First Tier, Downstream, and Related Entities (FDRs): What Medicare Advantage Rides Ask of You

A Medicare Advantage plan holds the contract with CMS, but it rarely drives anyone. It hands rides to a broker, and the broker hands them to companies like yours. Medicare calls everyone in that chain first tier, downstream, or related entities, FDRs for short. The label decides which Medicare rules travel with each trip you take for the plan.

What each term means

The three definitions are in 42 CFR 422.2, current as of September 30, 2026:

• First tier entity. Any party with a written arrangement, acceptable to CMS, directly with the plan to provide administrative or health care services to Medicare members. A ride broker that contracts with the plan is one.
• Downstream entity. Any party with a written arrangement below the plan’s contract with its first tier entity. The chain runs down to the ultimate provider of the service, which for a ride is the company whose van shows up.
• Related entity. A company tied to the plan by common ownership or control that does some of the plan’s management work, serves its Medicare members under an oral or written agreement, or leases property or sells materials to the plan for more than $2,500 in a contract period.

CMS’s compliance manual adds that a related entity can also be a first tier or downstream entity, and it lists health care services among the functions that make a contractor an FDR (Medicare Managed Care Manual, chapter 21, section 40, issued July 27, 2012). A contract with nothing to do with the plan’s Medicare work, such as an office lease, does not count.

Where your company sits

1. You drive for a broker that holds the plan contract. You are a downstream entity. This is the usual case, covered in Medicare Advantage transportation.
2. You contract with the plan itself. You are a first tier entity, and the plan oversees you directly.
3. You take overflow trips from another NEMT company that holds the broker contract. You are still downstream, one level lower, and the rules reach you through that company’s contract with you.

FDR is a Medicare Advantage and Part D term. On a Medicaid managed care trip the same company is a network provider (42 CFR 438.2), and your state’s and broker’s Medicaid rules apply. A dual special needs plan can put both programs on one rider.

What being downstream requires

The plan stays fully responsible to CMS no matter how many companies sit below it (42 CFR 422.504(i)(1)). So it must write its Medicare duties into every contract down the chain, including yours:

• Audit access. HHS, the Comptroller General, or their designees may audit and inspect your books, contracts, computer systems, and records, and may ask you for them directly. CMS normally tells the plan when it makes a direct request. The right lasts through 10 years from the end of the contract period or of any audit, whichever is later.
• No payments to precluded parties. You agree that no payment goes to anyone on CMS’s preclusion list, which lists people and companies Medicare revoked, or could have revoked, for conduct CMS finds harmful to the program, and anyone convicted in the last 10 years of a felony CMS finds harmful to it.
• No billing members. Your contract must bar you from holding a member liable for fees the plan owes (422.504(g)(1)(i) and (i)(3)(i)).
• Medicare rules for delegated work. When the plan delegates work, the contract must name it, say the plan monitors it, allow it to be taken back or set other remedies, and require you to follow Medicare laws, rules, and CMS instructions. When a broker picks the network, the plan keeps the right to approve, suspend, or end your arrangement (422.504(i)(5)).

The plan’s compliance program reaches you too. Its lines of communication must extend to FDRs and include a way to report concerns anonymously (42 CFR 422.503(b)(4)(vi)(D)). CMS’s manual has plans check each FDR against the OIG and federal exclusion lists before contracting and monthly after that (section 50.6.8). It also has plans confirm that each first tier entity applies the compliance rules to its own downstream companies (section 50.6.6). That is why your broker audits you. Keep your OIG exclusion list checks current for every owner and driver.

Compliance training since 2019

Starting January 1, 2016, CMS made FDRs satisfy the training rule with its own one-hour web course. Its final rule of April 16, 2018 (CMS-4182-F) ended that, along with the duty of plans to make sure FDRs are trained, starting January 1, 2019. CMS still holds plans accountable for what their FDRs do. It said each plan may choose its own way to check FDRs: training, attestations, reports, routine monitoring and auditing, or corrective actions.

Chapter 21 of the manual, last revised January 11, 2013, still describes FDR training as a plan duty. Follow the regulation and your contract. In practice, the brokers below still ask for proof of training every year.

In practice: the attestation before Medicare Advantage trips

Alivi’s Downstream Provider Oversight Policy, effective January 1, 2025, cites 42 CFR 422.503 and 422.504 and chapter 21. It has every downstream provider sign an FDR Provider Attestation before starting and every year after, covering topics such as:

• The code of conduct, and general compliance and fraud, waste, and abuse training
• OIG and SAM exclusion screenings, background screening, and record retention
• HIPAA privacy and security, reporting channels, and conflicts of interest
• Oversight of your own downstream companies, and ownership and management disclosure

Alivi audits at least 5 percent of active downstream providers each year and requires a corrective action plan for any gap. Modivcare’s 2025 attestation covers Medicare and Medicaid general compliance and fraud, waste, and abuse training. It has you train new employees within 30 days of hire, keep training records at least 10 years, and hand them over free on request. Its training page asks providers doing the yearly round to submit the signed attestation within 90 days.

Before you sign one, have this ready:

1. A training roster with each owner’s and driver’s name, course, and completion date.
2. Your monthly exclusion screening log.
3. A signed code of conduct for everyone who touches a trip or a claim.
4. A records plan that keeps trip logs and training proof for at least 10 years, as in NEMT record retention.
5. The name of the person with authority to sign for the company.

If any item is missing, fix it before the date on the attestation. A signed attestation your records cannot back up is exactly what an audit looks for. The NEMT compliance program guide puts all of it on a yearly calendar.