On October 14, 2026, U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr., published a notice (the “Publication”) in the Federal Register formalizing the delegation to the administrator of the Centers for Medicare & Medicaid Services (CMS) of the power to exclude individuals and entities, including providers, from participation in federally funded health care programs—effective immediately.

The Publication follows the Secretary’s July 21, 2026, announcement that he would be giving CMS permissive exclusion authority under section 1128(b) of the Social Security Act—which was, until now, within the exclusive domain of the HHS Office of Inspector General (HHS-OIG) (see Epstein Becker Green’s previous blog post here). The July announcement was made during an HHS press conference covered by C-SPAN.

Although the Publication purports to “reduc[e] redundancy” by “align[ing] investigative and enforcement responsibilities within a single operating division,” it does not clarify the extent and scope of the delegated authority, how it could be exercised jointly with HHS-OIG, and what impact it has on False Claims Act (FCA) cases.

What We Know

Force Multiplier. As a practical matter, the Publication states that CMS will “investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations” within a single operating division, “exercised in accordance with CMS applicable policies, procedures, guidelines, and regulations.” This has been described by HHS as a “force multiplier” in combination with HHS-OIG’s exclusion authority.

No Hearings or Regulations. Under the Publication, CMS will not have independent authority to conduct hearings and issue regulations. Since section 1128(f)(1) guarantees excluded individuals and entities “reasonable notice and opportunity for a hearing,” the delegation of exclusion authority, without the authority for a hearing, may implicate the Fifth Amendment’s Due Process Clause.

Redelegation. The Publication states that permissive exclusion authority may be redelegated, subject to CMS review.

What We Don’t Know

Section 1128(b)(7). HHS-OIG typically negotiates settlement releases of section 1128(b)(7) allowing permissive exclusions in cases of fraud or kickbacks. It remains unclear whether and how CMS will coordinate with HHS-OIG on corporate integrity agreements—and whether both agencies must agree, which could lead to blocks and/or delays.

Due Process. It remains unclear what specific due process would exist to challenge an exclusion instituted by CMS. Will this incorporate exiting OIG processes and protocols?

Potential Challenges. As we noted in our previous post, while section 1128 of the Social Security Act commands the Secretary to exclude certain individuals and providers, it also expressly contemplates that such activity occurs through HHS-OIG. As such authority is exercised, we may see challenges from providers.

Takeaways

As CMS’s new exclusion authority continues to develop, we note that the consequences of exclusion are substantial: Those excluded can receive no payment from federal health care programs for any items or services they furnish, order, or prescribe. They cannot bill or be paid by Medicare, Medicaid, the Children’s Health Insurance Program, or any federal program, which effectively prevents them from working in health care.

Yet despite that authority, there is still little guidance. As challenges develop, providers should:

  • demand clarification with regard to CMS’s role in any FCA settlement discussions;
  • monitor for guidance, and don’t assume pre-July 21 settlement precedents still apply;
  • if subject to CMS revocation (i.e., ending Medicare billing), treat this as a potential precursor to exclusion; and
  • for FCA cases, consider seeking an explicit CMS non-involvement clause.

The bottom line is that, heading into 2027, health care providers face an ever-more aggressive enforcement landscape with less predictability. Assuming that CMS’s newfound exclusion authority remains unchallenged—which is unlikely—the agency will now be even more focused on potential health care fraud as it interacts with providers and suppliers in federal health care programs. We will keep you posted.

Epstein Becker Green Staff Attorney Ann W. Parks contributed to the preparation of this post.

* * * *

If you have questions, please reach out to the author(s).

The Health Law Advisor blog is currently edited by Emily Chi Fogler.

Back to Health Law Advisor Blog

Search This Blog

Authors

Related Services

Topics

Archives

Jump to Page

Subscribe

Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.