The Department of Health and Human Services (HHS) Office of Inspector General (OIG) is responsible for excluding individuals and entities from participation in federal healthcare programs; however, that responsibility is now shared with the HHS Centers for Medicare and Medicaid Services (CMS). The move is intended to improve the ability of the HHS to investigate and prosecute individuals and entities suspected of healthcare fraud.
On October 14, 2026, HHS published a notice in the Federal Register formally delegating partial exclusion responsibility to CMS with immediate effect. The authority of HHS-OIG remains unchained, and it will retain sole responsibility for imposing mandatory exclusions. “As the agency directly responsible for administering Medicare and Medicaid, CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations,” explained HHS Secretary Robert F.
Kennedy, Jr. “Formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.” The CMS already had administrative enforcement authority related to Medicare and Medicaid program providers and suppliers; its authority has been expanded to include any individual or entity.
The expanded authority does not cover conducting hearings or promulgating regulations, and the authority will be in line with existing HHS-OIG policies, procedures, and regulations. While the authority takes immediate effect, some of the details still need to be fleshed out, such as how the CMS will coordinate with HHS-OIG and the Department of Justice, and how individuals and entities should respond to exclusion proceedings initiated by CMS.
Under Section 1128 of the Social Security Act, mandatory exclusions from federal healthcare programs are required by law if certain criteria are met and are generally for a minimum of five years unless an individual or entity has previously been excluded from participation. Mandatory exclusions are typically required by law for healthcare fraud convictions related to Medicare, Medicaid, the State Children’s Health Insurance Program, or other State health care programs; felony convictions for other healthcare-related fraud; felony convictions related to controlled substances; and criminal convictions related to patient abuse or neglect.
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The HHS can also impose permissive exclusions, as authorized by Section 1128(b) of the Social Security Act.
These exclusions are discretionary and are often imposed for misdemeanor convictions, such as financial misconduct; the submission of false claims under the Anti-Kickback Statute; and the suspension or revocation of a license by a state licensing authority. Depending on the nature of the grounds for exclusion, there may be no minimum or maximum exclusion, although permissive exclusions are generally shorter than mandatory exclusions.
Regardless of the reason for exclusion, federal healthcare programs such as Medicare and Medicaid cannot pay for goods or services provided by an excluded individual or entity. All exclusions are made public via the HHS-OIG List of Excluded Individuals/Entities (LEIE). Entities that bill federal healthcare programs for goods or services provided by an excluded individual or entity face stiff financial penalties and must regularly check the HHS-OIG Exclusion List .
The post HHS Delegates Permissive Exclusion Authority to CMS appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
