Delegation Oversight for Health Plans: Running the Program, Not Just the Calendar

Ask to see a health plan's delegation oversight program and you are usually shown a calendar.

Q1 is pre-delegation assessments for new entities. Attestations go out in January and get chased through March. Audits are scheduled across the year by risk tier. Corrective action plans are tracked to closure. Universe submissions are scrubbed before they go to CMS. It is organized, it is defensible, and a competent team runs it.

It is also not the program. It is the schedule the program runs on, and the difference shows up in one specific way: nothing in that calendar is derived from what any individual delegated agreement actually says.

Where the calendar comes from

Delegation oversight calendars are built from templates - a standard audit tool, a standard attestation, a standard risk tier. That is reasonable. Standardisation is how a small team covers thirty delegated entities.

The cost is that the template is the same for every entity, while the agreements are not. Two delegated entities performing the same function will have negotiated different insurance limits, different notice periods, different audit rights, different subcontracting permissions and different termination triggers. An audit tool asks both the same questions, which means it asks neither about the terms specific to it.

So the program verifies what the template remembers to ask, and the obligations that were negotiated into the agreement - often the ones somebody fought for - sit outside the scope of the thing designed to check them.

What the rules actually require

Three regulations carry most of this, depending on the line of business.

For Medicare Advantage, 42 CFR 422.504(i). Subsection (i)(1) is the foundation: notwithstanding any relationship with first tier, downstream and related entities, the plan maintains ultimate responsibility for its CMS contract. Subsection (i)(2) requires the plan to get all of those entities to agree to specified terms, including audit rights, records access, and ensuring no payment goes to anyone on the CMS preclusion list. Subsection (i)(4)(iii) requires every contract to specify that the plan monitors performance on an ongoing basis.

For Part D, 42 CFR 423.505(i) does the equivalent work.

For Medicaid managed care, 42 CFR 438.230 does less than it is usually credited with. It requires the State to ensure, through its managed care contracts, that the plan maintains ultimate responsibility for its state contract notwithstanding any subcontract, and that each subcontract specifies the delegated activities, provides for revocation or other remedies, and grants audit rights for ten years. It sets no monitoring cadence, and it reaches only the subcontractors the plan holds a contract with.

Read the delegation provision carefully and one thing stands out. 422.504(i)(4)(iii) says ongoing, and nothing in Part 422 or Part 423 sets an annual cadence for monitoring delegated entities. Be precise about the scope of that, because a neighbouring rule does set one: compliance training under 422.503(b)(4)(vi)(C)(2) must occur "at a minimum annually." It is the monitoring of delegated performance that carries no frequency. Annual is a convention there, coming from accreditation standards and negotiated contract terms rather than from 422.504, and a convention is worth separating from a requirement because the constraint that produced it has changed.

OIG has now said the quiet part

On 3 February 2026, HHS OIG published its Industry Segment-Specific Compliance Program Guidance for Medicare Advantage - the first compliance guidance for this industry since 1999. Section II.E is Oversight of Third Parties, and its subsections are selecting third parties, crafting compliance-focused agreements, ongoing oversight and corrective action, and special considerations for providers.

On what to secure in writing, OIG is specific: attestations covering the third party's compliance program, "requirements to conduct regular screenings of employees and downstream entities via OIG's LEIE," obligations to report potential violations, and auditing and monitoring rights. It also suggests requiring entities to report data at defined intervals, run self-audits and report the results, and standardize credentialing.

And then this:

"Attestations may be a way to help mitigate risk, but they should be accompanied by additional compliance-related steps."

The guidance is voluntary and creates no new obligations, which is what makes it useful. It is the enforcement agency describing what adequate looks like without waiting for a rule. Read it carefully on attestations, though, because it is not the indictment it is sometimes quoted as. OIG recommends periodic renewal of attestations as part of ongoing oversight, and its caution that they "should be accompanied by additional compliance-related steps" appears in a passage about educating third parties, where the additional steps it names are manuals, toolkits and training resources. The narrower reading is still worth having: the agency that enforces this treats an attestation as one input among several rather than as the answer.

The four gaps in a calendar-driven program

The agreement is not the source. Nothing in the program derives from clause text, so any obligation not on the template is unverified by design.

Evidence is self-reported. An attestation is the entity telling you they did something. Where the program collects the underlying document - the certificate, the screening result, the signed flow-down - it becomes verification rather than assertion, and the difference is what an auditor is actually asking about.

The chain stops at the first tier. Most programs can produce a signed flow-down for their first tier entities. Two hops down, they are relying on the first tier's assurance that it handled the entities below it. The regulation reaches those entities directly; the program usually does not.

Nothing runs between cycles. Exclusion lists update monthly. Certificates expire on their own schedule. Subcontractors change without notice. A program whose finest granularity is quarterly is blind in the intervals, and the intervals are most of the year.

What a contract-derived program adds

None of this argues for scrapping the calendar. Pre-delegation assessment scoring, audit workpapers, corrective action tracking and universe submission are real work and there is tooling built for them.

What is missing sits underneath. Each delegated agreement, read once, yields the obligations that specific entity owes - with the clause, the page and the regulatory citation attached. Those become tracked items on their own clocks, so the annual ones run annually, the monthly screening runs monthly, the retention duties persist past termination, and the event-driven ones stay dormant until they fire.

That is the layer Harper operates. It reads the executed agreements and regulatory attachments, extracts each obligation, then does the recurring work: chasing the attestation to completion rather than logging that it was requested, collecting evidence at the source from the entity that holds it, checking returned documents against the clause that required them, tracking corrective actions to closure, and keeping an immutable record of every step. Because obligations are stored canonically and referenced across every agreement containing them, the thirtieth delegated entity costs less to onboard than the first.

What Harper does not do is pre-delegation assessment scoring or CMS universe submission. If those are the jobs you are buying for, we say plainly where to look.

Five questions for your own program

Answer these from evidence rather than from the calendar.

1. Pick a delegated entity. Can you produce the signed flow-down for an entity two hops below it, or only for the first tier?
2. When that entity's insurance renewed, did anything compare the new limits against what its specific agreement required?
3. If a program audit asked how you concluded that entity was compliant last quarter, would you retrieve the answer or assemble it?
4. What in your stack remembers the ten-year records obligation on a delegation that terminated in 2023?
5. Which of your delegated agreements still carry a compliance training obligation, now that CMS removed FDRs from the requirement at 42 CFR 422.503(b)(4)(vi)(C) in the Contract Year 2019 final rule (83 FR 16440), applicable from 1 January 2019?

Question 5 catches most programs in both directions at once: still enforcing what CMS dropped, while missing what their own contracts still independently require.