Compliance Drift: The Gap Between What You Signed and What Is Happening

In April 2018, CMS published its Contract Year 2019 final rule. Among many other things, it rewrote the compliance program requirement at 42 CFR 422.503(b)(4)(vi)(C), and in doing so removed first tier, downstream and related entities from the training obligation entirely.

You can watch it happen in the annual editions of the CFR. The 2017 edition requires training and education "between the compliance officer and organization employees ... and the MA organization's first tier, downstream, and related entities." The 2018 edition requires it "for its compliance officer and organization employees, the MA organization's chief executive and other senior administrators, managers and governing body members." The FDRs are gone, and they have stayed gone through the current text.

The rule was published 16 April 2018, took effect 15 June 2018, and applied from 1 January 2019. Either way, more than seven years ago.

Ask a compliance team today whether their delegated entities are required to complete compliance and fraud-waste-abuse training and a good number will say yes, because their agreements say so and their audit templates check for it. Enforcing it is not wrong; a contractual obligation is a real obligation whether or not a regulation still demands it. What is wrong is believing CMS requires it, because that belief shapes where the program spends attention it does not have.

That is compliance drift, in its most ordinary and least dramatic form. Nobody was careless. A requirement moved, the paper did not, and no system was watching the gap.

Drift is a process, not a state

Non-compliance is a finding. Somebody looked, compared, and concluded. It has a date and usually a letter.

Drift is what runs in the years before that, and it has no date because nothing observes it. The contract is fixed at signature. Everything it depends on is not:

The counterparty changes. Vendors get acquired, and the acquirer's compliance program replaces the one you diligenced. Subprocessors get added without notice. The person who owned the relationship leaves.

The evidence changes. Insurance renews at different limits. A policy that satisfied a clause gets rewritten by someone who never read the clause. Certificates expire and are replaced by certificates that look identical and promise less.

The rule changes. This is the one almost nobody tracks, and the training requirement above is only one instance. A contract that cites a CFR section is pointing at text the agency can rewrite without telling the parties, and the citation keeps looking correct afterward.

Each of those moves independently. None of them announces itself. The agreement in the folder reads exactly as reassuring the whole time.

Why it surfaces adversarially

Drift has a characteristic discovery pattern: it is found by whoever benefits from finding it.

An auditor asks how you concluded a delegated entity was compliant in a quarter two years ago. A payor's recoupment letter reaches back further than your contract permits, and the person receiving it has no fast way to check. A breach investigation walks the subprocessor chain and reaches an entity nobody at your organization could have named. A buyer's diligence team reads your vendor agreements more carefully than you have since signing them.

In every one of those, the other party is looking and you are not. That asymmetry is the whole cost of drift. It is not that the gap exists - some gap always exists in a large vendor book. It is that you learn its size from someone with an interest in it being large.

The three comparisons nobody runs

Drift feels unmeasurable, and it is not. There are three comparisons, and each is computable once obligations are stored as items rather than as prose.

Contract against rule. Does the obligation the clause creates still match the section it cites? The training requirement is the clean example. An agreement that cites 422.503 as the authority for an FDR training obligation is citing a section that no longer imposes one.

That is a hypothetical, and worth separating from the document we actually pulled: the Alignment form does not mention training, and its one substantive 422.503 citation is a general reference to the compliance-plan requirement. What the form does show is the exposure surface. Counting every distinct Part 422 section referenced anywhere in the exhibit, 19 of 37 carry an eCFR amendment date later than the 3 March 2021 filing. Counting only the twelve bracketed authority citations the form itself flags, it is 5 of 12. Either way, a contract pointing at a CFR section that has since moved is a candidate for this check, and a form filed five years ago has dozens of them.

Evidence against contract. Does the certificate on file meet the limits this specific clause requires? Is there a countersigned BAA for every vendor that touches protected health information, carrying the provisions 45 CFR 164.504(e) requires? Is the last exclusion screening recent enough to matter?

Reality against evidence. Is the entity that signed still the entity performing? Are the subprocessors named in the disclosure the subprocessors currently in use?

Each of those is a diff. What makes them feel impossible is that the left-hand side is trapped inside a hundred-page document, in prose, unqueryable. Extract the obligations and all three become ordinary comparisons that run on a schedule.

What measuring it requires

An obligation has to carry its provenance. Not just "maintain $5 million general liability" but which clause said so, on which page, of which agreement, citing which regulation. Once that link exists, a change to the regulation is a diff you can compute rather than a surprise an auditor finds, and a certificate that arrives with lower limits fails a comparison rather than passing as current.

This is the work Harper does. It reads the executed agreements and extracts each obligation with its clause, page and citation, then runs those three comparisons continuously instead of at audit prep. When something moves - the rule, the evidence, or the counterparty - the gap surfaces as a change rather than as a finding. Every conclusion carries the document behind it, which is what makes it defensible later. We counted the obligations in seven real healthcare agreements to see what that extraction actually yields.

Find your own drift in fifteen minutes

You do not need software to confirm this exists in your own paper.

1. Open one vendor or delegated agreement and find a clause that cites a regulation by section number.
2. Pull that section from the eCFR and read it as it stands today.
3. Compare the wording. Note anything the contract paraphrases rather than quotes.
4. Check whether that section has been amended since your contract was signed.
5. Now find the evidence that satisfies that clause, and check its date.

If step 4 turns up an amendment nobody logged, or step 5 turns up nothing, you have measured your first two units of drift. The exercise does not scale by hand, which is the point. But it tells you whether anything in your stack is watching, and the answer is usually no.