From Announcement to Authority: HHS Formalizes CMS’ Exclusion Power

Nearly three months after announcing that the Centers for Medicare & Medicaid Services (CMS) would share responsibility for excluding individuals and entities from federal healthcare programs, the U.S. Department of Health and Human Services (HHS) has formalized that authority through an October 14, 2026 Federal Register notice delegating the Secretary’s permissive exclusion powers to the CMS Administrator.

As we previously discussed in Enforcement Edge, this expansion of CMS’ role is part of the administration’s broader effort to prevent improper payments and remove providers that present program-integrity concerns. The notice confirms that CMS will have a direct role in exclusion enforcement, but says little about how CMS and the Office of Inspector General (OIG) will work together. That gap leaves providers and manufacturers with open questions about settlement releases, enforcement standards, and the process for challenging an exclusion.

A Broader Enforcement Role for CMS

The delegation covers Section 1128(b) of the Social Security Act, which permits exclusion on specified grounds, but does not extend to mandatory exclusion under Section 1128(a), civil monetary penalties (CMPs) under Section 1128A, or authority under Section 1156. CMS must exercise its new authority under applicable departmental policies and regulations, and the delegation does not authorize CMS to conduct hearings or issue regulations. The delegation also allows redelegation and ratifies prior actions within its scope.

The distinction between mandatory and permissive exclusion matters. Mandatory exclusion lasts at least five years and applies to program-related crimes, patient abuse or neglect, felony healthcare fraud, and felony controlled-substance offenses. Permissive exclusion, by contrast, gives the government discretion over whether to pursue exclusion and, within applicable statutory limits, how long it will last. Section 1128(b) defines the grounds on which the government may exercise that discretion.

Several of those statutory grounds address conduct familiar to healthcare enforcement practitioners. Section 1128(b)(7) covers fraud, kickbacks, and other prohibited activities, and often arises in False Claims Act (FCA) settlements. Other provisions address specified licensing actions involving competence, performance, or financial integrity, Section 1128(b)(4); sanctions imposed by other federal or state healthcare programs on those grounds, Section 1128(b)(5); and excessive charges, unnecessary services, and care that falls below professionally recognized standards, Section 1128(b)(6).

OIG reported 2,837 exclusions in fiscal year 2025. CMS’ participation could increase the government’s capacity to develop exclusion cases, though the amount of additional enforcement will depend on the resources CMS commits and how the agencies divide the work.

Why Exclusion Matters

Exclusion is one of the government’s most consequential healthcare enforcement tools. Federal healthcare programs generally cannot pay for items or services that an excluded party furnishes, orders, or prescribes. Unlike revocation of Medicare enrollment, exclusion reaches across federal healthcare programs and carries corresponding consequences for participation in state healthcare programs. For a business that depends on Medicare or Medicaid reimbursement, exclusion can threaten its continued operation.

These consequences also extend to organizations that work with an excluded party. OIG’s guidance explains that the payment prohibition can reach services included in bundled payments or furnished by contractors. An organization that employs or contracts with an excluded person to provide federally reimbursable items or services can face CMP exposure if it knows or should know of the exclusion, and payments for those items or services may constitute overpayments. Exclusion screening therefore matters well beyond an organization’s own enrollment status.

Two Agencies, Multiple Unanswered Questions

For companies resolving healthcare fraud allegations, one immediate concern is whether a settlement will resolve exclusion exposure across HHS. Historically, defendants negotiating FCA settlements have addressed Section 1128(b)(7) exposure with OIG, which often agrees to forgo exclusion in exchange for a Corporate Integrity Agreement (CIA). OIG’s exclusion criteria also recognizes circumstances in which a cooperative, good-faith self-disclosure may support a release without integrity obligations.

With CMS now sharing that exclusion authority, parties will need to determine whether a proposed release binds HHS, including CMS, and whether CMS must participate in or concur with the settlement. The delegation does not itself require two separate releases or establish that CMS can revisit conduct covered by a binding agreement. It does, however, make the scope of the release, the authority of the officials granting it, and the effect of any CIA issues to address early in negotiations to avoid delays at the end of a lengthy investigation.

Consistency between the agencies will also matter. OIG’s established criteria assesses the risk a party poses to federal healthcare programs based on factors such as its conduct, cooperation, remediation, and compliance history. For companies considering self-disclosure or negotiating compliance obligations, a key question is whether CMS will apply the same criteria. HHS will also need a way to resolve disagreements between the agencies over whether permissive exclusion is warranted and how long it should last, within applicable legal limits.

CMS may also use its permissive exclusion authority to pursue conduct that OIG has not historically prioritized, potentially including emerging areas of enforcement interest such as the provision of gender-affirming care. Because the delegation creates no new substantive ground for exclusion, CMS would still need a statutory basis and supporting evidence for any action.

The procedural questions are equally significant. Existing exclusion procedures provide for administrative law judge review, Departmental Appeals Board review, and subsequent judicial review. Section 1128(b)(7) generally affords a right to a hearing before exclusion takes effect, subject to a health-or-safety exception. The regulations in 42 C.F.R. Parts 1001 and 1005, however, address OIG actions, leaving CMS to explain how its cases will fit into that process. Compliance teams will also need to know how CMS will administer its exclusions, including whether they will appear on OIG’s List of Excluded Individuals/Entities (LEIE) and who will handle reinstatement.

What This Means for Providers and Manufacturers

The delegation reflects the growing role of administrative action in healthcare fraud enforcement. CMS’ enrollment inquiries, claims reviews, and requests for supporting documentation may now inform exclusion decisions as well. Organizations should assess how those reviews could create overlapping exposure to exclusion, revocation, payment restrictions, CMPs, and FCA liability.

Several practical steps follow:

• Review exclusion screening. Confirm that screening covers relevant employees, contractors, vendors, and ordering or prescribing practitioners and incorporates applicable state exclusion lists. OIG recommends monthly LEIE screening to minimize exposure. Organizations using outside vendors should also verify how those vendors handle updates and potential matches.
• Plan for coordination in settlement discussions. In matters involving Section 1128(b)(7), clarify CMS’ position and confirm the scope of proposed exclusion releases and any related compliance obligations.
• Build the record during CMS reviews. Preserve documentation supporting claims, clinical decisions, and corrective action, recognizing that a response to a payment or enrollment inquiry may become important in a later exclusion proceeding.
• Monitor implementation guidance. Look to CMS procedures and OIG-CMS coordination statements for clarification on case allocation, appeals, exclusion reporting, and reinstatement.

For questions about these developments and their implications, please contact the authors or any member of Arnold & Porter’s White Collar Defense & Investigations or Life Sciences & Healthcare Regulatory practice groups.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.