Delegated Entity: CMS Rules, FDR Oversight, and Subdelegation

CMS compliance for a delegated entity rests on one rule the sponsoring health plan cannot negotiate around: no matter what it hands off to another organization, it keeps full responsibility to CMS for the work. Everything else — the required contract terms, the audits, the monitoring, the training obligations — flows from that principle. If you run compliance for a Medicare Advantage organization, a Part D sponsor, or a Medicaid managed care plan, delegation is a way to distribute the work, never the risk.

How CMS Defines a Delegated Entity

CMS uses the umbrella term “First Tier, Downstream, or Related Entity,” usually shortened to FDR, for organizations performing work under a health plan’s contract. A first tier entity contracts directly with a Medicare Advantage organization or Part D sponsor to provide administrative or health care services for Medicare enrollees.1Centers for Medicare & Medicaid Services. Medicare Managed Care Manual Chapter 11 – Medicare Plus Choice Contract Requirements A downstream entity sits below the first tier through a written arrangement with that first tier entity rather than the plan itself. A related entity is one tied to the plan through common ownership or control that furnishes services, manages functions, or leases property to it.

Medicaid managed care uses different wording for the same structure. The delegated party is called a “subcontractor,” but the mechanics match: the managed care organization delegates a function, the subcontractor performs it, and the MCO stays on the hook for compliance with its state contract.2eCFR. 42 CFR 438.230 – Subcontractual Relationships and Delegation

Required Provisions in the Written Arrangement

Every delegation has to be documented, and the document has to contain specific provisions federal regulators wrote themselves. On the Medicare Advantage side, 42 CFR 422.504 lists what each contract with a delegated entity must include:

Medicaid managed care carries parallel obligations under 42 CFR 438.230. The subcontractor must agree to perform the delegated activities in compliance with the MCO’s state contract, and the written arrangement must allow revocation or spell out other remedies when performance falls short.2eCFR. 42 CFR 438.230 – Subcontractual Relationships and Delegation

One boundary worth flagging: when the delegated entity will handle protected health information, the CMS-required delegation contract does not satisfy HIPAA. A separate Business Associate Agreement is required in addition, with its own required terms around use, disclosure, safeguards, breach reporting, and return or destruction of data at contract end.4U.S. Department of Health & Human Services. Business Associate Contracts

Audit Rights and Ten-Year Record Retention

One required provision deserves separate attention because of how far it reaches. The delegated entity has to agree that HHS, the Comptroller General, and their designees can audit, evaluate, and inspect any books, contracts, computer systems, and medical records related to the health plan’s CMS contract.3eCFR. 42 CFR 422.504 – Contract Provisions Government auditors can go directly to the delegated entity for records without routing the request through the plan, though CMS will generally notify the plan when it does.

The retention obligation is long. The right to audit pertinent records lasts 10 years from either the end of the contract period or the completion of any audit, whichever comes later.3eCFR. 42 CFR 422.504 – Contract Provisions Medicaid mirrors this window for subcontractor records and adds that when the state, CMS, or the HHS Inspector General suspects fraud, they may inspect subcontractor records at any time without following the usual procedural steps.2eCFR. 42 CFR 438.230 – Subcontractual Relationships and Delegation

Pre-Delegation Evaluation and Ongoing Monitoring

Signing the contract starts the compliance obligation rather than ending it. Two phases matter: what happens before the delegation goes live, and what happens every year after.

Before Delegation Begins

The plan has to determine whether the prospective entity can actually do the work. Under NCQA’s delegation oversight framework, that means a formal pre-delegation evaluation for each delegated function, examining the entity’s systems, policies, staffing, and capacity against the plan’s own regulatory obligations. When the entity already holds NCQA accreditation or certification for the function at issue, the plan may take automatic credit for parts of the evaluation rather than duplicating the work.

After Delegation Is Active

Federal rules require ongoing monitoring, and NCQA operationalizes that into at least an annual review of the delegate’s program and performance. The plan evaluates the delegate’s activities across each delegated function and identifies opportunities for improvement. When monitoring turns up problems, the contractual remedy provisions come into play. The plan can impose a corrective action plan with specific steps and deadlines, or it can revoke the delegation and bring the function back in-house. What it cannot do is nothing. Passive oversight is treated as a compliance failure in its own right by both CMS and accreditation bodies.

FDR Training and Exclusion Screening

CMS requires two types of training for every FDR: general compliance training and training on detecting and preventing fraud, waste, and abuse. New employees must complete both within 90 days of hire, and everyone repeats them annually. CMS provides its own training modules, and employees must score at least 70% on a short test to receive the certificate of completion.5Centers for Medicare & Medicaid Services. Compliance and FWA Training Requirement Update The sponsoring plan is responsible for making sure its FDRs actually complete the training. Auditors will ask for the documentation.

Exclusion screening is separate and continuous. Delegated entities must screen employees, contractors, and vendors against the OIG’s List of Excluded Individuals and Entities. Federal healthcare programs cannot pay for any services or items provided by an excluded person, whether that person is an employee, contractor, or volunteer. OIG updates the list monthly, and the standard industry practice is to screen against it on the same monthly cycle.6HHS Office of Inspector General. Exclusions

Subdelegation and the Downstream Chain

A first tier entity can further delegate functions to a downstream entity, extending a chain below the original arrangement. CMS expects the same written arrangement requirements to flow down through each level of the chain. Each downstream entity must agree to the same audit rights, compliance obligations, and record access provisions that bind the first tier entity.1Centers for Medicare & Medicaid Services. Medicare Managed Care Manual Chapter 11 – Medicare Plus Choice Contract Requirements

The health plan at the top stays accountable across the full chain, including entities it has no direct relationship with. If a downstream entity two or three levels removed commits a compliance violation, regulators come to the sponsoring plan. Because of that exposure, some plans require advance approval before a first tier entity can subdelegate, and functions involving offshore work often require a separate approval process before any work moves outside the country.

What Happens When Compliance Fails

The accountability structure is deliberately asymmetric. The plan bears the regulatory consequences even when the delegated entity caused the problem. CMS can impose intermediate sanctions and civil money penalties on the sponsoring plan for failures anywhere in its FDR chain.7eCFR. 42 CFR 422.752 – Civil Money Penalties OIG can impose additional penalties under its own authority, and on the Medicaid side, the state agency can take enforcement action against the MCO for its subcontractor’s failures.

Within the delegation relationship, the plan manages accountability through the mechanisms already written into the contract. A typical escalation path:

  • Routine monitoring identifies a gap and the plan requests an explanation or additional data.
  • A formal corrective action plan requires the entity to fix specific problems within defined timelines.
  • Financial penalties, such as liquidated damages or fee reductions, hit when performance benchmarks are missed.
  • Revocation ends the delegation and the plan either brings the function in-house or moves it to another entity.

How fast this moves depends on severity. Slow claims turnaround might trigger a corrective action plan. Discovering that an excluded individual has been providing services can lead to immediate revocation, because the plan’s own compliance status is on the line.

Retained Accountability

The single principle organizing all of the above is retained accountability. The delegating organization can never transfer its ultimate responsibility. On the Medicare side, 42 CFR 422.504 states it directly: regardless of any relationships an MA organization has with its FDRs, the organization maintains ultimate responsibility for complying with all terms of its CMS contract.3eCFR. 42 CFR 422.504 – Contract Provisions Medicaid managed care rules use nearly identical language: the MCO maintains ultimate responsibility for adhering to all terms of its state contract, regardless of its subcontractor relationships.2eCFR. 42 CFR 438.230 – Subcontractual Relationships and Delegation

This is why the monitoring obligations are so extensive, why audit rights extend 10 years, and why plans invest heavily in oversight infrastructure. Delegation can bring in specialized expertise and improve efficiency. It does not reduce the plan’s legal exposure by a single degree.