aggregate to a single covered recipient in a calendar year — figures adjusted annually for CPI. Cross either and reporting is triggered for a covered payment.

But market research payments typically never reach that test, because they fall outside the reportable category in the first place. The statutory exclusion covers payments where the participating physician is paid by an intermediary — a market research firm — and their identity is not disclosed to the sponsoring manufacturer.

The important and frequently misunderstood detail: the exclusion applies to single-blind research as well as double-blind. Double-blind means neither side knows the other's identity. Single-blind, in this context, means the manufacturer does not know who the participants are, even though the participants may know which company sponsored the study. Because it is the manufacturer's knowledge that triggers reporting, single-blinding is sufficient. This matters practically, because plenty of legitimate research cannot be run without telling participants whose product they are evaluating.

Manufacturers report to CMS by 31 March each year; covered recipients then have 45 days to review and dispute before publication, which occurs around 30 June.

The EU position: EFPIA, and the list trap

The EFPIA Disclosure Code addresses market research directly, and the drafting is unusually precise. Under 4.33, disclosure is required when the pharmaceutical company is aware of the identities of those participating in market research it has commissioned and transfers of value have been made — in which case payments to individual named HCPs must be disclosed publicly, whether paid directly or indirectly via an agency. Routing money through your agency does not, by itself, break the reporting obligation. Only ignorance of identity does.

Then comes the trap that catches experienced teams, at 4.34:

If a sample is to be drawn from a list of HCPs supplied by the pharmaceutical company, the identity of those actually interviewed will not be known and so disclosure is not required. However, if all those on the list are to be interviewed, then the company will be aware of the identity of the HCPs involved.

Read that twice if you run small-n specialist research. Sampling 40 rheumatologists from a list of 300 preserves the blind. Interviewing all 40 on a list of 40 destroys it, because the sponsor can now name every participant by deduction. The blind is a property of the sampling ratio, not of your intentions or your contract with the agency. In rare-disease and niche-specialty work, where the addressable population may be a few dozen clinicians, this is a live and recurring problem — and it is the single most common way a study that was designed to be non-reportable becomes reportable.

Three further provisions worth knowing:

• 4.35 — where identity will be known, HCPs must be told disclosure will take place and asked to consent to their personal data and payment information being passed on, as soon as practical and generally at recruitment.
• 4.36 — if consent is refused, the payments must still be disclosed, but on an aggregate basis. Refusing consent does not remove the payment from the disclosure regime; it only removes the name. Participants sometimes need this explained to them.
• 4.40 — if an HCP's identity becomes known to the company only as a result of an adverse event report where reporter contact details were provided, disclosure is not required. Similarly, if a participant is recognised by client personnel while viewing non-anonymised fieldwork, disclosure may not be required.

US and EU compared

Fair market value, and what you may not do

Even where nothing is reportable, the payment itself is constrained. The EphMRA Code of Conduct, which governs pharmaceutical market research across Europe, sets out at 4.21 that an incentive should be dependent only on completing the interview, kept to a minimum, appropriate to the time involved, appropriate to the subject type and task — and no more than the fair market value for that individual's professional consultancy or advice. For patients and members of the public, the Code is explicit that an incentive is a token of appreciation, not a fee for time.

Fair market value for a clinician is normally derived from their professional hourly rate by specialty and geography, prorated to the actual interview length. Document the derivation before fieldwork, not after a question is asked about it. An unexplained round number is the thing that attracts scrutiny.

4.24 lists incentives that are not allowed at all:

The US Anti-Kickback Statute reaches the same territory from a different direction: remuneration must be at fair market value, commercially reasonable, supported by a genuine business need, and never varied by the recipient's prescribing or purchasing volume. In practice, if your honorarium schedule is uniform by specialty and interview length, documented in advance, and blind to the participant's prescribing behaviour, you are on the right side of both frameworks.

Note also 4.22: participants must be clearly told who administers the incentive, what it is, when they will receive it, and any conditions attached. And under 4.8, in list-based sampling, the client company must not be informed of the identity of participants — the operational expression of everything above.

The one-business-day rule everybody discovers too late

Any research touching a medicinal product, device or diagnostic carries a pharmacovigilance obligation that has nothing to do with payment, and it catches teams by surprise more often than any other item in this article.

Under the EphMRA Adverse Event Reporting Guidelines (revised September 2025), adverse events must be reported to the marketing authorisation holder's pharmacovigilance function within one business day of the research agency or its subcontractor becoming aware of them. The narrow exceptions are syndicated studies where data are collected independently of individual companies, and longitudinal patient databases.

Practical mechanics that make this workable:

• 3.1 — the participant must be informed of the AE reporting obligation both at recruitment and at the start of the interview. Not one or the other.
• 3.2 — the report is completed at the end of the interview. There is explicitly no need to interrupt the session to do it, which is the thing interviewers most often get wrong.
• 3.4 — a valid report requires four minimum criteria: an identifiable reporter, an identifiable patient or group of patients, one or more suspected medicinal products, devices or diagnostics, and a suspected adverse event.
• 3.5 — both solicited AEs (from organised data collection, which includes every interview and survey you run) and unsolicited ones must be passed to pharmacovigilance.
• Country exception worth flagging: in Germany, the manufacturer must not know the identity of the participant, so follow-up on incomplete reports must be routed back through the research agency.

The tension between AE reporting and the identity firewall is real and it is resolved, not ignored: EFPIA 4.40 confirms that identity learned solely through an AE report does not trigger disclosure.

Country-specific provisions to check

Building the identity firewall in practice

1. Decide the regime first. Applicable manufacturer, EFPIA adherent, both or neither. This determines everything downstream.
2. Sample, never census. Draw a subset from any client-supplied list, and record the sampling ratio in the study documentation. If the addressable population is small enough that a subset is not meaningful, accept that the study is reportable and plan for consent under 4.35.
3. Pay through the agency or platform, never from the sponsor. Both regimes turn on this.
4. Set the honorarium schedule before fieldwork, derived from specialty rates and interview length, and keep the derivation.
5. Brief the AE obligation twice — at recruitment and at interview start — and set up the one-business-day route to pharmacovigilance before the first session, not after the first event.
6. Restrict who sees raw material. If client personnel view non-anonymised fieldwork, participants may be recognised. Anonymise transcripts and quotations before they cross the firewall.
7. Capture re-contact consent during the interview. Under EphMRA 4.18, re-contact requires a lawful basis obtained before the interview ends, and a generic "may we contact you for future research?" is explicitly insufficient.

Where an AI research platform fits

The firewall is an information-flow problem, and information flow is a property of your tooling as much as your policy.

Running HCP research on a platform like Koji, the sponsor's team works with transcripts, structured answers and generated reports rather than with a recruitment list. Recruitment identity stays with whoever sourced the sample; what reaches the analysis layer is the conversation. That separation is the thing both regimes are asking you to demonstrate, and it is considerably easier to evidence when it is a property of how the study runs than when it is a promise in a statement of work.

Two more specifics worth noting for regulated work:

• Structured questions — six types: open_ended, scale, single_choice, multiple_choice, ranking and yes_no — let you make the AE screen a deterministic part of the instrument rather than something an interviewer might forget. A yes_no item on experience of an adverse event, with an open_ended follow-up, produces a consistently-located, machine-readable field across every conversation in the study. You still need a human pharmacovigilance process behind it; what you gain is that the question was asked identically of everyone.
• AI follow-up questions get to the reasoning behind a clinician's answer without a moderator in the room. For HCP research that is a scheduling advantage above all: specialists are the hardest population in research to book, and an interview they can take at 21:40 by voice or text — whichever suits them — converts at rates a calendar invitation does not.

Koji is a research platform, not a compliance system. It does not file Open Payments reports, maintain your disclosure templates or discharge your pharmacovigilance duty. What it can do is make the identity separation structural rather than procedural, which is the part teams most often fail to evidence when someone finally asks.

Frequently asked questions

Do I have to report what I pay a physician for a one-hour interview? If you are an applicable manufacturer and you know who they are, yes. If the interview was arranged and paid for by a research agency or platform and you never learn the participant's identity, the payment falls within the market research exclusion in the US and outside the EFPIA disclosure requirement in Europe. The amount is not the deciding factor; your knowledge of identity is.

Does the exclusion require double-blind research? No. Single-blind is sufficient, because the trigger is the manufacturer's knowledge of the participant's identity, not the participant's knowledge of the sponsor. Participants may know whose product they are assessing provided the sponsor does not learn who they are. Denmark is the exception worth checking: unblinded research there brings association-reporting rules into play.

We are a digital health company, not a pharma or device manufacturer. Does Open Payments apply? Generally not. Open Payments applies to applicable manufacturers of drugs, devices, biologicals and medical supplies reimbursable under Medicare, Medicaid or CHIP, and to GPOs. A software company selling to providers is usually outside it. Fair-market-value and anti-kickback principles still apply to your payments, and your customers' own compliance teams may impose contractual requirements regardless.

What happens if a participant refuses consent to be named in an EFPIA disclosure? They can still take part, and the payment is still disclosed — but on an aggregate basis rather than under their name (EFPIA 4.36). The aggregate report must state the total transfers of value, the number of recipients, and the percentage they represent of all recipients disclosed.

How quickly must an adverse event mentioned in an interview be reported? Within one business day of the agency or its subcontractor becoming aware of it, per the EphMRA Adverse Event Reporting Guidelines. The report is completed at the end of the interview rather than by interrupting it, and the participant must have been told about the obligation both at recruitment and at the start of the session.

Can I interview every clinician on a list the sponsor gave me? You can, but doing so ends the blind: the sponsor then knows exactly who participated, and disclosure becomes required (EFPIA 4.34). Draw a subset instead. Where the specialty is so small that a subset is not meaningful, plan for a disclosed study from the outset and collect consent at recruitment.

Related Resources

• Structured Questions in AI Interviews — making screens and safety questions a deterministic part of the instrument
• HCP Research: Recruiting and Interviewing Physicians and Nurses — the recruitment practice this sits on top of
• Research Participant Incentives and Taxes — the tax dimension of the same payment
• Research Incentive Strategies: What to Pay and How — deriving a defensible honorarium
• HIPAA-Compliant AI User Research — the privacy regime alongside the transparency one
• Is It Legal to Email or Text Someone for Research? — outreach law for recruitment
• Do You Need IRB Approval for User Research? — when ethics review is also in scope

---

Running research with clinicians? Start free with 10 credits and see how AI-moderated voice and text interviews fit specialist schedules — with structured questions and automatic analysis.