Inside 540 Obligations Across Real Healthcare Contracts

Most writing about contract compliance argues from the abstract. A contract has "hundreds of obligations," somebody says, and you either believe it or you don't.

You don't have to. Healthcare companies file their material contracts as exhibits to SEC filings, which means real agreements - a vendor's services contract with Cigna, a pharmacy participation agreement, the contract between CMS and a Medicare Advantage organization - are sitting in EDGAR, free, in full. So we pulled seven and counted.

What we did, and what the number means

We used EDGAR full-text search to pull EX-10 exhibits filed by healthcare companies: CMS contracts, a payor flow-down amendment, a health plan vendor agreement, and two pharmacy-sector commercial agreements. Then we stripped the markup and counted sentences between 40 and 1,200 characters containing a binding modal - shall, must, agrees to, is required to, may not.

That is a rough proxy for an obligation, not a lawyer's count. A single sentence sometimes carries three commitments, which pushes the true number up; a handful of matches are definitional or boilerplate rather than operative, which pushes it down. Treat it as an order of magnitude, not a tally. We would rather show the method than round it into something tidier.

540 obligation-bearing clauses across 49,892 words. Seven documents, counted as filed. One caveat worth stating: Omada filed an Amendment No. 1 to the Cigna agreement as a separate exhibit, which we did not count, so that row describes the agreement before amendment.

The Alignment contract alone cites 38 distinct sections of 42 CFR, 121 times. Each is a body of regulation in its own right, incorporated by reference into a document somebody is nominally responsible for satisfying in full. Nobody reads 38 CFR sections at signature, and nobody re-reads them when one changes.

The health plan vendor contract is the one to read

Omada Health's agreement with Cigna Health and Life Insurance Company is the closest thing in the public record to the contract Harper exists to work on: a vendor selling into a health plan, with the plan's compliance obligations pushed onto it.

It is 3,668 words and carries 31 obligations. It also carries this:

"neither it nor any of its employees, contractors, officers, directors, Downstream Entities (as defined in 42 CFR 423.4) or any major shareholders (5% or more) are on the list of excluded individuals/entities as published by the Office of the Inspector General"

Read what that obliges. Not just Omada. Its employees, its contractors, its downstream entities - defined by federal regulation - and anyone holding 5% or more of the company. Against a list the OIG updates monthly.

That is a continuous, recursive screening obligation, stated in one sentence of a commercial services agreement, with no process attached and no due date. It is the FDR problem arriving in a commercial services agreement that never uses the phrase "first tier, downstream and related entities."

What gets redacted is the other half of the story

That Omada filing carries 44 separate redaction markers - text withheld under Regulation S-K Item 601(b)(10) because disclosure would cause competitive harm. Payment terms, reporting windows, the number of days for executive review: redacted.

So even when a healthcare vendor contract is public, its operative numbers frequently are not. Which is worth stating plainly, because it bounds what any analysis like this can claim - including ours.

Why the CMS contracts in that table are old

The filings run from 2011 to 2021, and that is not us failing to look.

Companies did once file these routinely - WellCare and HealthSpring each filed CMS contracts several times across the 2000s. Then they stopped. Alignment Healthcare's 2021 exhibit is, as far as EDGAR's full-text index goes, the most recent CMS Medicare Advantage contract form any public company has filed, and a search for the phrase that would surface a newer one returns nothing after it. The exact phrase "first tier, downstream and related entities" returns 57 filings all-time and 10 since 2023; nine of those ten are 10-K, proxy and annual-report narrative, and the tenth is a credit agreement. The recent healthcare exhibits that turn up are financing paper - credit, security and exchange agreements that happen to carry healthcare reps and warranties.

Sit with that. The agreements governing how a multi-hundred-billion-dollar program is administered are publicly visible in a handful of documents, the newest of which is five years old.

If you want to know what obligations a health plan operates under today, the public record cannot tell you. That is worth naming before anything else, because it shapes what the rest of this post can and cannot claim.

What is current

Two things, and we checked both directly.

CMS publishes its Part C application every contract year. The CY2027 version carries 74 explicit attestations - clauses where the applicant states that it agrees, attests, or acknowledges something. Those are commitments in the same sense the contract clauses are. The rest of that document is instructions for completing a form, and we are not counting those, though an earlier draft of this post did, before we read what the matches said.

And the regulation itself is live. 42 CFR 422.504 is the section the Medicare Advantage contract is built from, and its current text is a click away in the eCFR.

The sentence that explains everything

Tagged with its regulatory cite in the Alignment contract:

"Notwithstanding any relationship(s) that the MA Organization may have with first tier, downstream, or related entities, the MA Organization maintains full responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS." [422.504(i)(1)]

That is the whole reason FDR oversight exists, in one sentence. A plan can delegate claims processing, utilization management, pharmacy, call centers, care coordination. It can delegate nearly all of the work. It cannot delegate the responsibility for it. When a delegated entity fails a requirement, CMS holds the plan.

The contract does not match the regulation it cites

We pulled 42 CFR 422.504(i)(1) to verify that quote. The regulation reads:

"Notwithstanding any relationship(s) that the MA organization may have with first tier, downstream, and related entities, the MA organization maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS."

Ultimate, not full. And rather than or.

Our first instinct was that the rule had been rewritten after the contract was signed. It has not. We checked the annual CFR editions back to 2012, and 422.504(i)(1) has said "ultimate responsibility" continuously through 2018, 2021 and today. The regulation never moved.

The contract form did, in both directions at once: the same Alignment exhibit says "maintains full responsibility" in one article, tagged [422.504(i)(1)], and "maintains ultimate responsibility" in another. It also carries a third, older rendering - "notwithstanding any relationship(s) that the MA Organization may have with related entities, contractors, or subcontractors" - which is the pre-2012 phrasing. One CMS contract form, three generations of language for the same rule.

Whether "ultimate" and "full" mean different things is a question for a lawyer reading a signed agreement. The point for a compliance program is narrower and harder to argue with: the paper in your file is not a reliable copy of the rule it points to. This contract cites 38 distinct sections of 42 CFR, 121 times, and half of those sections have been amended since it was filed. Read your obligations from the CFR, not from the document in the folder.

The flow-down is recursive, and that is the part that breaks

The Molina exhibit is a different animal - not a CMS contract but a regulatory amendment bolting federal requirements onto an existing provider services agreement. It is the flow-down in action, and its first substantive clause is the one that matters:

"Provider agrees to require all of its first tier, downstream, and related entity(ies) that provide any services benefiting Health Plan's Medicare-Medicaid Program Members to agree in writing to all of the terms provided herein."

Read that carefully. The plan requires the provider to require its entities to agree in writing. Those entities are, in turn, bound by the same clause. The obligation propagates down the chain as far as the chain goes, and each hop has to be evidenced in writing.

So the real question is not "did my delegated entity sign the amendment." It is "did my delegated entity get signatures from everyone downstream of it, and can I see them." At two hops out, most plans are relying on an attestation that someone else did the work. At three hops, on nothing at all.

The Alignment contract confirms the auditors go all the way down: HHS and the Comptroller General reserve the right to audit "any books, contracts, computer or other electronic systems, including medical records and documentation of the first tier, downstream, and related entities."

The clock runs a decade past the relationship

Two of the seven carry an explicit 10-year tail. Here is how the Alignment form states it:

"HHS, the Comptroller General, or their designees have the right to inspect, evaluate, and audit any pertinent information for any particular contract period for 10 years from the final date of the contract period or from the date of completion of any audit, whichever is later."

Not 10 years from signature. Ten years from the end, or from the completion of an audit that hasn't happened yet, which means the clock can restart on a date nobody can predict at signing. A relationship that ended in 2021 is still generating retention obligations today, for an entity that may no longer exist, under a contract nobody has opened since the offboarding.

Retention is the most quietly failed obligation in healthcare compliance, and this is why. It has no due date to put on a calendar.

What is conspicuously absent

Across 49,892 words and 540 obligations, here is what these documents never say: who does the work, when it is due, what evidence proves it, and where that evidence lives.

They are complete as legal instruments and useless as operating plans. "The MA Organization agrees to maintain for 10 years books, records, documents, and other evidence of accounting procedures and practices" is unambiguous about the commitment and silent about the task. Somebody has to convert that sentence into a system with an owner, a schedule, a storage location, and a way to prove it held.

That conversion is done by hand, once, at implementation - if it is done at all. Then the person who did it leaves.

What this looks like when a machine reads it

This is the work Harper does. Give it the CMS contract and it extracts each of those 91 clauses with its exact wording, its page, and its CFR cite. Give it the flow-down amendment and it maps which clauses propagate to which delegated entities, and what written agreement satisfies each one. Each becomes a tracked item on its own clock: the annual ones annually, the 10-year retention ones as a standing obligation that survives termination, the event-driven ones dormant until they fire.

The same clause appears in every delegated agreement a plan holds. Read once, stored canonically, referenced everywhere - so the two hundredth provider agreement costs less to process than the first.

And the drift problem is tractable the same way. If each obligation carries the CFR section it came from, then a change to that section is a diff you can compute rather than a surprise an auditor finds.

Check our work

Every document is linked below. The CMS application is current and free, EDGAR full-text search is free, and the eCFR shows the regulation as it stands today.

The most useful thing you can do with fifteen minutes is run the same check on your own paper:

1. Open one delegated agreement and find a clause that cites a CFR section.
2. Pull that section from the eCFR and read it as it stands today.
3. Compare the wording. Note anything the contract paraphrases rather than quotes.
4. Check the eCFR versioner for whether that section has been amended since your contract was signed.
5. Repeat for the three clauses carrying the most money or the most regulatory exposure.

If step 4 turns up an amendment nobody logged, that is your answer about whether anything in your stack is watching. Half the Part 422 sections in the contract we analyzed had been amended since it was filed.