HCP compliance is the set of policies, controls and processes that govern how pharmaceutical and medical device companies interact with healthcare professionals. Those interactions include speaker programs, consulting agreements, advisory boards, meals, travel, educational grants and promotional activities. Depending on the type of engagement, who is involved and which rules apply, each one can trigger legal, disclosure and internal compliance requirements.
This guide covers the laws behind HCP compliance, how to build a program around the OIG’s seven elements, and where the biggest risks are. Throughout, it links to ZHM’s detailed guides on each topic.
What HCP compliance covers
- Speaker programs, live and virtual
- Consulting arrangements and advisory boards
- Meals, travel and lodging for HCPs
- Educational and research grants
- Promotional materials and what reps and speakers say
- Transparency reporting of payments to HCPs
- Vendors who interact with HCPs on your behalf, including speaker bureaus and event agencies
The laws behind HCP compliance
The federal Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)). This makes it a felony to knowingly and willfully offer or pay anything of value to induce someone to refer, prescribe, order or recommend items or services paid for by a federal health care program. The criminal penalties are fines of up to $100,000, up to 10 years in prison, or both. The conduct has to be knowing and willful. But a person doesn’t need actual knowledge of the statute, or specific intent to violate it. Under the statute, a claim that includes items or services resulting from a violation is a false or fraudulent claim for the purposes of the False Claims Act.
The Sunshine Act (Open Payments). Manufacturers report most payments and other transfers of value to covered recipients to CMS, which publishes them. See our guide to Sunshine Act reporting requirements.
FDA promotion rules. These depend on the type of product. Prescription drug advertising and promotional labeling must meet FDA requirements, including the submission duty under 21 CFR 314.81(b)(3)(i). Biological products and medical devices each have their own frameworks. Whatever the product, promotional communications must be truthful, not misleading, and properly supported.
The PhRMA Code. The PhRMA Code on Interactions with Health Care Professionals is a voluntary industry code. It covers speaker programs, consulting arrangements, meals and more, and gives practical guidance on how companies should conduct themselves. The OIG has described it as useful and practical.
State laws. Some states add gift bans, meal limits or their own reporting. See our state-level compliance roadmap.
It helps to keep three kinds of rules apart:
| Type | Examples | Binding? |
|---|---|---|
| Law and regulation | Anti-Kickback Statute, Sunshine Act, FDA regulations, state laws | Yes |
| Government guidance | OIG compliance program guidance, OIG Special Fraud Alerts | No, but shows how the government views risk |
| Industry codes and company policy | PhRMA Code, your own SOPs | Voluntary codes, but binding inside your company once you adopt them |
The risk is real. In April 2025, Gilead agreed to pay $202 million to resolve allegations that it used speaker programs to pay kickbacks to doctors. A settlement resolves allegations. It isn’t a court finding that every allegation was true.
HCP compliance program: the seven elements
In November 2023, the HHS Office of Inspector General published its General Compliance Program Guidance. It describes seven elements of an effective compliance program. The guidance is voluntary and nonbinding, but it’s a widely recognized framework for designing and evaluating healthcare compliance programs. Here’s how each element applies to HCP interactions:
| OIG element | What it means for HCP interactions | Go deeper |
|---|---|---|
| 1. Written policies and procedures | Policies on speaker programs, FMV, meals, consulting and grants, which vendors follow too | PhRMA Code on speaker programs |
| 2. Compliance leadership and oversight | A compliance officer who reports to the CEO or board, and a committee that reviews HCP spend | OIG guidance for speaker programs |
| 3. Training and education | Training for reps, speakers and vendors on approved content and the rules | Compliance training for HCP speakers |
| 4. Effective lines of communication with the compliance officer and disclosure programs | A way to raise concerns anonymously, and a culture where people use it | OIG General Compliance Program Guidance |
| 5. Enforcing standards: consequences and incentives | Clear consequences for breaking policy, and incentives that don’t reward risky behavior | OIG General Compliance Program Guidance |
| 6. Risk assessment, auditing and monitoring | Regular risk assessments, program monitoring, and a full audit trail for each engagement | Audit trail checklist for HCP engagement |
| 7. Responding to detected offenses and developing corrective action initiatives | Investigating issues, fixing root causes, and correcting or disclosing reports when needed | 7 speaker program compliance mistakes |
High-risk HCP activities
The OIG’s compliance guidance for pharmaceutical manufacturers (2003) is still the OIG’s industry-specific guidance for pharma. It names these risk areas in relationships with physicians:
- Switching arrangements: payments or other remuneration meant to get healthcare professionals to switch patients from one product to another
- Consulting and advisory payments: there must be a legitimate need, and the pay must be fair market value. See our guides to the speaker honorarium and negotiating speaker agreements.
- Payments for detailing: paying HCPs to spend time with sales representatives
- Business courtesies and other gratuities: meals, entertainment and gifts
- Educational and research funding: arrangements that may hide an improper inducement, or that reward prescribing instead of supporting real education or research
Speaker programs have their own warning signs, listed by the OIG in its 2020 Special Fraud Alert. They include:
- Little or no real educational content
- Alcohol, or meals beyond modest value
- Venues that don’t suit an educational exchange
- HCPs attending the same program more than once
- Attendees with no legitimate business reason to be there
- Sales or marketing teams influencing who is chosen as a speaker
Our list of 7 speaker program compliance mistakes covers these in detail. So does our checklist for avoiding off-label promotion.
Life sciences compliance for small and mid-sized teams
Small companies face the same rules as large ones with far fewer people. What works:
- Write policies for the activities you actually run. A company that runs speaker programs and advisory boards doesn’t need a 200-page manual on everything.
- Set up the controls before launch. Fixing a speaker program after a complaint costs far more than designing it properly.
- Hold vendors to your policies. A speaker bureau or event agency acts on your behalf. Make them sign up to your policies, check what they do, and get data from them in a format your compliance team can use.
- Treat virtual and hybrid programs the same as live ones. See our hybrid event compliance guide.
- Track spend as it happens. Our guide to aggregate spend tracking explains how.
HCP compliance checklist
Most items below are good practice drawn from OIG guidance and the PhRMA Code, not legal requirements on their own. Adjust them to your company’s risk profile with your compliance team.
- Written policies for every type of HCP interaction you run
- A compliance officer with direct access to leadership
- Training for reps, speakers and vendors, with records
- A documented FMV method, pay limits and approval controls for HCP compensation
- A needs assessment before each program series or consulting engagement
- Speaker selection based on expertise, never on prescribing
- Modest meals and suitable venues, plus a no-alcohol rule at speaker programs in line with the PhRMA Code and company policy
- Accurate attendance records with the right HCP identifiers
- A process for checking that Open Payments data is right before submission
- Regular risk assessments and program monitoring, scaled to your risk profile
- An anonymous way to report concerns, and a process for investigating them
More ZHM guides on HCP compliance
- OIG compliance guidance for speaker programs
- PhRMA Code on speaker programs
- State-level compliance for speaker programs
- Sunshine Act reporting requirements
- Speaker honorarium for HCPs
- Audit trail checklist for HCP engagement
- Avoiding off-label promotion at speaker events
- Compliance training for HCP speakers
- Hybrid event compliance
- Aggregate spend tracking
- HCP engagement workflow automation
How ZHM supports HCP compliance
ZHM is an operational partner. We help small and mid-sized pharma companies run HCP engagements inside the compliance framework they’ve already set. We don’t replace your legal or compliance team. Our speaker bureau management team handles speaker contracting on your approved rate card, training records, venue and meal limits, and attendance. The Zvent.ai HCP engagement platform keeps program details, attendance and spend together, so your compliance team can review them. For larger meetings, our pharmaceutical event management service applies the same controls.
Want a review of how your programs run today? Talk to ZHM.
FAQ
What is HCP compliance?
It’s the policies and controls that keep a pharma or device company’s interactions with healthcare professionals within the Anti-Kickback Statute, the Sunshine Act, FDA promotion rules, state laws and industry codes.
What are the seven elements of a compliance program?
The OIG lists written policies; compliance leadership and oversight; training; lines of communication and disclosure; enforcing standards; risk assessment, auditing and monitoring; and responding to detected offenses.
Is the PhRMA Code legally binding?
No. It’s a voluntary industry code. The OIG has described it as useful and practical guidance for structuring relationships with HCPs.
Is pharma compliance the same as HCP compliance?
Not quite. “Pharma compliance” often means manufacturing and quality rules such as GMP. HCP compliance covers how a company deals with healthcare professionals.
Are companies responsible for what their vendors do with HCPs?
Outsourcing HCP interactions doesn’t remove a company’s responsibility to oversee them. Make sure vendors follow your compliance policies, keep accurate records, and give you the information you need for monitoring and reporting.
What are the biggest HCP compliance risks for small pharma companies?
The usual ones are speaker programs run without a clear educational need, speaker pay with no documented FMV method, weak attendance records, and Open Payments data put together in a hurry at year-end. Small teams also tend to lean heavily on vendors without checking what those vendors actually do.
What should a pharma company monitor when it outsources speaker programs?
Speaker selection and contracts, pay against your rate card, venues and meals, attendance and repeat attendees, program content and any off-script discussion, and whether the spend data matches before it goes to Open Payments.
