CMS can now bar providers from Medicare. Test your compliance controls now
- Posted by Greg Wahlstrom, MBA, HCM
- Posted in Blog
HHS has handed CMS the power to exclude individuals and organizations from Medicare and Medicaid, adding a second, payment-focused enforcer alongside the inspector general.
What changed on October 14
A notice in the Federal Register delegated the HHS secretary’s permissive exclusion authority under Section 1128(b) of the Social Security Act to the CMS administrator. It took effect immediately. For decades, exclusion cases have been the work of the HHS Office of Inspector General, which received this authority in 1988. The OIG keeps that role; CMS now holds a parallel one.
HHS argues that the agency paying the claims is best placed to build the evidence for exclusion decisions, and that housing the work in one operating division cuts duplication. Hearings, rulemaking and reporting to Congress stay with the secretary.
Why this matters for hospitals
Permissive exclusion is not limited to fraud convictions. The statute reaches license suspensions, billing substantially excessive charges, furnishing unnecessary services, kickbacks and false statements on enrollment applications. CMS already sees claims data, enrollment files and audit results directly, so the path from a data anomaly to an exclusion action could become shorter.
The move fits a broader program-integrity push. In July, CMS deferred more than $1 billion in federal Medicaid payments to California and Minnesota pending documentation reviews. Leaders should expect enforcement to rely more on analytics and less on referrals.
What to check now
- Exclusion screening: confirm that employees, medical staff, contractors and vendors are checked against federal exclusion lists at hire and at least monthly.
- Billing outliers: ask compliance for a current view of services and charges that sit far above peer benchmarks, and how each is justified.
- Enrollment accuracy: review Medicare and Medicaid enrollment records for ownership, practice locations and managing employees. Errors here now carry more risk.
- Board reporting: make sure the compliance committee hears about CMS audits and data requests, not only OIG matters.
Executive takeaway: CMS no longer has to refer exclusion cases elsewhere. Treat your billing, enrollment and screening data as evidence CMS can act on directly, and test those controls before an auditor does.
Sources
- Statement of Delegation of Authority (Federal Register, Oct 14, 2026)
- CMS delegated exclusion authorities for Medicare, Medicaid (AHA News, Oct 14, 2026)
- CMS gains new authority to exclude providers from Medicare, Medicaid (Becker’s Hospital Review, Oct 14, 2026)
- HHS Defers More Than $1 Billion in Medicaid Payments to California, Minnesota (HHS, Jul 21, 2026)