HHS delegates partial permissive exclusion authority to CMS to strengthen healthcare fraud enforcement
On October 14, 2026, HHS published a Federal Register notice delegating part of its exclusion authority to the Centers for Medicare and Medicaid Services (CMS), effective immediately. CMS can now pursue permissive exclusions from federal healthcare programs against any individual or entity, where it was previously limited to Medicare and Medicaid providers and suppliers. HHS-OIG keeps sole authority over mandatory exclusions. HHS says the change aligns investigative and enforcement duties in one operating division and improves program integrity in healthcare fraud cases. Open questions remain on how CMS will coordinate with HHS-OIG and the Department of Justice, and how parties should respond to CMS-initiated proceedings. This is regulatory news with no direct cyber threat.
Detalhes técnicos
- Permissive exclusions fall under Section 1128(b) of the Social Security Act. They are discretionary and typically follow misdemeanor convictions, false claims under the Anti-Kickback Statute, or state license suspension or revocation.
- Mandatory exclusions under Section 1128 generally last at least five years. They are tied to Medicare/Medicaid fraud convictions, healthcare-related felonies, controlled substance felonies, and patient abuse or neglect.
- The delegation does not cover conducting hearings or promulgating regulations, and CMS must follow existing HHS-OIG policies, procedures and regulations.
- Federal healthcare programs cannot pay for goods or services from excluded parties. All exclusions are published in the HHS-OIG List of Excluded Individuals/Entities (LEIE).
Remediação
- Entities billing federal healthcare programs should check the HHS-OIG LEIE regularly to avoid financial penalties for using excluded individuals or entities.
- Watch for further HHS guidance on CMS exclusion procedures and on how to respond to proceedings it initiates.
Linha do tempo
-
HHS delegates partial permissive exclusion authority to CMS to strengthen healthcare fraud enforcement
ler a análise desta fonte ocultar
On October 14, 2026, HHS published a Federal Register notice delegating part of its exclusion authority to the Centers for Medicare and Medicaid Services (CMS), effective immediately. CMS can now pursue permissive exclusions from federal healthcare programs against any individual or entity, where it was previously limited to Medicare and Medicaid providers and suppliers. HHS-OIG keeps sole authority over mandatory exclusions. HHS says the change aligns investigative and enforcement duties in one operating division and improves program integrity in healthcare fraud cases. Open questions remain on how CMS will coordinate with HHS-OIG and the Department of Justice, and how parties should respond to CMS-initiated proceedings. This is regulatory news with no direct cyber threat.
Technical Details
- Permissive exclusions fall under Section 1128(b) of the Social Security Act. They are discretionary and typically follow misdemeanor convictions, false claims under the Anti-Kickback Statute, or state license suspension or revocation.
- Mandatory exclusions under Section 1128 generally last at least five years. They are tied to Medicare/Medicaid fraud convictions, healthcare-related felonies, controlled substance felonies, and patient abuse or neglect.
- The delegation does not cover conducting hearings or promulgating regulations, and CMS must follow existing HHS-OIG policies, procedures and regulations.
- Federal healthcare programs cannot pay for goods or services from excluded parties. All exclusions are published in the HHS-OIG List of Excluded Individuals/Entities (LEIE).
Remediation
- Entities billing federal healthcare programs should check the HHS-OIG LEIE regularly to avoid financial penalties for using excluded individuals or entities.
- Watch for further HHS guidance on CMS exclusion procedures and on how to respond to proceedings it initiates.