HHS Exclusion Becomes a Two-Headed Monster Featuring CMS and OIG

Introduction

On October 14, 2026, the Department of Health and Human Services (HHS) published a notice formally delegating the Secretary’s authority to impose permissive exclusions under section 1128(b) of the Social Security Act to the Centers for Medicare & Medicaid Services (CMS) Administrator. See 91 Fed. Reg. 65,219 (Oct. 14, 2026). A departure from past practice, the delegation gives CMS a direct role in investigating and pursuing exclusions from federal healthcare programs while maintaining the existing delegation to HHS Office of Inspector General (OIG) of mandatory and permissive exclusions under section 1128. This delegation greatly expands CMS’s administrative enforcement tools and may substantially affect the resolution of healthcare and life sciences fraud investigations.

Background 

Section 1128 of the Social Security Act authorizes the Secretary of Health and Human Services (the “Secretary”) to exclude individuals and entities from federal healthcare programs for a variety of bases. Certain types of criminal convictions (for example, convictions related to Medicare or Medicaid fraud) trigger mandatory exclusion while numerous other conditions trigger possible permissive exclusion. 

Federal healthcare programs may not pay for items or services furnished by an excluded person or furnished at the medical direction or on the prescription of an excluded individual. This prohibition applies regardless of who submits the claim. For example, a hospital is not permitted to receive payment for services that were furnished by an excluded employee, contractor, or volunteer. Further, HHS has interpreted this prohibition to apply to those that directly or indirectly “furnish” an item or service. So, for example, HHS prohibits federal healthcare program payments to anyone for a pharmaceutical or medical device manufactured or distributed by an excluded entity. Therefore, unlike CMS’s other administrative remedies, which are tied to Medicare or Medicaid enrollment as a provider or supplier, exclusion can reach any person involved in any way in the chain of events that can lead to an item or service being paid for by any federal healthcare program.

Any amounts that are paid for items or services that are furnished by an excluded person are overpayments. OIG may also impose a civil monetary penalty on the excluded person and on any person who employed or contracted with someone who they knew or should have known was excluded. See 42 C.F.R. § 1001.1901; OIG, Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (May 8, 2013). 

The October 14 delegation relates to the permissive authority in section 1128(b). See 42 U.S.C. § 1320a-7(b). Permissive exclusions under Section 1128 of the Social Security Act may be derivative. For example, permissive exclusion authority may be exercised when a healthcare provider’s license has been revoked or suspended by any state licensing authority. See § 1128(b)(4). Others are affirmative. For example, HHS may exclude an individual or entity whom HHS determines has submitted or caused to be submitted false or fraudulent claims or committed an act that violates the Anti-Kickback Statute. See § 1128(b)(7). This broad permissive exclusion provision authorizes HHS to exclude anyone subject to False Claims Act (FCA) liability related to Medicare or Medicaid claims or kickbacks.

The HHS Secretary previously delegated exclusion authority to OIG. Because OIG controlled the exclusion remedy that parallels the FCA, DOJ worked closely with OIG attorneys in the resolution of all Medicare and Medicaid FCA cases. In addition to addressing exclusion, OIG represented HHS and has been responsible for working with the HHS Office of the General Counsel (OGC), CMS, and other HHS agencies to provide consolidated HHS input in all these FCA matters. This practice has allowed FCA defendants to understand HHS’s position on the matter through communications with OIG attorneys. 

OIG also maintains the public List of Excluded Individuals/Entities (LEIE). See Delegation of Authority, 53 Fed. Reg. 12,993 (Apr. 20, 1988). OIG’s Spring 2026 Semiannual Report to Congress reported 1,212 exclusions during the six-month reporting period. See HHS-OIG, Spring 2026 Semiannual Report to Congress. For decades, companies have used the LEIE to screen employees and contractors to avoid exclusion-related liability.  

Prior to the October 14 delegation, CMS already had extensive administrative enforcement authorities. It can review provider activities, including through medical, utilization, fraud reviews, and audit cost reports. See 42 U.S.C. § 1395ddd(b)(1)-(2). It can identify and recover overpayments. See id. § 1395ddd(f). It can suspend Medicare payments while investigating credible fraud allegations. See 42 C.F.R. §§405.371(a)(2), 405.372(a)(4). And it can deny or revoke providers’ and suppliers’ Medicare enrollment and billing privileges. See id. §§ 424.530, 424.535. 

Although CMS has engaged in program integrity activities for decades, CMS Administrator Dr. Mehmet Oz has been much more aggressive than his predecessors in publicly decrying fraud and talking about CMS’s efforts to “crush fraud.” CMS has also pointed to its use of data analytics to identify potential fraud, waste, and abuse and had the authority to suspend or revoke providers’ billing privileges. See CMS, Data Analytics and Systems Group; U.S. Dep’t of Justice, 2026 National Health Care Fraud Takedown (June 23, 2026).

The October 14 Delegation 

The October 14 notice expands the delegation of authority within HHS by extending the Secretary’s section 1128(b) permissive exclusion authority to the CMS administrator while preserving OIG’s existing delegation of mandatory and permissive exclusions. Statement of Delegation of Authority, 91 Fed. Reg. 65,219 (Oct. 14, 2026). The CMS administrator is permitted to redelegate this authority, subject to review by CMS’s Division of Performance and Organizational Programs or its successor. 

The delegation does not include authority to conduct hearings or issue regulations. As with OIG, the appeals of CMS exclusions will presumably be heard by the HHS Departmental Appeals Board and its Administrative Law Judges (ALJs). The Secretary retains authority to promulgate regulations and submit reports to Congress. The notice does not specify CMS’s procedures for administering exclusions or coordinating with OIG.

The notice cites that the delegation “aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.” While the notice states that the delegation is intended to consolidate authority in one HHS agency, it actually has the opposite effect since it expands the ability to exercise permissive exclusion authority beyond OIG to CMS. So, unlike before the delegation, both OIG and CMS can impose permissive exclusions. 

Potential Enforcement Implications 

The October 14 delegation allows CMS to directly wield HHS’s most powerful administrative anti-fraud tool in the context of its program integrity matters.

DOJ’s Justice Manual directs its attorneys to consult relevant agencies during FCA investigations, litigation, and settlements. For decades, OIG attorneys have been DOJ’s primary points of contact for HHS FCA cases. Now, CMS’s new authority may alter that longstanding practice and trigger a more direct role for CMS in all Medicare and Medicaid FCA matters. 

Practical Considerations for Healthcare and Life Sciences Companies and Providers

The new delegation broadens CMS’s enforcement arsenal. As discussed above, CMS’s enforcement authority traditionally has extended to only providers and suppliers. Exclusion authority allows CMS to expand beyond that realm. For example, CMS, like OIG, could exclude a pharmaceutical or medical device company or one of their employees or agents under section 1128(b)(7). 

CMS’s expanded authority may have implications for those facing FCA actions. While historically, companies seeking to settle an FCA case have engaged with OIG to address exclusion, the new delegation could mean that FCA defendants need to also engage with CMS (or OGC on behalf of CMS). OIG also has historically entered into and monitored corporate integrity agreements (CIAs) in connection with FCA settlements, but the new delegation could mean CMS joins in negotiating and monitoring CIAs or pursues its own alternative remedies.

Healthcare and life sciences companies should review their existing exclusion screening and program integrity response processes, continue screening against OIG’s LEIE, and monitor for CMS guidance on how CMS-issued exclusions will be publicized and what screening practices may be appropriate to account for potential additional exclusion lists. 

Conclusion

The October 14 notice authorizes CMS to pursue permissive exclusions. The notice leaves important operational questions open, including how CMS will coordinate with OIG and DOJ and how affected parties will navigate CMS exclusion proceedings. Healthcare and life sciences companies should monitor for further guidance and account for potential exclusion exposure when assessing and responding to suspected compliance issues.

***

The Goodwin Healthcare team will continue to monitor these developments and their potential impact on healthcare providers, life sciences companies, pharmacies, and other industry participants. For more information on the issues discussed in this alert, please contact the authors, reach out to Goodwin's Government Investigations, Enforcement & White Collar Defense or Healthcare Regulatory and Compliance groups, or contact the Goodwin lawyer with whom you typically consult.