A Medicaid managed care plan operates under a contract with the state Medicaid agency, and that contract is not only a service agreement. It is a conduit for federal and state requirements that the plan must pass on to every entity performing delegated functions: utilization management vendors, pharmacy benefit administrators, behavioural health organizations, dental and vision plans, transportation brokers, care management vendors, claims processors and provider networks.
The pass-through is not optional and it is not general. State contracts typically enumerate provisions that must appear in subcontracts, and readiness reviews and audits test for their presence. A plan that has strong internal compliance and weak downstream contract provisions is exposed in a specific, documentable way, because the finding is not about performance but about the absence of a required term in an agreement that can be read, the same evidentiary posture as provider contract management for a health system.
The recurring difficulty is cycle mismatch. State contracts are amended regularly, sometimes annually, sometimes more often, and amendments frequently add or revise required subcontract provisions. Subcontracts are multi-year and are amended when a commercial reason arises. Left alone, the gap between what the state now requires downstream and what the subcontracts actually say widens every amendment cycle.
What typically must appear in a subcontract
Required provisions vary by state and by contract year, so the specifics must come from the current state contract. The categories below are the ones that appear almost universally and that reviews focus on.
- Retained accountability, an express statement that the plan remains responsible for delegated functions and that delegation does not relieve it of obligations to the state.
- Audit, inspection and access rights, rights for the state, federal agencies and their designees to access records, facilities and personnel, usually extending to the subcontractor’s own subcontractors.
- Record retention, retention for a specified period, commonly measured from the end of the contract term or the resolution of any audit, whichever is later.
- Program integrity duties, exclusion and debarment screening with a defined cadence, fraud waste and abuse reporting obligations, and cooperation with investigations.
- Data, privacy and reporting obligations, encounter data submission standards and timeliness, privacy and security terms, breach notification, and the reporting the plan needs to meet its own state deliverables.
Tracking those categories per subcontract is a matrix problem: required provisions on one axis, subcontracts on the other, with the state contract version that generated each requirement recorded. That is the same structure used for any regulatory flowdown exercise, and it is what makes remediation prioritizable rather than open-ended, much as value-based care contract administration depends on knowing which measures each agreement actually carries.
When the state adds or revises a required subcontract provision, every affected downstream agreement becomes non-conforming on the effective date, regardless of when it is renewed. Treat each state contract amendment as triggering a scoped downstream remediation with a deadline, and track it, rather than waiting for subcontract renewal to catch up.
Where subcontract flowdown fails
These are the patterns readiness reviews find, and each has a tracking remedy rather than a drafting one.
- Incorporation by reference without the referenced document. Subcontracts incorporate state requirements by reference to a document the subcontractor has never seen and which has since been amended. Reviews frequently treat this as inadequate.
- Provisions present but inconsistent across subcontracts. Different vintages of template produce different versions of the same required provision, so conformance has to be assessed agreement by agreement.
- Downstream flowdown is not required. Audit and access rights that must extend to the subcontractor’s subcontractors often stop one tier down, because the flowdown duty was not imposed.
- Monitoring is attestation-based. Delegated function oversight is evidenced by an annual attestation rather than by dated monitoring activities with findings and corrective action.
- Nobody maps state amendments to affected subcontracts. The compliance team reads the amendment and the contract team does not, so the downstream impact is never scoped.
A five-step roadmap to control subcontract flowdown
Step 1, Build the required-provisions matrix from the current state contract
Extract every provision the state requires in subcontracts, with the state contract section and the version that introduced it. This becomes the reference the whole programme runs against.
Step 2, Assess every subcontract against the matrix
Go agreement by agreement, marking each required provision present, partially present or absent, with the clause reference where present. Partial conformance is the most common state and the easiest to overlook.
Step 3, Prioritize remediation by function criticality
Remediate delegated functions the state scrutinizes most closely first, typically utilization management, pharmacy, behavioural health and claims, rather than working alphabetically or by contract value.
Step 4, Make state amendments trigger a downstream scope
Establish that every state contract amendment is reviewed jointly by compliance and contract operations, with affected subcontracts identified and a remediation deadline set within a defined period.
Step 5, Convert delegation oversight into dated obligations
Replace annual attestations with scheduled monitoring activities: file audits, reporting timeliness checks, screening verification, with findings and corrective action tracked to closure against the subcontract.
Track required provisions across every subcontract
Aavenir holds the required-provisions matrix against each delegated entity agreement and tracks monitoring to evidenced closure.
Why the matrix beats a better template
The instinct on discovering flowdown gaps is to fix the template, and the template should certainly be fixed. But a template only governs agreements signed after it. The existing subcontract population, which is where the exposure sits, is unaffected, and the next state contract amendment makes the new template non-conforming too. A required-provisions matrix assessed against the actual population is the artefact that answers the review question, which is not what the plan intends to require but what its current agreements actually say. It also makes the amendment cycle manageable, because when a state adds a provision the affected subcontracts are identified by query rather than by reading. Plans consolidating on contract lifecycle management for healthcare run the matrix as contract data rather than as a spreadsheet.
Required provision categories and controls
The table maps common required categories to the control that keeps them current. State requirements govern and vary considerably, so the current state contract and compliance counsel should determine the actual provision set.
| Provision category | Typical requirement | Control | Evidence |
|---|---|---|---|
| Retained accountability | Express statement plus no-relief language | Matrix check at execution and on amendment | Clause reference per subcontract |
| Audit and access rights | State, federal and designee access, with downstream flowdown | Verify flowdown duty is imposed, not just access granted | Clause reference plus subcontractor list |
| Record retention | Specified period from term end or audit resolution | Retention terms extracted as contract data | Retention field per agreement |
| Program integrity | Screening cadence, FWA reporting, investigation cooperation | Screening cadence tracked as recurring obligation | Screening records with dates |
| Data and reporting | Encounter standards, timeliness, breach notification | Reporting timeliness monitored, not attested | Submission logs, timeliness findings |
Medicaid managed care subcontract compliance is a flowdown and tracking problem rather than a drafting problem. The required provisions are knowable from the state contract, the gap is measurable against the current subcontract population, and the amendment cycle is predictable enough to build a process around. Plans that maintain a required-provisions matrix, assess the actual population against it, and convert delegation oversight into dated monitoring obligations enter a readiness review with answers. Plans that rely on a good template and an annual attestation enter with a reading exercise.
For related guidance, see How to track locum tenens agreement obligations, Staffing agency contract control for health systems and The health system guide to physician agreement controls.
