A health plan’s regulated work often reaches well beyond its own walls. A pharmacy benefit manager (PBM) processes Part D claims. A delegated independent practice association or medical group makes utilization management decisions or credentials its clinicians for the plan. Agents, brokers and other third-party marketing organizations sell plans and enroll members. Other vendors print member notices or staff call centers.
The label matters. CMS treats some third parties as first tier, downstream or related entities (FDRs), with specific contract and oversight requirements. Other vendors fall outside those rules, but not outside the plan’s risk: the HHS Office of Inspector General (OIG) notes that fraud and abuse liability does not depend on FDR status and recommends screening contractors against its exclusion list. And a third party handling protected health information (PHI) for the plan is generally a HIPAA business associate. So before work changes hands, a plan needs to know what each third party will do, whether that makes it an FDR and how much risk it carries.
Federal rules state that a Medicare Advantage organization keeps ultimate responsibility for its CMS contract, regardless of its relationships with FDRs. In February 2026, OIG issued new compliance program guidance for MA organizations, its first major update since 1999, with a full section on third-party oversight. Oversight also has to hold up afterward: if an audit raises a finding involving a delegate, a dated record of what the plan monitored, found and fixed puts it in a better position.
The Rules
What the rules require
Under 42 CFR 422.504(i), when an MA organization delegates contract activities to an FDR, the written arrangement must specify the delegated activities, provide for revocation or other remedies if performance is unsatisfactory, provide for ongoing monitoring and require compliance with Medicare rules. HHS and the Comptroller General can audit FDR records for 10 years from the end of the contract period or the completion of an audit, whichever is later. 42 CFR 422.503(b)(4)(vi) requires an effective system for routine monitoring and identification of compliance risks, including audits that evaluate the compliance of the plan and its first tier entities; Part D rules run parallel. Under 42 CFR 438.230, Medicaid managed care plans remain responsible for their state contracts regardless of subcontracts.
- Specifies the delegated activities
- Provides for revocation or other remedies if performance is unsatisfactory
- Provides for ongoing monitoring
- Requires compliance with Medicare rules
Separate Systems
When FDRs and vendors sit in separate systems
When delegated entities sit in one system and other vendors in procurement, vendor-risk or IT security tools, each can be accurate and still miss what happens between them.
| What the requirement expects | What can slip between systems |
|---|---|
| FDR contract terms and ongoing monitoring (42 CFR 422.504(i)) | A vendor that takes on delegated work can stay in the vendor system, without FDR terms or monitoring. |
| No payments to individuals or entities on the CMS preclusion list, plus periodic exclusion checks of contractors (42 CFR 422.504(i)(2)(v); OIG) | Each system may screen on its own schedule, leaving gaps the plan cannot easily document. |
| Business associate agreements for third parties handling PHI (45 CFR 164.504(e)) | Business associate and delegation status live apart, obscuring who handles PHI and under what terms. |
| Regulatory changes passed down to delegates (OIG) | An HPMS memo reaches delegates but not an affected vendor. |
Oversight gaps, whatever their source, can reach audit results and members. CMS’s 2024 audit and enforcement report described routine monitoring that missed untimely enrollee notices after a delegated entity misinterpreted regulatory requirements. When CMS weighs compliance actions under 42 CFR 422.504(m), one factor is a plan’s lack of oversight that contributed to the noncompliance.
Role Changes
When a third party’s role changes
FDR status follows the functions a third party performs, and those can shift: a print vendor takes on the timing of member notices, or a vendor picks up Medicaid work in a new state. Depending on the facts, that may make it an FDR. If no one revisits the contract and oversight plan, the obligations change while the paperwork does not, and staff may be working under rules no one taught them. OIG’s broader guidance recommends that plans look for opportunities to train FDRs directly rather than relying on FDRs to train themselves.
The reverse carries risk too. When a function moves in house or to a new partner, record access, open corrective actions and member impact from the delegated period remain. Records need to show when the status changed, why, which oversight continues and where pending work now sits. The same CMS report described members with approved prior authorizations who could not get their medications because active authorization files were not properly transmitted to a new PBM.
One Platform
What changes when FDRs and vendors share one platform
One platform does not erase the differences between FDRs and vendors; it puts them in one place. Classification follows one written standard, applied to each third party’s recorded functions. When a recorded change affects the FDR criteria, the platform can flag it for review, and the status changes on the same record only after the plan’s designated reviewers approve it. The compliance committee sees the full third-party population, and each relationship’s evidence sits in one record with a dated history of changes.
- Contracted as a vendor · BAA on file
- Scope change proposed: timing of member notices
- Classified against the written FDR criteria
- FDR status · contract terms and oversight plan updated before the function starts
See delegated entities and vendors in one record
A 30-minute demo shows how delegation and vendor oversight can run on one platform, alongside your existing systems.
Request a DemoIn Practice
What effective oversight looks like
Plans can start with existing tools; a single platform can make each step easier to run and to prove.
- 1Inventory functionsNot just vendors
- 2Assess before delegatingAgainst written FDR criteria
- 3Match reporting to riskFunction · data · members · past performance
- 4Close corrective actionsVerify each fix before closing
- 5Treat scope changes as risk eventsSOW amendment · state expansion · vendor transition
Inventory functions, not just vendors. Record what each third party does, for which lines of business and states, with its FDR status, PHI access and risk tier. A vendor list shows whom the plan pays; a function list shows what it remains accountable for.
Assess before delegating. Before contracting, classify the relationship against written FDR criteria, since that status determines what the contract must include. Then review its compliance program, reporting capability, privacy and security safeguards, and exclusion and preclusion status, backed by documents and attestations.
Match reporting to the function and the risk. Set measures that fit each function, in a consistent format, and base reporting frequency on risk: the function, the data and members involved, and past performance, a factor OIG names. Regular monitoring can catch issues before an audit does. Errors still happen, but a plan with that record is better placed to show how it responded.
Close corrective actions with evidence. Corrective actions may be open with several delegates at once. Tracking owners and deadlines in one place, and verifying each fix worked before closing it, makes stalls less likely and leaves a clear record of accountability.
Treat scope changes as risk events. They can begin outside compliance, in a statement of work amendment, a state expansion or a vendor transition. Routing them to designated reviewers keeps the contract and oversight program in step with the work.
Technology does not replace judgment; compliance staff still decide which findings matter and when a relationship should end.
Self-Check
Questions worth asking
A few questions can show where an oversight program stands:
- 01If a vendor’s role changed last quarter, would the oversight program know?
- 02Could the team list each third party that handles PHI, and the agreement that covers it?
- 03If a delegated function moved to a new partner tomorrow, what would carry over, and who would own it?
- 04For a finding involving a delegate, could the plan show what it monitored, what it found and what it fixed?
Delegation is likely to keep expanding as plans add partners, enter new states and adopt new technology. Plans that can see each third-party relationship, and each change to it, in one place will be better prepared for what comes next. If you are working through these questions, the Inovaare team would be glad to compare notes.
Sources: 42 CFR 422.504, Contract provisions; 42 CFR 422.503, General provisions; 42 CFR 438.230, Subcontractual relationships and delegation; 45 CFR 164.504(e), Business associate contracts; HHS-OIG, Medicare Advantage Industry Segment-Specific Compliance Program Guidance (February 2026); CMS, 2024 Part C and Part D Program Audit and Enforcement Report.