Key Takeaways
- On October 14, HHS delegated permissive exclusion authority under Section 1128(b) of the Social Security Act to CMS, effective immediately, giving CMS independent power to bar individuals and entities from Medicare, Medicaid, and other federal healthcare programs.
- OIG retains its full exclusion authority, creating two parallel decision-makers within HHS, and CMS may redelegate the authority without clear limits on who can make exclusion decisions.
- Key questions remain regarding governing standards, interaction with other program integrity tools, appeals, Corporate Integrity Agreements, and False Claims Act and self-disclosure settlements.
On October 14, the U.S. Department of Health and Human Services (HHS) published a Statement of Delegation of Authority in which Secretary Robert F. Kennedy, Jr. delegated to the Administrator of the Centers for Medicare & Medicaid Services (CMS) the Secretary’s permissive exclusion authorities under Section 1128(b) of the Social Security Act. These authorities allow the government to bar individuals and entities from participating in Medicare, Medicaid, and other federal healthcare programs. The delegation formalizes an announcement the Secretary made at a July 2026 press conference on HHS anti-fraud initiatives and is effective immediately.
For nearly four decades, the HHS Office of Inspector General (OIG) has been the sole agency exercising the Secretary’s exclusion authorities. The new delegation does not displace OIG; instead, it creates two parallel decision-makers within HHS that can exclude on permissive grounds. For now, the notice raises more questions than it answers, leaving healthcare organizations to navigate significant uncertainty about how, when, and against whom CMS will use its new authority.
Overview
The delegation covers the Secretary’s permissive authorities under Section 1128(b), which include, among other grounds, certain misdemeanor healthcare fraud convictions, license revocations or suspensions, and the submission of false or fraudulent claims under Section 1128(b)(7). According to the notice, CMS requested the authority, and HHS granted the request because, “[a]s the agency directly responsible for administering Medicare and Medicaid, CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations.” According to the notice, the delegation will reduce redundancy and improve program integrity outcomes by aligning investigative and enforcement responsibilities within a single operating division.
The delegation “does not affect or diminish” the Secretary’s 1988 delegation to OIG, meaning OIG retains its full exclusion authority. The delegation to CMS specifically excludes the authority to conduct hearings and to issue regulations, noting that CMS’s authority will be exercised in accordance with the HHS’s “applicable policies, procedures, guidelines, and regulations.” It therefore is unclear whether OIG’s exclusion regulations at 42 C.F.R. Part 1001 and its long-standing guidance will bind CMS.
Two other features merit attention. First, the notice permits CMS to redelegate the authority, subject only to review by an office within CMS’s Office of Human Capital, without specifying to whom or at what level exclusion decisions must be made. Second, the Secretary “affirm[ed] and ratif[ied]” any prior exercise of the authority by “the Administrator or subordinates,” suggesting CMS may already have exercised its exclusion authority before the notice was published.
Key Open Questions
The notice leaves many practical questions unanswered. Consider, for example, the following:
- Governing standards. What standards will CMS apply in deciding whether and for how long to exclude individuals and entities? Will CMS apply OIG’s published criteria for permissive exclusions and determining exclusion length?
- Interaction with other program integrity tools. How will CMS use exclusion alongside its existing tools, such as payment suspensions, overpayment recoupment, and Medicare enrollment denials and revocations? The delegation comes in the wake of a broader program integrity push in which CMS has imposed an unprecedented volume of Medicare revocations and payment suspensions, paused Medicaid payments to some states, and increased pressure on state Medicaid fraud control units. Exclusion is likely to serve as an addition to these tools rather than a replacement.
- Redelegation authority. How will CMS use its redelegation authority? CMS contracts with a number of private entities to process claims, enroll and educate providers, and conduct audits. If CMS were to redelegate its exclusion authority to, for example, Medicare Administrative Contractors or Unified Program Integrity Contractors, routine communications could turn into high-stakes interactions that could result in exclusion.
- Exclusion list. Will CMS exclusions be added to OIG’s List of Excluded Individuals/Entities (LEIE) or will CMS maintain its own exclusion list?
- Hearings and appeals. Because the delegation excludes the authority to conduct hearings, how will administrative appeals of CMS-initiated exclusions be handled?
- Integrity agreements. Will CMS enter into Corporate Integrity Agreements (CIAs) or its own form of integrity agreement, in lieu of exclusion? Will it become a party to OIG’s CIAs?
- False Claims Act (FCA) and self-disclosure settlements. Historically, entities have negotiated a release of OIG’s Section 1128(b)(7) authority, often in exchange for a CIA or in recognition of a self-disclosure. Will CMS now need to be a party to FCA and OIG Self-Disclosure Protocol settlements to provide a comparable release, and how will this affect the incentives to self-disclose? Notably, OIG issued an updated Health Care Fraud Self-Disclosure Protocol on October 15, just one day after HHS published the Statement of Delegation of Authority. OIG’s updated Self-Disclosure Protocol makes no mention of CMS’s new exclusion authority or how, if at all, the agencies will coordinate with respect to exclusion decisions.
In short, CMS now has independent power to exclude providers and suppliers from federal healthcare programs, but how it will use that power remains largely undefined. Until the agencies provide clarity, entities working through issues with the government, including resolving allegations with the Department of Justice, OIG, or other agencies, will need to account for the possibility that CMS may separately pursue exclusion.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
