The Centers for Medicare & Medicaid Services (CMS) has received a significant new enforcement authority that healthcare providers, physician practices, hospitals, medical billing companies, and compliance teams should understand.
On October 14, 2026, the U.S. Department of Health and Human Services (HHS) published a Federal Register notice formally delegating to the CMS Administrator the authority to impose certain permissive exclusions under Section 1128(b) of the Social Security Act. The delegation took effect immediately and does not remove the existing exclusion authority of the HHS Office of Inspector General (OIG).
For physicians and healthcare organizations, the change makes provider screening, documentation, enrollment accuracy, billing oversight, and compliance controls particularly important. An exclusion from federal healthcare programs can have consequences far beyond a single claim: federal healthcare programs generally cannot pay for items or services furnished, ordered, or prescribed by an excluded individual or entity, subject to applicable statutory and regulatory exceptions.
However, the distinction matters: the new delegation does not automatically exclude providers who are investigated, accused of misconduct, or subject to an audit. It authorizes CMS to exercise existing permissive exclusion powers within the applicable legal framework.
This article explains what changed, what exclusion means, which risks healthcare organizations should assess, and how medical practices can strengthen their compliance and revenue cycle management (RCM) processes.
Policy status: October 16, 2026. This article provides general educational information, not legal advice.
Key Takeaways
- On October 14, 2026, HHS formally delegated Section 1128(b) permissive exclusion authority to the CMS Administrator.
- The delegation took effect immediately and preserves the HHS OIG’s existing authority.
- Permissive exclusions may apply to specified forms of misconduct, including certain healthcare-related convictions, license actions, false claims, kickbacks, and unnecessary or substandard services, depending on the applicable statutory ground.
- Exclusion can prohibit federal healthcare program payment for services furnished, ordered, or prescribed by an excluded person or entity.
- Medical practices should maintain reliable screening, credentialing, enrollment, documentation, and billing controls.
- An OIG List of Excluded Individuals/Entities (LEIE) search remains an important compliance tool, but organizations should also monitor applicable CMS and state requirements and not assume a single search answers every screening obligation.
- The delegation does not itself create a new list of prohibited conduct or mean that a provider is excluded merely because an allegation has been made.
1. What Changed on October 14, 2026?
The change was formalized through an HHS notice titled Statement of Delegation of Authority, published in the Federal Register on October 14, 2026.
The notice delegates to the CMS Administrator the authority vested in the HHS Secretary under Section 1128(b) of the Social Security Act. CMS requested the delegation, with HHS explaining that CMS’s role administering Medicare and Medicaid positions it to investigate, identify, and develop evidence supporting permissive exclusion determinations.
The notice also establishes important boundaries:
- CMS’s delegated authority is to be exercised under applicable HHS policies, procedures, guidelines, and regulations.
- The delegation excludes the authority to conduct hearings and issue regulations.
- The HHS Secretary retains authority to issue regulations and submit reports to Congress.
- The delegation does not diminish the prior delegation of exclusion authority to the HHS OIG.
- The delegation is effective immediately.
The practical significance is that CMS now has a more direct role in making permissive exclusion determinations alongside the OIG. It does not mean that the OIG has been replaced or that the legal standards for every exclusion have been rewritten.
Primary source: Federal Register — Statement of Delegation of Authority, October 14, 2026.
2. What Is a Provider Exclusion?
A federal healthcare program exclusion is a legal action that bars an individual or entity from participating in specified federal healthcare programs.
Exclusion is different from a routine claim denial, a Medicare enrollment correction, or an ordinary payment audit. It can affect whether federal healthcare programs may pay for services furnished, ordered, or prescribed by the excluded person or entity.
The consequences may extend beyond the excluded professional’s own claims. Under the applicable exclusion rules, payment restrictions can also affect organizations that employ or contract with excluded individuals when the services fall within the prohibition.
For example, a medical practice may face serious compliance and payment problems if an excluded professional provides services to federal healthcare program beneficiaries, even when the practice itself submits the claims.
The precise consequences depend on the statutory ground, the scope of the exclusion, the services involved, and applicable legal exceptions.
Official reference: HHS OIG — Exclusions Program.
3. What Does “Permissive Exclusion” Mean?
Federal law distinguishes between mandatory exclusions and permissive exclusions.
Mandatory exclusions apply when specified statutory conditions require exclusion. Permissive exclusions allow the government to exclude an individual or entity when an applicable statutory ground is established and the authorized decision-maker determines exclusion is appropriate.
Examples of grounds for permissive exclusion under Section 1128(b) include certain:
- Misdemeanor convictions related to healthcare fraud or controlled substances
- License suspensions, revocations, or surrenders under qualifying circumstances
- Submissions of false or fraudulent claims to federal healthcare programs
- Unlawful kickback arrangements
- Provision of unnecessary or substandard services
- Conduct involving specified fraud in other government-funded programs
- Situations involving ownership or control of sanctioned entities, where the relevant statutory requirements are met
This list is illustrative, not exhaustive. Not every licensing action, billing error, audit finding, or contractual disagreement satisfies a statutory exclusion ground.
The applicable law and evidence must be evaluated in context. A compliance concern should not be described as an exclusion unless an exclusion has actually been imposed.
Official reference: HHS OIG — Background Information and Exclusion Authorities.
4. Does CMS Now Have the Same Authority as the OIG?
The new delegation gives CMS the HHS Secretary’s Section 1128(b) permissive exclusion authority. It does not eliminate the OIG’s existing authority.
The Federal Register notice expressly preserves the earlier delegation to the OIG and does not authorize CMS to conduct hearings or issue regulations under the new delegation.
For providers, this creates a need to pay attention to official guidance from both agencies. The precise operational division of responsibilities, coordination between CMS and the OIG, and future procedural details should be assessed from subsequent official guidance rather than assumed.
The notice itself does not provide a comprehensive new set of procedural instructions for every potential exclusion case.
Primary source: Federal Register notice.
5. How Can Exclusion Affect Physicians and Medical Practices?
Exclusion can create substantial clinical, operational, financial, and administrative challenges.
Medicare and Medicaid payment restrictions
Federal healthcare programs generally cannot pay for items or services furnished, ordered, or prescribed by an excluded person or entity. The prohibition can apply even when another organization submits the claim.
Practices should not assume that billing through a group, hospital, management company, or another professional automatically resolves an exclusion issue.
Credentialing and enrollment risk
Provider enrollment and credentialing records should be accurate and current. Organizations should understand who is authorized to provide, order, prescribe, supervise, or manage services and should respond promptly to relevant changes in licensure or exclusion status.
Contracting and employment risk
Healthcare organizations should screen applicable employees, contractors, and other relevant parties and assess whether their roles create exposure under federal exclusion rules.
The applicable obligations depend on the relationship, services, and legal requirements. Organizations should not treat every vendor or business relationship as identical.
Revenue cycle disruption
An exclusion-related problem may lead to claims being questioned, payments being withheld, repayment exposure, or the need to review previously submitted claims.
Revenue cycle teams should have a clear escalation process for potential exclusion issues rather than treating them as routine coding or claim-edit errors.
Patient-care continuity
If a provider’s participation status changes, an organization may need to arrange appropriate clinical coverage, communicate with affected patients, and maintain continuity of care while complying with applicable legal requirements.
An exclusion affects payment and program participation; it does not, by itself, eliminate a beneficiary’s right to receive benefits under Medicare or Medicaid.
Official reference: HHS OIG — Exclusions FAQs.
6. Why Screening the OIG Exclusion List Matters
The HHS OIG maintains the List of Excluded Individuals/Entities (LEIE), a searchable database of individuals and entities excluded from participation in federal healthcare programs through the OIG’s exclusion process.
OIG advises healthcare organizations to routinely check the list to help prevent hiring or contracting with excluded individuals or entities. Organizations that employ excluded persons may face civil monetary penalty exposure in applicable circumstances.
A strong screening program should include:
- Pre-engagement screening: Check relevant individuals and entities before employment, contracting, enrollment, or other covered relationships begin.
- Ongoing screening: Establish a documented schedule for repeat checks, based on applicable federal and state requirements and the organization’s risk profile.
- Identity matching: Verify that a potential match relates to the correct individual or entity. Similar names alone are not conclusive.
- Documentation: Record the screening date, database or source used, result, and resolution of potential matches.
- Escalation: Refer potential matches to the designated compliance or legal team before making employment, contracting, or billing decisions.
- Re-screening after relevant changes: Reassess when a provider’s identity, license, ownership, enrollment status, or other relevant information changes.
State Medicaid agencies have specific screening requirements. OIG’s guidance directs state Medicaid programs to check the LEIE monthly and in connection with new enrollments. Healthcare organizations should determine the requirements applicable to their own roles and programs instead of assuming one frequency is universally sufficient for every relationship.
The LEIE is an important resource, but the new CMS delegation should not be interpreted as a guarantee that every relevant enforcement action will immediately appear in one database. Follow applicable CMS, OIG, state Medicaid, licensing, and contractual requirements.
Official resources:
7. Billing Compliance: What RCM Teams Should Review
The new delegation is particularly relevant to revenue cycle management because exclusion issues can affect the permissibility of claims and payments—not just whether a claim contains the correct code.
Billing teams should coordinate with compliance, credentialing, human resources, and clinical leadership to establish a reliable review process.
Provider eligibility and identity
Verify the identity and status of the professional or entity associated with the service. Maintain accurate records for relevant NPIs, enrollment details, affiliations, and billing relationships.
Claim and service review
If a potential exclusion issue is identified, do not assume that changing a rendering-provider field or routing a claim through another entity resolves the problem. Determine the actual service, the individuals involved, and the applicable payment restrictions.
Escalation and corrective action
Potential matches, adverse enrollment actions, or exclusion notices should be routed promptly to the designated compliance or legal personnel. Document the decision and any corrective action.
Audit and repayment assessment
When a confirmed exclusion or other material compliance issue is identified, the organization may need to assess affected services, claims, payments, and reporting obligations. The scope of any review should be determined under applicable rules and with appropriate professional advice.
Staff education
Train billing and administrative personnel to recognize exclusion-related issues and understand when to stop routine processing and escalate a concern.
Important: A claim denial, an audit finding, a provider enrollment revocation, and a formal exclusion are different events. Each requires its own analysis and response.
8. Exclusion vs. Medicare Enrollment Revocation vs. Payment Suspension
These terms are often confused, but they describe different enforcement or administrative actions.
| Action | General meaning | Practical implication |
|---|---|---|
| Exclusion | Bars participation in specified federal healthcare programs under the applicable exclusion authority | Broad payment restrictions may apply to services furnished, ordered, or prescribed by the excluded person or entity |
| Medicare enrollment revocation | Removes or terminates a provider’s Medicare billing privileges under applicable enrollment rules | The provider or supplier may no longer bill Medicare under the affected enrollment |
| Payment suspension | Temporarily suspends payments under applicable authority while a matter is addressed | Claims or payments may be delayed or withheld during the suspension |
| Claim denial | A specific claim is not paid as submitted | The claim may require correction, appeal, or other action depending on the reason |
These actions can have different legal bases, processes, and consequences. A revocation or suspension should not automatically be described as an exclusion, and a claim denial does not by itself establish misconduct.
Providers should review the actual notice, cited legal authority, effective date, appeal rights, and operational instructions associated with the action.
9. A Practical Compliance Checklist for Medical Practices
Medical practices can use the following checklist to strengthen their controls.
Provider and workforce screening
- Screen relevant professionals and entities before engagement.
- Establish a documented recurring screening schedule.
- Check the LEIE and any additional sources required for the organization and jurisdiction.
- Resolve potential identity matches before making final decisions.
- Document screening results and follow-up actions.
Enrollment and credentialing
- Maintain accurate provider enrollment and credentialing records.
- Monitor relevant license and participation-status changes.
- Review ownership and management changes where required.
- Confirm that staff understand how to report potential compliance concerns.
Billing and claims
- Maintain accurate rendering, ordering, prescribing, and billing-provider information.
- Establish a process for escalating potential exclusion issues.
- Review affected claims and payments when a material issue is confirmed.
- Document corrective action and obtain appropriate guidance when required.
Governance and accountability
- Assign responsibility for screening, escalation, and documentation.
- Train clinical, HR, credentialing, contracting, and RCM personnel.
- Review procedures when CMS, OIG, or state requirements change.
- Preserve records showing how potential matches and compliance issues were resolved.
This checklist is a practical starting point, not a substitute for a formal compliance program or organization-specific legal advice.
10. What Should Providers Watch for Next?
The October 14 delegation establishes CMS’s authority, but important operational questions may be addressed through subsequent guidance, agency actions, or legal developments.
Healthcare organizations should monitor:
- Official CMS and HHS announcements concerning implementation
- OIG guidance and any updates to exclusion-related resources
- Federal Register notices and applicable regulatory developments
- State Medicaid screening and participation requirements
- Relevant provider enrollment and billing instructions
- Any formal exclusion notices affecting the organization or its personnel
Providers should distinguish between what the delegation formally establishes and what commentators predict may happen next. The notice does not specify a complete future enforcement schedule or guarantee that CMS will pursue a particular number or category of exclusions.
The prudent response is to strengthen existing controls, maintain accurate records, and ensure that potential issues are reviewed promptly.
Frequently Asked Questions
Can CMS now exclude doctors from Medicare and Medicaid?
CMS has received delegated authority to exercise permissive exclusion powers under Section 1128(b) of the Social Security Act. The authority took effect on October 14, 2026. An exclusion still requires an applicable legal basis and the relevant decision-making process.
Does the new delegation mean that CMS replaces the HHS OIG?
No. The Federal Register notice expressly preserves the OIG’s existing delegated authority. CMS and OIG can both have roles in exclusion enforcement.
Can a physician be excluded simply because a claim was denied?
A claim denial alone does not establish an exclusion ground. The applicable statutory criteria and facts must be evaluated. A routine billing error and a formal exclusion are not the same thing.
What is the LEIE?
The List of Excluded Individuals/Entities is an OIG-maintained database of individuals and entities excluded through the OIG’s exclusion process. Healthcare organizations can search it to support applicable screening obligations.
How often should a medical practice screen employees and contractors?
The appropriate schedule depends on applicable federal and state requirements, the relationship involved, and the organization’s compliance policies. OIG recommends routine screening, and state Medicaid programs have specific monthly and new-enrollment screening requirements. Practices should verify which requirements apply to their operations.
Can a practice continue billing for services furnished by an excluded professional?
Organizations should not assume that claims can be paid simply because the practice submits them. Federal exclusion rules can prohibit payment for services furnished, ordered, or prescribed by an excluded person, subject to applicable exceptions. The specific facts and legal requirements should be reviewed before billing or continuing affected arrangements.
Is exclusion the same as Medicare enrollment revocation?
No. Exclusion and enrollment revocation are distinct actions with different legal bases and consequences. Providers should review the actual notice and applicable rules rather than treating the terms as interchangeable.
Does exclusion remove a patient’s Medicare or Medicaid benefits?
No. OIG explains that exclusion affects the ability to claim payment from the relevant federal healthcare programs for covered items and services; it does not, by itself, eliminate a beneficiary’s right to receive program benefits.
Conclusion
The October 14, 2026, delegation of permissive exclusion authority to the CMS Administrator is an important development in federal healthcare program enforcement. It gives CMS a more direct role in exclusion decisions while preserving the HHS OIG’s existing authority.
For physicians, medical practices, hospitals, and revenue cycle teams, the most practical response is to review provider screening, credentialing, enrollment, documentation, and billing controls. Reliable screening and clear escalation procedures can help organizations identify potential issues before they create larger operational or financial problems.
Exclusion is a serious legal action, not a synonym for an audit, claim denial, or allegation. Healthcare organizations should base decisions on verified information, applicable law, and the specific facts of each case.
For providers focused on protecting participation in federal healthcare programs, strong compliance processes are an essential part of sustainable operations and responsible revenue cycle management.
References and Authoritative Resources
- U.S. Department of Health and Human Services / Federal Register. Statement of Delegation of Authority, October 14, 2026.
- HHS Office of Inspector General. Exclusions Program.
- HHS Office of Inspector General. Background Information and Exclusion Authorities.
- HHS Office of Inspector General. Exclusions Frequently Asked Questions.
- HHS Office of Inspector General. LEIE Database and Supplement Downloads.
- HHS Office of Inspector General. Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs.
Disclaimer: This article is for general educational and operational purposes and is not legal, coding, reimbursement, or compliance advice. Providers should consult current official guidance and qualified legal or compliance professionals when assessing a specific exclusion, billing, or enrollment issue.
