First announced at a July 2026 press conference, the delegation by HHS Secretary Robert F. Kennedy Jr. to the Centers for Medicare & Medicaid Services (CMS) to exclude individuals and entities from participation in federal healthcare programs (FHCPs) was published in the Federal Register on October 14, 2026 and took effect immediately. It grants CMS authority to impose permissive or discretionary exclusions (but not mandatory exclusions for certain criminal convictions).
Since 1984, the HHS secretary delegated both mandatory and permissive exclusion authority under Section 1128 of the Social Security Act (SSA) to its Office of Inspector General (HHS-OIG). As discussed below, CMS has also historically held narrower exclusion powers for specified Medicare violations, although they were rarely, if ever, used. The October 2026 delegation substantially expands CMS’s existing authority by extending to CMS Section 1128(b)’s broader permissive exclusion grounds. The co-delegation expands CMS’s program integrity enforcement toolkit, potentially improving agency efficiency, but raises significant questions about how CMS will share this authority with HHS-OIG and whether CMS will exercise its new authority in a manner materially different from HHS-OIG.
On October 22, 2026, DOJ’s Civil Division and HHS announced a Healthcare False Claims Act Self-Disclosure Pilot Program (FCA SDPP). The initiative offers an early indication of how CMS may participate alongside DOJ in coordinated False Claims Act (FCA) resolutions. This announcement comes on the heels of an October 15, 2026 DOJ-OIG initiative coordinating voluntary self-disclosures of potential criminal healthcare fraud, accompanied soon thereafter by revisions to HHS-OIG’s longstanding Health Care Fraud Self-Disclosure Protocol (SDP). Notably, although both initiatives seek to facilitate voluntary self-disclosures, HHS-OIG’s SDP remains an established, ongoing disclosure mechanism, whereas DOJ and HHS have expressly designated the new FCA self-disclosure program as a six-month pilot.
Together, these developments reflect a broader effort to streamline the resolution of overlapping criminal, civil, and administrative healthcare enforcement matters. The FCA self-disclosure pilot expressly builds on this approach by seeking to reduce duplicative disclosures through existing civil self-disclosure programs and facilitating coordinated resolutions involving DOJ, HHS-OIG, and CMS.
In frequently asked questions (FAQs) updated on November 2, 2026, HHS-OIG clarified the various self-disclosure pathways:
- Potential criminal conduct should be disclosed to DOJ
- Conduct implicating HHS-OIG administrative remedies should be disclosed through HHS-OIG’s SDP
- Matters implicating the FCA and HHS-OIG and CMS administrative authorities should be disclosed through the FCA SDPP
- Physician self-referral matters not implicating the FCA should be disclosed to CMS’s Voluntary Self-Referral Disclosure Protocol
HHS-OIG also confirmed that it will coordinate with DOJ on disclosures under both the FCA pilot and DOJ’s corporate enforcement and voluntary self-disclosure policy.
WHAT CHANGED AND WHAT THIS COULD MEAN
Section 1128(b) of the SSA, 42 USC § 1320a-7(b), and the implementing regulations create 17 separate bases for permissive exclusions, ranging from False Claims Act (FCA) violations, certain misdemeanor convictions, and loss of professional licenses to less serious infractions like defaulting on HEAL education loans. HSS-OIG has promulgated regulations through Administrative Procedure Act notice-and-comment rulemaking for each of these permissive or discretionary exclusion authorities. HHS-OIG also has decades of experience exercising this discretion.
How CMS’s Exclusion Authority Developed
Federal healthcare program exclusion authority has developed over several decades. In 1979, the Health Care Financing Administration (HCFA), CMS’s predecessor, issued regulations addressing exclusions of practitioners, providers, and suppliers alongside practitioner suspensions. See 44 Fed. Reg. 31138 (May 30, 1979). The US Congress subsequently enacted Section 1128A of the SSA in 1981, authorizing the HHS secretary to impose civil monetary penalties, assessments, and exclusions for specified violations (and later enactments added further exclusion grounds).
In 1994, HHS issued a rulemaking that divided enforcement responsibilities between HHS-OIG and HCFA/CMS: HHS-OIG’s delegated exclusion authorities generally concerned fraud, misrepresentation, or falsification, while CMS’s addressed violations of programmatic and regulatory requirements. See 59 Fed. Reg. 52967 (Oct. 20, 1994).
The regulatory framework continued to develop in stages over the years. In 1998, HCFA adopted 42 CFR Part 402 for civil monetary penalties and assessments, making HHS-OIG’s hearing and appeal procedures in Part 1005 applicable to its delegated authorities. 63 Fed. Reg. 68687 (Dec. 14, 1998) (with the existing regulation for hearings and appeals promulgated under 42 CFR § 402.19 maintaining this same application to CMS).
In 2007, CMS adopted Subpart C’s procedures for exclusion duration, notice, hearings, appeals, and reinstatement. 72 Fed. Reg. at 39746 (July 20, 2007). The current regulations identify CMS or HHS-OIG exclusion authority for specified Medicare violations, such as repeated improper clinical-laboratory assignment billing, excess charges by certain suppliers, and failures to make required refunds. These exclusion remedies, previously delegated to CMS, are narrower than Section 1128(b)’s permissive exclusions, which include certain criminal convictions, adverse licensing actions, and false or fraudulent claims, among others.
Historically, CMS has not exercised its longstanding Part 402 exclusion powers in any regular fashion. Against that history, the October 14 delegation by the HHS secretary is significant because it permits CMS to pursue the full range of Section 1128(b) permissive exclusion grounds alongside HHS-OIG, rather than limiting CMS to its previously enumerated exclusion authorities.
Questions Raised by the New Delegation
The new co-delegation to CMS of the statutory permissive exclusion authorities raises a host of short-term questions:
- Will CMS redelegate its permissive exclusion authority, as granted in HHS Secretary Kennedy’s October 14 Statement of Delegation Authority, and if so, to whom?
- Will CMS rely on, adapt, or supplement its existing Part 402 exclusion procedures when exercising its newly delegated Section 1128(b) powers? Although Part 402 already provides notice and appeal procedures, its enumerated substantive grounds differ from Section 1128(b). Early signals suggest CMS may draw on HHS-OIG’s exclusion appeal procedures, particularly because Part 402 already incorporates the HHS administrative hearing and appeals framework by reference. Whether CMS will apply that framework to its newly delegated Section 1128(b) authority remains to be clarified.
- How will CMS and HHS-OIG collaborate to exercise these permissive exclusion authorities in an efficient and effective manner? On October 27, 2026, HHS-OIG published a series of Exclusions FAQs addressing this question in part, stating that it expects to continue coordinating with CMS and offered no additional information concerning case allocation. HHS-OIG also stated that it is coordinating with CMS to make CMS exclusions public through the List of Excluded Individuals and Entities (LEIE), with implementation details still under development. Inspector General March Bell has expressed support for Secretary Kennedy’s delegation of permissive exclusion to CMS to assist the agency with its program integrity efforts.
- Will CMS waive its permissive exclusion authority in a manner similar to how HHS-OIG waives its (b)(7) exclusion authority in connection with FCA settlements, and will CMS join HHS-OIG in negotiating or monitoring Corporate Integrity Agreements? Certainly, in connection with future FCA settlements, settling parties will want assurances that any resolution or waiver of permissive exclusion reaches the permissive exclusion authority of both HHS-OIG and CMS. In the Exclusions FAQs, HHS-OIG clarified that it will resolve permissive exclusion authority on behalf of HHS in DOJ FCA settlements, meaning settling parties need not separately negotiate with CMS over that authority. However, questions remain regarding whether CMS will have a role in negotiating or monitoring Corporate Integrity Agreements and how CMS will exercise its expanded exclusion authority outside the FCA settlement context.
- Will the delegation by Secretary Kennedy to CMS of this permissive exclusion authority result in CMS reconsidering its programmatic role in compliance program oversight? Notably, CMS has had the congressional authority vested to HHS in the Affordable Care Act in 2010 to require healthcare providers and suppliers, as a condition of enrollment in Medicare and Medicaid, to establish a compliance program containing certain core elements, but CMS has not embraced that authority. Will this new delegation incentivize CMS to engage in mandatory compliance program oversight through its permissive exclusion authority waiver in a manner similar to HHS-OIG, or will it somehow combine that authority with the mandatory compliance program authority tied to Medicare and Medicaid enrollment?
- Will CMS use AI to monitor mandatory compliance obligations tied to program enrollment or to exclusion waivers given CMS’s stated interest in using AI tools in its program integrity efforts?
HHS explained that CMS’s role in administering Medicare and Medicaid uniquely positions it to identify misconduct and develop evidence supporting exclusion determinations. According to the Federal Register notice, the delegation is intended to align investigative and enforcement responsibilities and strengthen program integrity.
Role of CMS in the FCA Self-Disclosure Pilot
The newly announced FCA SDPP protocol—as reported in our October 26, 2026 LawFlash—expressly identifies CMS, HHS-OIG, and HHS’s Office of the General Counsel as participants in the six-month FCA SDPP and contemplates coordinated resolution of FCA liability with specified HHS administrative authorities, including Medicare enrollment revocation and permissive exclusions. Consistent with this coordinated approach, HHS-OIG’s November 2 FAQs confirm that the agency will coordinate with DOJ on disclosures under the FCA pilot, as it has historically done for disclosures under HHS-OIG’s SDP.
Under the FCA self-disclosure protocol, CMS will not impose civil monetary penalties or seek enrollment revocation as part of a qualifying resolution, while HHS-OIG will not require a Corporate Integrity Agreement. This provides concrete evidence of CMS’s anticipated role at the FCA resolution table, although the protocol does not expressly establish a blanket waiver of CMS’s newly delegated permissive exclusion authority or resolve how CMS and HHS-OIG will coordinate outside the FCA SDPP.
IMPLICATIONS FOR HEALTHCARE AND LIFE SCIENCES ORGANIZATIONS
The delegation materially expands CMS’s exclusion authority beyond the specified Medicare compliance violations already covered by Part 402 and adds to its existing program integrity tools, including, for providers and suppliers, payment suspensions, enrollment revocations, and overpayment recoveries.
The new healthcare self-disclosure program also illustrates the potential interplay between these authorities in FCA resolutions: for eligible voluntary self-disclosures, CMS’s commitment not to seek enrollment revocation will be addressed as part of a coordinated resolution rather than solely through CMS’s ordinary program-integrity processes.
Practical Consequences of Exclusion and Revocation
Exclusion from federal healthcare programs can have severe consequences for healthcare businesses, potentially affecting their ability to continue operating as a going concern. Commercial health plans, for instance, will generally refuse to contract with or pay excluded providers and suppliers. Relying solely on self-pay customers is a very rare business model.
CMS already possesses a similarly consequential enforcement tool: its Medicare enrollment revocation authority, which typically also results in being placed on CMS’s “Preclusion List,” preventing Medicare Advantage organizations from contracting with a provider or supplier that had its Medicare enrollment revoked. Medicaid programs will also refuse to allow revoked providers and suppliers to participate in Medicaid.
Following a proposal in summer 2026, CMS finalized a rule on November 4, 2026 that will significantly broaden its revocation authority when it takes effect on January 1, 2027. The rule provides CMS with greater flexibility and fewer bases for appeal, including retroactive revocations and recoupments of Medicare payments back to that retroactive date. Will CMS seek a similar approach with its permissive exclusion authorities? Perhaps only time will tell. And with the statutory appeal rights for exclusion actions afforded through the SSA and current exclusion regulations, an erosion of those appeal rights for permissive exclusions could face legal challenge.
Considerations for Life Sciences Companies
As for life sciences companies, CMS has significant civil monetary penalty (CMP) authorities that now extend to pharmaceutical manufacturers, including for violations of Medicaid drug-pricing and reporting requirements, Medicare Part D manufacturer discount obligations, and Medicare drug-pricing requirements. However, CMPs are generally not nearly as consequential as exclusion. HHS-OIG has asserted since the late 1990s that it can exclude device and pharmaceutical manufacturers and other “indirect providers” from participation in Medicare and Medicaid.
CMS generally has less experience in the program integrity realm with life sciences companies, in part because the CMS enrollment and payment authorities do not extend to life sciences companies. Consequently, we would speculate that HHS-OIG will retain primary permissive exclusion authority over life sciences companies notwithstanding the HHS secretary’s recent co-delegation of the permissive exclusion authority.
