CMS-10717 First Tier, Downstream, and Related Entities Operations

Program Audit Data Request
Compliance Program Effectiveness (CPE)
First Tier, Downstream, and Related Entities Operations Oversight Questionnaire (FDR-Q)
Name of Sponsoring Organization:
Click or tap here to enter text.

Contract Numbers:
Click or tap here to enter text.

Name and Title of Person Completing Questionnaire:
Click or tap here to enter text.

Date Completed:
Click or tap to enter a date.

This questionnaire will assist CMS with understanding the organization’s accountabilities and
oversight of its delegated entities to ensure their compliance with Medicare program requirements.
Please upload the completed form to HPMS within 15 business days of receiving your audit
engagement letter.
We recognize that your time is valuable and appreciate your availability to provide responses to
our questions regarding the compliance program. The responses to these questions may be
discussed during the CPE audit.
If multiple individuals are responsible for the operational oversight of first tier, downstream, and
related entities (e.g., Corporate Compliance Officer, Delegated Entity Compliance Officer,
Vendor Management Group) and have different responses to the questions, please consolidate
responses and incorporate into one document.
Please specifically note the following when completing the questionnaire:
• “You”, “your” refers to your organization, not necessarily a specific person.
• “Employees” refer to employees, including senior management, who support your Medicare
business.
• “Compliance Officer” refers to the compliance officer who oversees the Medicare business.
• “CEO” refers to the Chief Executive Officer of the organization or the most senior officer,
usually the President or Senior Vice President of the Medicare line of business.
• “Compliance Program” refers to your Medicare compliance program.
• If the Medicare contract holder is a wholly owned subsidiary of a parent company, references
to the governing body, CEO, and highest level of the organization’s management are to the
board, CEO and management of the company (parent or subsidiary/contract holder) that the
organization has chosen to oversee its Medicare compliance program.
• “First Tier Entity” refers to any party that enters into a written agreement, acceptable to
CMS, with an organization to provide administrative services or health care services to a
Medicare eligible individual under the Part C and/or Part D program.
• “Downstream Entity” refers to any party that enters into a written agreement, acceptable to
CMS, with persons or entities involved with the Medicare Part C and/or Part D benefits
below the level of the arrangement between an organization and a first tier entity. These
Page 1 of 4

OMB Approval 0938-1395 (Expires 05/31/2024)

Program Audit Data Request
Compliance Program Effectiveness (CPE)
First Tier, Downstream, and Related Entities Operations Oversight Questionnaire (FDR-Q)

•

•

written agreements continue down to the level of the ultimate provider of both health and
administrative services.
“Related Entity” refers to any entity that is related to an organization by common ownership or
control, and
o performs some of an organization’s management functions under contract or delegation,
o furnishes services to Medicare enrollees under an oral or written agreement, or
o Leases real property or sells materials to the organization at a cost of more than $2,500
during a contract period.
If the Medicare contract holder is a wholly owned subsidiary of a parent company, references
to the governing body, CEO and highest level of the organization’s management are to the
governing body, CEO and management of the company (parent or subsidiary/contract holder)
that the organization has chosen to oversee its Medicare compliance program.

1. Are delegated entities managed by one individual or a group of individuals/departments?
Skip Question 2 if answer is a group of individuals/departments.
Click or tap here to enter text.

2. How long has the individual identified in Question 1 been employed with the
organization and been involved with overseeing First Tier, Downstream, and/or Related
Entities?
Click or tap here to enter text.

3. Briefly describe your process for determining if a potential First Tier, Downstream,
and/or Related Entity is capable of complying with contractual, and regulatory
obligations. Who or which business operations are responsible for this process?
Click or tap here to enter text.

4. Provide a general overview of the delegated entity oversight program.
Click or tap here to enter text.

5. Please describe your criteria/process for determining which delegated entities are
identified as First Tier, Downstream, and/or Related Entities subject to Medicare
compliance requirements.
Click or tap here to enter text.

6. How many first tier entities does your organization contract with to perform Medicare
Part C and/or Part D functions?
Click or tap here to enter text.

Page 2 of 4

OMB Approval 0938-1395 (Expires 05/31/2024)

Program Audit Data Request
Compliance Program Effectiveness (CPE)
First Tier, Downstream, and Related Entities Operations Oversight Questionnaire (FDR-Q)
7. Describe the communications process between the Compliance Department and First
Tier, Downstream, and/or Related Entity Oversight for Medicare requirements, policy
updates, performance concerns, or issues with First Tier, Downstream, and/or Related
Entities. At minimum, please include the process for communications about, or for, first
tier entities such as your PBM, appeals and grievances, enrollment/membership
functions, coverage or claims adjudication, network management, etc.
Click or tap here to enter text.

8. How do you ensure compliance issues involving a First Tier, Downstream, and/or
Related Entity is communicated to upper management (e.g., compliance committee,
senior managers, Board of Directors, CEO)? Please provide a recent example/scenario.
Click or tap here to enter text.

9. How do you share information with First Tier, Downstream, and/or Related Entities on
your organization’s culture, compliance and productivity expectations, CMS
regulations, and policy for the Medicare function performed on the organization’s
behalf?
Click or tap here to enter text.

10. What types of monitoring reports do you receive from First Tier, Downstream, and/or
Related Entities, and how often?
Click or tap here to enter text.

11. What is your process for monitoring and auditing your first tier entities compliance
with requirements, downstream oversight, and implementation of corrective actions?
Click or tap here to enter text.

12. What happens or is the consequence if a First Tier, Downstream, and/or Related Entity
fails to satisfactorily implement a corrective action plan or commits a serious act of
noncompliance with a Medicare requirement that affects enrollees from receiving their
health care or drug benefit appropriately or timely?
Click or tap here to enter text.

13. Do you have any questions or comments for CMS?
Click or tap here to enter text.

Page 3 of 4

OMB Approval 0938-1395 (Expires 05/31/2024)

Program Audit Data Request
Compliance Program Effectiveness (CPE)
First Tier, Downstream, and Related Entities Operations Oversight Questionnaire (FDR-Q)

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information
unless it displays a valid OMB control number. The valid OMB control number for this information collection is 09381395 (Expires 05/31/2024). This is a mandatory information collection. The time required to complete this information
collection is estimated to average 701 hours per response, including the time to review instructions, search existing data
resources, gather the data needed, and complete and review the information collection. If you have comments concerning
the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security
Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850. ****CMS
Disclosure**** Please do not send applications, claims, payments, medical records or any documents containing sensitive
information to the PRA Reports Clearance Office. Please note that any correspondence not pertaining to the information
collection burden approved under the associated OMB control number listed on this form will not be reviewed, forwarded,
or retained. If you have questions or concerns regarding where to submit your documents, please contact
[email protected].

Page 4 of 4

OMB Approval 0938-1395 (Expires 05/31/2024)