Although previously announced at a July 21, 2026 press conference, the US Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. has now formally delegated authority to the Centers for Medicare & Medicaid Services (CMS) to exclude individuals and entities from participation in federal healthcare programs (FHCPs). The delegation, published in the Federal Register on October 14, 2026, and effective immediately, grants CMS authority to impose permissive or discretionary exclusions (but not mandatory exclusions for certain criminal convictions).
Since 1984, the HHS Secretary had delegated both mandatory and permissive exclusion authority under Section 1128 of the Social Security Act (SSA) to its Office of Inspector General (OIG). As discussed below, CMS also has historically held narrower exclusion powers for specified Medicare violations, although they were rarely if ever used. The October 2026 delegation substantially expands CMS’s existing authority by extending to CMS, Section 1128(b)’s broader permissive exclusion grounds. The co-delegation expands CMS's program integrity enforcement toolkit, contributing to greater agency efficiency, but raises significant questions about how CMS will share this authority with OIG and whether CMS will exercise its new authority in a manner materially different from OIG.
What Changed and What Could This Mean?
Section 1128(b) of the Social Security Act, 42 USC § 1320a-7(b), and the implementing regulations create 17 separate bases for permissive exclusions, ranging from False Claims Act (FCA) violations, certain misdemeanor convictions, loss of professional licenses, to more benign infractions like defaulting on HEAL education loans. OIG has regulations promulgated under APA notice and comment rulemaking for each of these permissive or discretionary exclusion authorities. OIG also has decades of experience exercising this discretion.
Federal healthcare program exclusion authority has developed over several decades. In 1979, the Health Care Financing Administration (HCFA), CMS's predecessor, issued regulations addressing exclusions of practitioners, providers, and suppliers alongside practitioner suspensions. See 44 Fed. Reg. 31138 (May 30, 1979). Congress subsequently enacted Section 1128A of the SSA in 1981, authorizing the HHS Secretary to impose civil monetary penalties, assessments, and exclusions for specified violations (and later enactments added further exclusion grounds).
In 1994, HHS issued a rulemaking that divided enforcement responsibilities between OIG and HCFA/CMS: OIG's delegated exclusion authorities generally concerned fraud, misrepresentation, or falsification, while CMS's addressed violations of programmatic and regulatory requirements. See 59 Fed. Reg. 52967 (Oct. 20, 1994).
The regulatory framework continued to develop in stages over the years. In 1998, HCFA adopted 42 CFR Part 402 for civil monetary penalties and assessments, making OIG's hearing and appeal procedures in Part 1005 applicable to its delegated authorities. 63 Fed. Reg. 68687 (Dec. 14, 1998) (with the existing regulation for hearings and appeals promulgated under 42 CFR § 402.19 maintaining this same application to CMS).
In 2007, CMS adopted Subpart C's procedures for exclusion duration, notice, hearings, appeals, and reinstatement. 72 Fed. Reg. at 39746 (July 20, 2007). The current regulations identify CMS or OIG exclusion authority for specified Medicare violations, such as repeated improper clinical-laboratory assignment billing, excess charges by certain suppliers, and failures to make required refunds. These exclusion remedies, previously delegated to CMS, are narrower than Section 1128(b)'s permissive exclusions, which include certain criminal convictions, adverse licensing actions, and false or fraudulent claims, among others.
For a variety of reasons, CMS historically has not exercised its longstanding Part 402 exclusion powers in any regular fashion. Against that history, the October 14, 2026 delegation is significant because it permits CMS to pursue the full range of Section 1128(b) permissive exclusion grounds alongside OIG, rather than limiting CMS to its previously enumerated exclusion authorities.
The new co-delegation to CMS of the statutory permissive exclusion authorities raises a host of short-term questions:
- Will CMS redelegate its permissive exclusion authority, as granted in Secretary Kennedy’s October 14 Statement of Delegation Authority, and if so, to whom?
- Will CMS rely on, adapt, or supplement its existing Part 402 exclusion procedures when exercising its newly delegated Section 1128(b) powers? Although Part 402 already provides notice and appeal procedures, its enumerated substantive grounds differ from Section 1128(b)?
- Will CMS adopt the existing HHS administrative hearing and appeals framework—which its Part 402 regulations already incorporate by reference—to hear appeals for Section 1128(b) permissive exclusions, or will CMS work with the secretary to create a different appeals process?
- How will CMS and OIG collaborate to exercise these permissive exclusion authorities in an efficient and effective manner? Incidentally, Inspector General March Bell expressed his support for the secretary’s delegation of permissive exclusion to CMS to assist the agency with its program integrity efforts.
- Will CMS waive its permissive exclusion authority in a manner similar to how OIG has waived it in connection with FCA settlements, and will CMS join OIG in negotiating or monitoring Corporate Integrity Agreements? Certainly, in connection with future FCA settlements, we would expect settling parties to seek permissive exclusion authority waivers from both HHS OIG and CMS, but what will that process look like?
- Will the delegation by the Secretary to CMS of this permissive exclusion authority result in CMS reconsidering its programmatic role in compliance program oversight? Notably, CMS has had the congressional authority vested to HHS in the Affordable Care Act in 2010 to require healthcare providers and suppliers, as a condition of enrollment in Medicare and Medicaid, to establish a compliance program containing certain core elements, but CMS has not embraced that authority. Will this new delegation incentivize CMS to engage in mandatory compliance program oversight through its permissive exclusion authority waiver in a manner similar to OIG, or will it somehow combine that authority with the mandatory compliance program authority tied to Medicare and Medicaid enrollment?
- Will CMS use AI to monitor mandatory compliance obligations tied to program enrollment or to exclusion waivers given CMS’s stated predilection for the adoption of effective AI tools in its program integrity efforts?
HHS explained that CMS's role in administering Medicare and Medicaid uniquely positions it to identify misconduct and develop evidence supporting exclusion determinations. According to the Federal Register notice, the delegation is intended to align investigative and enforcement responsibilities and strengthen program integrity.
Implications for Healthcare and Life Science Organizations
The delegation materially expands CMS's exclusion authority beyond the specified Medicare compliance violations already covered by Part 402 and adds to its existing program integrity tools, including, for providers and suppliers, payment suspensions, enrollment revocations, and overpayment recoveries.
CMS also has significant civil monetary penalty authorities that now extend to pharmaceutical manufacturers. The exclusion authority has often been described colloquially as the “nuclear bomb” as it generally renders a healthcare business unable to continue to carry on its business. Commercial health plans, for instance, will generally refuse to contract with or pay excluded providers and suppliers. Relying solely on self-pay customers is a very rare business model.
CMS already possesses similar experience in exercising a “nuclear bomb” authority—its Medicare enrollment revocation authority that also results in being placed on CMS’s “Preclusion List” which prevents Medicare Advantage organizations from contracting with the provider or supplier that had its Medicare enrollment revoked. Medicaid programs will also refuse to allow revoked providers and suppliers to participate in Medicaid.
In the summer of 2026, CMS proposed rulemaking significantly broadening its revocation authority with greater flexibility vested to CMS and less due process or appeal rights extended to providers and suppliers. Will CMS seek a similar approach with its permissive exclusion authorities? Perhaps only time will tell, but given all of the other program integrity arrows in CMS’s quiver, like revocations and payment suspensions, the answer is far from obvious. And with the statutory appeal rights for exclusion actions afforded through the Social Security Act and current exclusion regulations, an erosion of those appeal rights for permissive exclusions would certainly face legal challenge.
As for life science companies, OIG has asserted since the late 1990s that it can exclude device and pharmaceutical manufacturers and other “indirect providers” from participation in Medicare and Medicaid. CMS generally has less experience in the program integrity realm with life science companies, in part because the CMS enrollment and payment authorities do not extend to life science companies. Consequently, we would speculate that OIG will retain primary permissive exclusion authority over life science companies notwithstanding the HHS secretary’s recent co-delegation.