MSSP Contracting Rules Create Operational and Revenue Risk for ACOs

For Health System and ACO Executives | Medicare Shared Savings Program

Current as of: July 2026

What Executives Need to Know

ACO participant agreements should be viewed as part of the organization’s operating model, not simply as legal paperwork. These agreements define whether the ACO can demonstrate that its participant network is properly formed, that providers and suppliers billing under participant TINs are bound to MSSP requirements, and that the organization has enforceable rights to address noncompliance.

For health systems, CINs, physician enterprises, and ACO sponsors, the practical implications are significant. Weak agreement controls can create delays in MSSP applications or participant additions, limit the ability to include a participant TIN, undermine compliance certifications, and create avoidable exposure during audit or monitoring. Executives should ensure that legal, compliance, finance, operations, provider enrollment, and network management teams are aligned around a single source of truth for participant and provider/supplier participation.

Why This Matters to the Business

MSSP participation depends on more than the ACO’s agreement with CMS. Current regulations require the ACO to maintain compliant agreements across its participant network. Those agreements support core MSSP functions, including beneficiary assignment, quality reporting, financial benchmarking, shared savings calculations, and annual compliance certifications.

From an executive perspective, the issue is governance and operational reliability. If the ACO cannot show that the correct entities signed the correct agreements, that all providers and suppliers billing under a participant TIN are covered, and that enrollment information is current, the organization may face approval delays, participant-list issues, documentation requests, or compliance findings.

Where the Risk Shows Up

The most immediate risk arises during MSSP applications, renewals, and requests to add new ACO participants. CMS expects the ACO to have compliant agreements in place with each participant. If agreements are missing, improperly executed, inconsistent with enrollment data, or not direct between the ACO and the participant, the organization may experience delays or be unable to add the participant as planned.

Common Failure Points for ACO Leadership to Monitor

CMS has previously identified recurring problems in ACO participant agreements, including agreements that were not properly executed, involved the wrong parties, lacked required provisions, contained inaccurate information, or failed to address program restrictions. For executives, these are process-control failures. They typically reflect gaps in ownership, template governance, signature tracking, provider enrollment coordination, or participant onboarding.

Leadership teams should pay particular attention to whether current contracting and onboarding processes reliably confirm the following:

• The participant agreement is direct between the ACO and the ACO participant.
• The agreement is signed by individuals with authority to bind both parties.
• The agreement includes the required MSSP compliance provisions.
• All providers and suppliers billing through the participant TIN are covered by enforceable participation and compliance obligations.
• Enrollment records, legal names, TINs, and provider rosters are reconciled before submission.
• The ACO can impose corrective action, deny incentive payments, terminate participation, and complete close-out obligations if needed.

Direct ACO-to-Participant Agreements Are Required

Executives should understand that CMS expects a direct agreement between the ACO and each ACO participant. This matters because the ACO must be able to enforce MSSP obligations directly against the participant, including corrective action, termination, and other remedies when compliance problems arise.

Arrangements that rely on an independent practice association, management company, or other intermediary may not satisfy CMS requirements if the ACO and the participant are not the only parties to the agreement. Health systems and ACO sponsors using legacy network or CIN contracting structures should confirm that those arrangements have been adapted for MSSP compliance.

TIN-Level Participation Is a Critical Operational Control

ACO leaders should treat legal-name and enrollment-data accuracy as a control requirement. Participant agreements should match the legal names, TINs, and Medicare enrollment information reflected in CMS systems. Mismatches can result in rejection of agreements, additional documentation requests, or the need to obtain corrected or amended agreements on short timelines.

The bigger operational issue is that MSSP participation works at the participant TIN level. The ACO should not include a participant TIN unless all Medicare-enrolled providers and suppliers billing under that TIN have agreed to participate and comply with MSSP requirements. This requires close coordination among legal, compliance, provider enrollment, medical group operations, finance, and network development teams.

Executive Example: Partial TIN Participation Is Not Enough

CMS’s examples illustrate a simple but important operating principle: a group practice TIN generally cannot be treated as an ACO participant unless the group practice and all Medicare-enrolled providers and suppliers billing through that TIN are covered by the required MSSP participation and compliance commitments.

• Correct: A large group practice, enrolled under a Medicare TIN, joins an ACO as an ACO participant. The owner signs the agreement on behalf of the practice, and all practitioners who reassigned their Medicare payment rights to that TIN have also agreed to participate and follow program regulations. The ACO may include the group practice TIN.
• Incorrect: A large group practice signs an agreement, but not all practitioners billing through the group practice TIN have agreed to participate and follow Shared Savings Program regulations. The ACO may not include the group practice TIN.
• Incorrect: Several practitioners in a large group practice want to participate, but the group practice as a whole has not agreed to participate. The ACO may not include the group practice TIN.

Current Requirements: What the Executive Team Should Confirm

Current 42 C.F.R. § 425.116 establishes the agreement requirements that ACOs should build into their contracting, onboarding, monitoring, and audit-readiness processes. Executive teams should confirm that the organization can demonstrate the following:

• Each ACO participant has a direct agreement with the ACO.
• Each agreement is signed by authorized signatories.
• Each participant is obligated to comply with MSSP requirements and ensure compliance by providers and suppliers billing through its TIN.
• The agreement addresses participant rights and obligations, quality reporting, beneficiary notification, and participation in other Medicare shared savings initiatives.
• Shared savings or other financial arrangements are linked to quality assurance, improvement programs, and evidence-based medicine guidelines.
• Participants must update enrollment information and notify the ACO of provider/supplier additions or deletions within 30 days.
• The ACO has enforceable rights to require corrective action, deny incentive payments, terminate agreements, and address program integrity issues.
• ACO participant agreements cover at least one performance year and address early termination consequences.
• Close-out obligations are clear if the ACO’s participation agreement terminates or expires.

These requirements should be embedded into standard operating procedures, not handled as one-off legal review items. The executive question is whether the ACO can prove compliance quickly and consistently when CMS asks.

Provider/Supplier Agreements and Participant-Level Controls

If the ACO contracts directly with individual ACO providers/suppliers, those agreements must substantially track the required MSSP obligations. If the ACO relies on participant-level agreements, leadership should confirm that those agreements require the participant to secure and maintain provider/supplier commitments, update rosters, report changes, and support the ACO’s compliance certifications.

Documentation Readiness Is an Executive Risk Area

CMS’s April 2026 ACO Participant List and Participant Agreement Guidance emphasizes current expectations for participant lists, agreement requirements, executed agreement documentation, legal business name changes, and participant-list changes. Executives should assume that the ACO may need to produce agreement documentation during application, participant-addition, renewal, audit, or monitoring activities.

The operational goal should be a reliable, centralized evidence file. That file should allow the ACO to produce executed agreements, signature pages, template versions, legal-name documentation, enrollment-data reconciliations, provider/supplier participation evidence, and change notices without recreating the record under deadline pressure.

Leadership Implications

MSSP agreement compliance should be assigned clear executive ownership. The work cuts across legal, compliance, finance, provider enrollment, operations, and network management. Without clear ownership, organizations may discover too late that participant agreements, provider rosters, PECOS data, and internal approval records do not align.

Recommended Executive Actions

• Assign an executive owner for MSSP participant agreement compliance and related documentation controls.
• Direct legal and compliance to review participant and provider/supplier agreement templates against current 42 C.F.R. § 425.116 requirements.
• Require a cross-functional reconciliation of participant legal names, TINs, provider/supplier rosters, and Medicare enrollment records.
• Confirm that participant onboarding includes evidence that all providers and suppliers billing through each participant TIN are bound to MSSP requirements.
• Establish a centralized evidence file for executed agreements, signature pages, template versions, roster changes, enrollment updates, and 30-day notices.
• Test whether the organization can produce complete agreement documentation quickly in response to a CMS request.
• Integrate participant agreement compliance into annual certification, renewal, participant-addition, audit, and compliance committee reporting processes.

Conclusion

Current MSSP regulations should prompt ACOs to view participant agreement compliance as part of their broader MSSP control environment. The requirements implicate not only contract drafting, but also enrollment data integrity, participant onboarding, provider/supplier roster management, remedial authority, documentation controls, and audit readiness. Organizations that address these issues proactively will be better positioned to avoid application delays, participant-addition denials, and disputes over whether their participant networks satisfy MSSP requirements.

Sources consulted: current eCFR text for 42 C.F.R. Part 425 and § 425.116, and CMS’s April 2026 ACO Participant List and Participant Agreement Guidance.

Attorney Contacts

This client alert is provided for informational purposes only and does not constitute legal advice. Readers should consult counsel regarding the application of these developments to their specific circumstances.