On July 21, 2026, Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. announced (the “July 21 announcement”) that he would be providing to the Centers for Medicare & Medicaid Services (CMS) the exclusion authority currently within the exclusive domain of the HHS Office of Inspector General (HHS-OIG)—that is, the power to exclude individuals and entities from participation in federally funded health care programs.
CMS has various payment integrity weapons at its disposal, including recoupment of claimed CMS overpayments, Medicare payment suspensions (537 imposed on providers in 2025), and revocation of Medicare billing privileges (5,586 providers and suppliers in 2025). Expanding the broad exclusion power to a new agency raises significant questions about process, scope, and control. There has been no guidance or other information provided with respect to the extent and scope of this authority, how it could be exercised jointly, and what impact it has on False Claims Act (FCA) cases. We explore some of the issues below.
HHS-OIG Exclusion Powers
Currently, only HHS-OIG is granted the authority by Congress to exclude individuals and entities from federally funded health care programs for a variety of reasons under Sections 1128 (42 U.S.C. 1320a-7) and 1156 (42 U.S.C. 1320c-5, governing Medicare and State health care programs) of the Social Security Act. HHS-OIG’s Spring 2026 Semiannual Report to Congress, covering the period from October 1, 2025, through March 31, 2026, noted the exclusion of 1,212 individuals and entities from federal health care programs, generating a monetary impact of $5.56 billion and more than $447 million in potential cost savings.
Those excluded can receive no payment from federal health care programs for any items or services they furnish, order, or prescribe. They cannot bill or be paid by Medicare, Medicaid, Children’s Health Insurance Program, or any federal program, which effectively prevents them from working in health care. HHS-OIG maintains a List of Excluded Individuals/Entities (LEIE), currently containing more than 83,000 entries.
Mandatory exclusions under Section 1128(a) include certain felony convictions relating to health care fraud, controlled substances, or patient abuse or neglect. Permissive exclusions under Section 1128(b) can involve misdemeanor convictions relating to health care fraud, obstructing an investigation or audit, misdemeanors relating to controlled substances, cases of license revocation or suspension, exclusions or suspensions under any federal or state health care program, excessive charges, or unnecessary services.
Permissive exclusions can also involve individuals or entities that the HHS Secretary has determined have committed fraud, kickbacks, or other prohibited activities, or have knowingly made or caused to be made any false statement, omission, or representation of a material fact in any application, agreement, bid, or contract to participate or enroll as a provider of services or supplier under a federal health care program in connection with a federal health care program.
HHS-OIG Exclusions—Due Process and Challenges
During the July 21 announcement, Secretary Kennedy stated that both CMS and HHS-OIG “will be able to use that authority to remove bad actors from federal health care programs and in many cases to permanently ban them from returning.”
Currently, it is unclear under what circumstances CMS would have the authority to exclude providers, when or whether HHS-OIG’s exclusion authority would compete with that of CMS, and what due process would exist to challenge any exclusion instituted by CMS.
There is a threshold question: “Is Secretary Kennedy able to empower CMS to exclude providers from federal health care programs?” HHS-OIG’s exclusion authority is granted by Congress, which prescribed specific limits and parameters for such authority. While Section 1128 of the Social Security Act commands the Secretary to exclude certain individuals and providers, it also expressly contemplates that such activity occurs through HHS-OIG.
Additional detail surrounding CMS’s apparent authority was not provided at the conference. Instead, HHS Inspector General T. March Bell stated simply that HHS expects the additional exclusion authority to be “a force multiplier” with the goal of creating “additional momentum.” In considering its exclusion authority, HHS-OIG assesses future risk to federal health care programs and their beneficiaries posed by persons who have allegedly engaged in civil health care fraud and are entering into an FCA settlement, using five criteria:
- nature and circumstances of conduct (adverse impact on individuals; financial loss, pattern of wrongdoing, and continual or repeated conduct over a substantial period of time; leadership role; and history of prior fraudulent conduct);
- conduct during investigation;
- self-disclosure/cooperation;
- significant ameliorative efforts; and
- history of compliance.
The limits on CMS’s exclusion authority are not currently apparent. It remains to be seen whether CMS may exclude for the same conduct as HHS-OIG, and whether there is an administrative procedure similar to the one that exists through HHS-OIG.
The July 21 announcement also implicates settlement authority for self-disclosures and FCA cases. HHS-OIG investigations can lead to civil FCA actions, including civil settlements with and judgments enforced by the Department of Justice (DOJ). Between October 1, 2025, and March 31, 2026, HHS-OIG investigations led to 287 civil FCA actions. HHS-OIG also often reviews and signs off on FCA settlements pursued by DOJ. The July 21 announcement opens the door to another agency’s involvement in settlements, potentially delaying or complicating resolutions.
Takeaways
It remains to be seen how HHS-OIG and CMS will share this authority, who might challenge the expansion, and how. Penalties for engaging with an entity excluded by HHS, at least, include civil monetary penalties and damages under 42 U.S.C. § 1320-7a, and entities controlled by sanctioned individuals could also be excluded under 42 U.S.C. § 1320a-7(b)(8).
In any event, health care providers now face an unprecedented enforcement landscape: CMS has purportedly been granted exclusion authority previously held only by HHS-OIG. Without guidance or other information provided with respect to the extent and scope of this authority, or how it could be exercised jointly, providers must now anticipate both CMS and HHS-OIG exclusions for the same conduct. And with state Medicaid Fraud Control Units also facing unprecedented federal scrutiny, compliance is more critical than ever.
Epstein Becker Green Staff Attorney Ann W. Parks contributed to the preparation of this post.
* * * *
If you have questions, please reach out to the author(s).
The Health Law Advisor blog is currently edited by Emily Chi Fogler.
Authors
Member of the Firm
Member of the Firm