In a July 21, 2026, announcement, the U.S. Department of Health and Human Services (“HHS”) granted the Centers for Medicare & Medicaid Services (“CMS”) federal health care program exclusion authority under the Social Security Act. On October 13, 2026, the delegation was formalized, and on October 14, 2026, CMS announced it. Exclusion exists to remove “bad actors” from federal health care programs, and the authority was previously limited to the Office of Inspector General (“OIG”) under delegated authority. This expansion, however, raises significant questions for health care entities – particularly how CMS intends to use its new exclusion authority and to what extent, if at all, it will coordinate with OIG on exclusion decisions.
Background
Statutory exclusion authorities provide various grounds for the government to exclude an individual or entity from participation in federal health care programs, such as Medicare, Medicaid and TRICARE. Historically, exclusion has been used by OIG for significant issues often involving certain felony convictions, licensure revocations and criminal fraud and abuse matters, including violations of the False Claims Act (“FCA”). Exclusions are typically categorized as mandatory exclusions (in which OIG is required by law to exclude those convicted of particular offenses) and permissive exclusions (in which the OIG has discretion on whether to exclude based on a variety of grounds). OIG has often resolved potential exclusion exposure by requiring a provider to enter into a Corporate Integrity Agreement (“CIA”) in lieu of exclusion. Individuals and entities frequently resolve potential exclusion exposure from OIG through self-disclosure, using the OIG’s Health Care Fraud Self-Disclosure Protocol (“SDP”). Self-disclosure reduces and nearly eliminates the risk that OIG will impose exclusion or a CIA for the misconduct.
Potential Impact
In the July announcement, HHS Secretary Robert F. Kennedy, Jr. stated that “CMS and OIG will be able to use that [exclusions] authority to remove bad actors from federal health care programs and in many cases to permanently ban them from returning.” The shift coincides with the administration’s decision to pause more than one billion dollars in federal Medicaid payments to California and Minnesota amid suspected fraud and noncompliance. In the October notice, Secretary Kennedy expanded on this, noting that the permissive exclusion authority was being delegated specifically to the CMS Administrator, though redelegation in accordance with CMS policies, procedures and guidance is possible.
Giving exclusion authority to CMS, in addition to the OIG, raises significant questions of experience and expertise. OIG has fraud expertise, largely because of its existing focus on investigations, enforcement and assessments to identify noncompliance (such as improper payments, unrendered services and kickbacks). CMS’s expertise, on the other hand, is focused on billing and coding, which includes clinical documentation standards, coverage determinations and revenue cycle management. In short, extending exclusion authority to CMS risks applying exclusion to errors in an extraordinarily complex regulatory environment rather than to intentional fraud.
While CMS and OIG have not yet issued guidance or rules explaining how the authority will be administered, the change appears to be effective immediately and raises several questions, including:
- How will current exclusion standards be affected?
- What effect will joint agency enforcement have on health care entities and appeals processes?
- What types of providers and services will CMS target?
- Will CMS have the same guardrails as OIG, with a remit to protect essential medical services, particularly in health care deserts?
- How will FCA settlements be affected?
- How closely will CMS and OIG coordinate their efforts?
- Does CMS’s new found authority meaningfully increase the incentive for providers to self-disclose potential fraud or abuse, particularly where the conduct could support a permissive exclusion?
- Can the CMS Administrator delegate the new exclusion authority to CMS’s fiscal intermediaries and other private contractors? If such delegation is possible, will those contractors be financially incentivized to use the new authority?
Ultimately, this is a potentially vast expansion without any visible guardrails, and its true impact remains to be seen.
Practical Takeaways
Health care entities should monitor for further developments and guidance from CMS and OIG, as well as other sources such as the Federal Register and agency press conferences. This expansion of exclusion authority is not merely an administrative change; rather, it reflects the government’s continued focus on program integrity and fraud prevention, perhaps with the exclusion of appropriate guardrails. Entities should bolster their compliance programs, with particular attention to assessing and mitigating risk and implementing preventive controls. In addition, health care entities should treat every CMS inquiry related to billing and coding as though it carries potential exclusion risk. Until guidance is issued or the authority is applied in practice, entities should consider working with counsel so that investigative work and decisions around self-disclosing potential fraud and abuse may be protected by the attorney-client privilege.
Hall Render will continue to track developments on this new CMS exclusion authority. If you have questions about this topic, please contact:
- Katherine Kuchan at (414) 721-0479 or kkuchan@hallrender.com;
- Ritu Kaur Cooper at (202) 370-9584 or rcooper@hallrender.com;
- David Honig at (317) 977-1447 or dhonig@hallrender.com; or
- Your primary Hall Render contact.
Special thanks to Compliance Advisor Melissa La Motta for her assistance in the preparation of this article.
Hall Render blog posts and articles are intended for informational purposes only. For ethical reasons, Hall Render attorneys cannot give legal advice outside of an attorney-client relationship.
