Risk-sharing arrangements are contracts in which two or more parties agree to split the financial consequences of a defined set of outcomes, most often the cost of delivering healthcare to a population or an episode of care. One party no longer absorbs every dollar of overrun, and no party keeps every dollar of savings. The structure sets a spending benchmark, tracks actual performance against it, and divides the surplus or shortfall according to pre-negotiated percentages. In healthcare the model dominates value-based payment, but the same mechanics appear in reinsurance and corporate finance. Getting the structure, the regulatory fit, and the contract language right is what separates a workable arrangement from one that creates fraud, antitrust, or solvency exposure.
The Main Structures
Shared Savings
A shared savings model sets a spending benchmark for a defined population over a fixed period. If actual costs land below the benchmark, the participants split the difference at contracted percentages. Many agreements add two-sided risk, so participants also owe a share of any overrun. The Medicare Shared Savings Program, governed by 42 CFR Part 425, is the most prominent federal example: Accountable Care Organizations manage a Medicare population and either share in savings, absorb losses, or both, depending on the track they choose.1eCFR. 42 CFR Part 425 – Medicare Shared Savings Program
Capitation
Capitation pays a provider a flat per-member-per-month fee covering every service listed in the contract, regardless of how much care each member actually uses. The provider keeps the margin when the total cost of care comes in below total capitation payments collected, and absorbs the shortfall when it does not. The model rewards efficiency but puts smaller providers at real risk when they lack the patient volume to smooth out high-cost outliers.
Bundled Payments
Bundled payments center on a single episode of care rather than an entire population. One payment covers a defined procedure and all related services before and after it. If the total cost stays under the bundled amount, the providers keep the difference. If it runs over, they absorb the loss without additional reimbursement. There is no end-of-year benchmark adjustment, so the discipline is tighter than shared savings.
Stop-Loss and Reinsurance
Nearly every risk-sharing arrangement layers in stop-loss protection so a single catastrophic case does not drain the shared fund. Individual stop-loss limits are typically set at a specific dollar threshold per patient, commonly $50,000 to $100,000 or higher depending on the risk profile. Aggregate stop-loss triggers when total spending exceeds a set percentage above the benchmark, catching systemic overruns that per-patient caps miss. Skipping stop-loss is a bet that no concentration of high-cost cases will materialize, which in healthcare is not a bet that ages well.
Federal Fraud and Abuse Exposure
The largest regulatory risk when a healthcare risk-sharing arrangement involves federal program dollars is inadvertently violating one of three statutes. Each targets different conduct, and the penalties stack.
The Stark Law
The Stark Law prohibits a physician who has a financial relationship with an entity from referring patients to that entity for services covered by Medicare, unless a specific exception applies.2Office of the Law Revision Counsel. 42 USC 1395nn – Limitation on Certain Physician Referrals It is a strict liability statute: the government does not have to prove intent. If a prohibited financial relationship existed and a referral was made, the violation is complete. The inflation-adjusted civil penalty for a claim tied to a prohibited referral is up to $31,670 per service.3GovInfo. Federal Register Volume 91 Issue 18 – Civil Monetary Penalties Inflation Adjustment A separate penalty of up to $211,146 applies to each circumvention scheme designed to disguise prohibited referrals. Violators also face exclusion from all federal healthcare programs.
The Anti-Kickback Statute
The Anti-Kickback Statute makes it a felony to knowingly offer or receive anything of value in exchange for referrals of services payable by a federal healthcare program. Unlike Stark, this statute requires intent. A conviction carries fines up to $100,000 and imprisonment of up to ten years per violation.4Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Risk-sharing arrangements can trip the statute when bonus payments, shared savings distributions, or other financial incentives flow to physicians in ways that could be characterized as compensation for referrals.
The False Claims Act
Claims submitted to a federal program as a result of a Stark or Anti-Kickback violation also create False Claims Act exposure. Current inflation-adjusted civil penalties range from $14,308 to $28,619 per false claim, plus treble damages.5eCFR. 28 CFR Part 85 – Civil Monetary Penalties Inflation Adjustment A risk-sharing entity that submits thousands of tainted claims over several years faces per-claim penalties stacked on top of treble damages.6Office of the Law Revision Counsel. 31 USC 3729 – False Claims
Waivers and Safe Harbors
Reading the fraud and abuse statutes in isolation would suggest no risk-sharing arrangement involving physicians and Medicare has a clean path through. Congress and the agencies have carved out protections for arrangements that genuinely share financial risk.
CMS Waivers
Section 1899(f) of the Social Security Act authorizes the Secretary of Health and Human Services to waive the Stark Law, the Anti-Kickback Statute, and certain other provisions when necessary to operate the Medicare Shared Savings Program.7Centers for Medicare & Medicaid Services. Fraud and Abuse Waivers CMS and the Office of Inspector General have jointly issued waivers covering ACO pre-participation and ongoing participation activities. A separate waiver authority under Section 1115A(d)(1) covers Innovation Center models testing new payment and delivery approaches. These waivers apply only when every condition is met, so treating them as blanket immunity is a fast path to an enforcement letter.
Value-Based Enterprise Protections
Beginning in 2021, CMS finalized new Stark Law exceptions and the Department of Justice finalized corresponding Anti-Kickback safe harbors for value-based arrangements. These apply to “value-based enterprises” where two or more participants collaborate to coordinate care, improve quality, or reduce costs for a defined patient population. The level of risk sharing determines which protection applies.
Care coordination arrangements protect in-kind remuneration used for value-based activities such as care management, provided the arrangement is commercially reasonable and backed by documented outcome or process measures.8eCFR. 42 CFR 1001.952 – Exceptions Substantial downside risk arrangements apply when participants face meaningful loss exposure, such as shared savings models with at least 30 percent loss repayment or bundled payments with at least 20 percent loss repayment. Full financial risk arrangements cover situations where the enterprise takes prospective financial responsibility for the full cost of all covered services for the target population. Under the Stark Law’s meaningful downside risk exception, the physician must be at risk to repay or forgo at least 10 percent of the total remuneration received under the arrangement. Arrangements that fall short of the applicable risk-sharing floor cannot rely on the corresponding protection.
State Oversight and the ERISA Carve-Out
State insurance departments classify many risk-sharing entities as risk-bearing organizations and apply financial oversight: solvency monitoring, a Certificate of Authority or equivalent license, and capital reserves sufficient to cover potential claims. Required reserve amounts vary widely. Some states tie the requirement to a minimum tangible net equity calculation; others apply coverage ratios based on enrolled members. Application and renewal fees also differ by jurisdiction.
One jurisdictional wrinkle matters a great deal. If the risk-sharing arrangement sits within a self-funded employer health plan governed by ERISA, state insurance regulators generally have no authority over the plan’s benefits or solvency. ERISA’s deemer clause prevents states from treating self-insured employer plans as insurance companies, even though those plans bear primary insurance risk. The entity structure chosen for the arrangement therefore determines which regulators have jurisdiction.
ERISA Fiduciary Duties and MEWA Filings
Anyone who exercises discretion over a group health plan’s administration or assets is a fiduciary under ERISA, regardless of title. The determination is functional. Decisions about participant eligibility, management of plan funds, or selection of investment options carry fiduciary obligations whether or not the contract uses the word “fiduciary.”9U.S. Department of Labor. Understanding Your Fiduciary Responsibilities Under a Group Health Plan For risk-sharing arrangements involving employer-sponsored coverage, the entity managing shared funds or making payment decisions must act solely in participants’ interests and exercise prudent judgment.
When a risk-sharing entity pools employees from more than one employer to provide health benefits, it may qualify as a Multiple Employer Welfare Arrangement with its own federal filing track. Administrators of MEWAs offering medical care must register with the Department of Labor by filing Form M-1 at least 30 days before operating in any state.10eCFR. 29 CFR 2520.101-2 – Filing by Multiple Employer Welfare Arrangements After initial registration, annual reports are due each March 1. Additional filings are triggered when the MEWA expands into new states, merges with another MEWA, or sees enrollment rise by 50 percent or more over the prior year.
Antitrust Safety Zones
Competitors collaborating on pricing and reimbursement through a risk-sharing arrangement can draw antitrust scrutiny when the arrangement functions as a price-fixing vehicle rather than genuine risk sharing. The Federal Trade Commission and the Department of Justice have established safety zones for physician network joint ventures that share substantial financial risk. An exclusive network qualifies for the safety zone if it includes 20 percent or fewer of the physicians in each relevant specialty practicing in the geographic market. For non-exclusive networks, the threshold is 30 percent.11Federal Trade Commission. Statements of Antitrust Enforcement Policy in Health Care
Exceeding these thresholds does not make an arrangement illegal. The agencies will evaluate it case by case rather than extending a presumption of legality. If a network approaches or exceeds these percentages, antitrust review before launch is the sensible move.
HIPAA and Business Associate Agreements
Risk-sharing arrangements run on shared data: patient-level claims, clinical outcomes, utilization patterns. When any party other than the covered entity itself handles protected health information, HIPAA requires a written Business Associate Agreement. The agreement must address at least ten core requirements, including limits on how the business associate uses the data, safeguards against unauthorized disclosure, breach reporting, flow-down obligations for subcontractors, and return or destruction of all protected health information when the contract ends.12U.S. Department of Health and Human Services. Sample Business Associate Agreement Provisions The covered entity must also retain the right to terminate for a material violation. Sharing data without a compliant Business Associate Agreement in place creates HIPAA exposure and can undercut the arrangement itself if a regulator concludes the data underlying the financial reconciliation was improperly shared.
Drafting Essentials
Financial Baseline
A credible agreement starts with historical cost data broken down by category: facility fees, professional services, pharmacy, and administrative overhead. That data drives the spending benchmark. Under the Medicare Shared Savings Program, CMS uses its own benchmarking methodology to set and adjust the target for each ACO.1eCFR. 42 CFR Part 425 – Medicare Shared Savings Program Private contracts typically require the parties to agree on a benchmarking method and data sources before signing.
Quality Measures
Cost savings produced by cutting corners on care defeat the purpose of the arrangement. Agreements tie a portion of shared savings, and sometimes the entire payout, to defined quality benchmarks. ACOs in the Medicare Shared Savings Program for the 2026 performance year must report on the APP Plus quality measure set, covering diabetes management, blood pressure control, cancer screenings, depression screening, hospital readmissions, and patient experience surveys.13Centers for Medicare & Medicaid Services. Medicare Shared Savings Program Quality Performance Standard – Performance Year 2026 Private arrangements commonly use the Healthcare Effectiveness Data and Information Set (HEDIS), which covers more than 235 million enrolled lives.14National Committee for Quality Assurance. HEDIS
Population, Stop-Loss, and Attestation
The agreement must define the covered population precisely using identifiers like age ranges, geographic boundaries, or diagnostic categories. Loose definitions produce reconciliation disputes at year-end over who should have been counted. Stop-loss limits should be specified as concrete dollar amounts per individual, and the aggregate attachment point as a percentage above the benchmark; both figures need to match the population’s actual risk profile rather than a template. Every participant should also sign an attestation confirming the accuracy of financial data submitted during drafting. If that data turns out to be materially wrong and federal program dollars are involved, the attestation becomes evidence in any subsequent fraud investigation.
Reconciliation, Exit, and Tail Liability
Once the arrangement is approved, it enters a performance period that usually aligns with the calendar year. Reconciliation occurs after the performance period ends, often taking an additional six months to process outstanding claims. Final shared savings or losses are then calculated and distributed by contract percentage. Disputes over reconciliation math are common, and well-drafted agreements include a dispute resolution path, often requiring mediation or internal review before arbitration or litigation.
Every agreement should address what happens when a participant leaves or the arrangement dissolves. Two issues cause the most trouble. If the arrangement uses claims-made coverage, departing participants need tail coverage for claims filed after departure for services rendered while they were still in the arrangement. Purchased separately, tail coverage can run roughly twice the final-year premium, which is why sophisticated participants negotiate upfront for the entity to fund tail coverage upon departure. Occurrence-based policies avoid the problem because coverage is built into the original policy period. For surplus or deficit distribution at dissolution, state receivership statutes generally pay secured creditors and administrative expenses first, then policyholder claims, then federal and state government claims, and finally general creditors and equity holders. Participants who wait until dissolution to negotiate their share find the priority order has already decided for them.
Tax-Exempt Participants
Tax-exempt organizations face additional scrutiny around private inurement. A 501(c)(3) must ensure none of its earnings flow to private individuals in ways that serve private rather than charitable interests. Shared savings distributions, performance bonuses, or administrative fees paid to individuals with substantial influence over the organization can trigger excise taxes on the recipient and on managers who approved the transaction.15Internal Revenue Service. Exemption Requirements – 501(c)(3) Organizations The standard protection is to set these payments at fair market value and document the rationale contemporaneously.