Two Hops Down: Where Subcontractor Disclosure Stops and Your Liability Does Not

Molina filed a regulatory amendment with the SEC that contains, as its first substantive clause, this requirement on the provider:

"Provider agrees to require all of its first tier, downstream, and related entity(ies) that provide any services benefiting Health Plan's Medicare-Medicaid Program Members to agree in writing to all of the terms provided herein."

Read what that obliges. Not the provider. The provider's entities. In writing. And since those entities are bound by the same clause, it obliges theirs too, and so on down.

Now ask the practical question. When you audit that provider, what do you actually collect? A countersigned copy of the amendment, from the provider. One document, one tier. The clause reaches an indefinite number of entities below it and your evidence covers exactly one of them.

The rules do not stop where your paperwork does

This is not a Medicare Advantage quirk. Three separate regimes propagate obligations downward, and all three reach past your direct counterparty.

42 CFR 422.504(i) reaches first tier, downstream and related entities. CMS's definition of a downstream entity is explicit that these written arrangements continue down to the level of the ultimate provider of both health and administrative services. There is no depth limit.

45 CFR 164.502(e) does it for protected health information. A business associate that hands PHI to a subcontractor must obtain satisfactory written assurances, and a subcontractor that does the same must do likewise.

42 CFR 438.230 governs subcontractual relationships in Medicaid managed care, requiring the State to ensure through its contracts that the plan maintains ultimate responsibility notwithstanding any subcontract. It is the shallowest of the three. 42 CFR 438.2 defines a subcontractor as an entity holding a contract with the plan itself, so the section reaches one tier, and its audit-rights clause is the only part that goes further.

In each case the obligation propagates by design, because the regulators understood that services get subcontracted and wanted the requirements to travel with the work. What none of them do is give you visibility. They tell you what must be true; they do not tell your vendor to show you.

Why the second hop is where it breaks

At one hop the mechanics are simple. You have a contract, you have leverage, you can withhold payment, and you can ask for a signature and get it.

At two hops you have no contract, no leverage and no relationship. Your ability to know anything depends entirely on your vendor's willingness to tell you, and their contractual duty is usually to obtain assurances rather than to forward them. So you ask, and you get told that they handle it, and that sentence is the whole of your evidence.

At three hops nobody is pretending. The honest state of most programs is that they know their first tier, can name some of the second, and have no mechanism at all below that.

The reason this matters is that risk does not attenuate with distance the way visibility does. The staffing agency at the bottom of the chain is where an excluded individual actually gets hired. The small cloud vendor two tiers down is where the data sits. The subcontracted courier is who loses the specimens. Your exposure is concentrated at exactly the depth where your evidence runs out.

What OIG said about attestations

HHS OIG published its Medicare Advantage compliance program guidance on 3 February 2026, the first for this industry since 1999. Section II.E covers oversight of third parties. It recommends periodic attestations as part of ongoing oversight, and then adds a caution:

"Attestations may be a way to help mitigate risk, but they should be accompanied by additional compliance-related steps."

The guidance is voluntary and creates no new duty. That is what makes the sentence useful, and its neighbourhood is worth quoting honestly: the caution sits in a passage about educating third parties who are new to healthcare, and the additional steps OIG goes on to name are manuals, toolkits and training resources rather than document collection. What survives is still the point. The agency that enforces this describes an attestation as something to be accompanied, not relied on alone.

Turning assertion into verification

The gap between an attestation and evidence is usually bridgeable, and the reason it is not bridged is effort rather than impossibility.

Ask for the executed downstream agreement, not confirmation that one exists. Most vendors can produce it, and the ones who cannot have told you something important.

Ask for the current list of subcontractors touching your data, facilities or members, with a defined refresh interval, rather than accepting the list captured at onboarding. Subcontractors change; a two-year-old list is a historical document.

Put the disclosure obligation in the agreement with a notice requirement attached, so a change becomes an event you receive rather than a fact you discover.

Screen the names you get. A subcontractor list is only useful if the entities on it are run against the OIG and SAM.gov lists like any other counterparty.

And keep the chain as a structure rather than a document. Who hired whom, for what function, under which written agreement, verified when. That is a graph, and it is queryable in a way a folder of PDFs is not.

How Harper handles the chain

Harper reads the flow-down clauses out of the executed agreements, which tells it which obligations propagate and to whom. That turns a recursive contractual requirement into a set of tracked items with named counterparties rather than a sentence nobody operationalises.

Then it works the chain outward. Disclosure requests go to the vendor as standing obligations chased to an answer, not logged as sent. Downstream agreements are collected as evidence where they can be obtained, so the record holds the document rather than the assurance. Named subcontractors are screened on the same schedule as direct vendors. When a vendor reports a change, the affected obligations resurface for re-verification rather than staying satisfied on the basis of a check that is now out of date.

Every step carries its provenance - which clause required it, who was asked, what came back - which is what makes the audit record retrievable rather than reconstructed when someone asks two years later.

Find your own depth limit

Pick your three highest-risk vendors: the ones with data access, facility access, or a delegated function.

1. Name every subcontractor each of them currently uses in performing your work.
2. For each named subcontractor, produce the written agreement in which it accepted the flowed-down terms.
3. Check the date on your subcontractor list. Is it the onboarding list or a current one?
4. Run each named subcontractor against the OIG exclusion list and SAM.gov.
5. Now attempt step 1 for the subcontractors of those subcontractors.

Step 2 is where most programs convert from evidence to assertion. Step 5 is where nearly everyone stops entirely, and it is worth doing just to see the boundary clearly - because the regulations do not stop there, and neither does what you are answerable for.