November 5, 2026  – The Centers for Medicare & Medicaid Services (CMS) has gained new authority to exclude certain providers, suppliers and other individuals or entities from participating in Medicare, Medicaid and other federal health care programs.

Authority was delegated to the CMS administrator in an October 14 notice published in the Federal Register. The delegation took effect immediately and applies to permissive exclusions authorized under Section 1128(b) of the Social Security Act.

The change gives CMS a more direct enforcement role when conduct may justify exclusion from federal health care programs. CMS already uses tools such as enrollment denials and revocations, payment suspensions and other administrative actions. Exclusion is a separate and potentially far-reaching remedy because it can bar payment by federal health care programs for items or services furnished, ordered or prescribed by an excluded individual or entity.

Section 1128(b) includes a range of discretionary grounds for exclusion. Depending on the circumstances, those grounds can include certain misdemeanor convictions involving health care fraud or controlled substances, licensing actions, kickbacks and other prohibited conduct, medically unnecessary or substandard services, and false statements or omissions in federal health care program enrollment applications.

The new delegation is limited to permissive exclusions. It does not transfer authority over mandatory exclusions, which the HHS Office of Inspector General continues to impose for certain convictions and other circumstances specified in federal law.

OIG also retains the permissive exclusion authority previously delegated to it. That means CMS and OIG will both have authority to pursue permissive exclusions rather than CMS replacing OIG in that role. OIG has said the change is expected to increase HHS’s overall capacity to use exclusions to combat fraud and protect federal health care programs.

HHS said CMS requested the delegation because the agency directly administers Medicare and Medicaid and is positioned to develop evidence supporting exclusion actions. The Federal Register notice states that delegating the authority to CMS can better align investigative and enforcement responsibilities, reduce duplication and strengthen program integrity outcomes.

There are limits on the delegation. CMS does not receive authority to conduct hearings or issue regulations under the delegated power. The HHS secretary also retains rulemaking authority and responsibility for reports to Congress, and CMS must exercise the authority in accordance with applicable HHS policies, procedures, guidelines and regulations.

For providers and health plans, the change adds another potential consequence to federal program integrity investigations. Conduct involving billing, enrollment information, licensing actions or suspected fraud may now lead to a CMS-led permissive exclusion in addition to other administrative remedies. Organizations may also need to watch how CMS incorporates exclusion authority into existing enrollment, payment and enforcement processes.

Some implementation questions remain, including how CMS and OIG will divide or coordinate cases and how CMS-issued exclusions will be made public. OIG has said it is working with CMS on public disclosure of exclusions and expects to provide additional information as implementation develops.

The delegation ultimately gives CMS a stronger direct enforcement pathway: the agency that identifies potential misconduct through its oversight of Medicare and Medicaid can now pursue certain exclusions without relying exclusively on OIG to exercise that authority. For providers and plans, that makes exclusion risk an increasingly important part of compliance and program integrity monitoring.