The Centers for Medicare & Medicaid Services (CMS) can now exclude providers and organizations from participation in Medicare, Medicaid and other federal healthcare programs, under a statement of delegation of authority published in the Federal Register on October 14, 2026. HHS Secretary Robert F. Kennedy Jr. delegated the Secretary's permissive exclusion authority under Section 1128(b) of the Social Security Act to the CMS Administrator, Dr. Mehmet Oz, and the delegation took effect immediately.
What Changed on October 14
Permissive exclusion is a discretionary sanction: unlike mandatory exclusion, which follows certain convictions automatically, it allows the government to bar an individual or entity from federal healthcare programs based on conduct described in the statute. According to the notice, CMS requested the delegation. The notice gives as its reasoning that CMS, as the agency that directly administers Medicare and Medicaid, is well placed to investigate cases, identify them and build the evidence behind an exclusion decision, and that formalising the delegation places investigative and enforcement work in one operating division.
The conduct that can support a permissive exclusion under Section 1128(b) includes misdemeanour convictions connected to healthcare fraud or controlled substances, the revocation or suspension of a professional licence, billing charges that are substantially more than usual or providing services that were not needed, kickbacks and other prohibited payments, and false statements in applications to enrol in a federal healthcare program. For drug and medical device companies, legal commentators have noted that convictions for offences under the Federal Food, Drug, and Cosmetic Act can also fall within the exclusion grounds. The delegation may be passed down further inside CMS, provided any redelegation is reviewed by the Division of Performance and Organizational Programs in the CMS Office of Human Capital, and the authority must be exercised in line with existing departmental policies and regulations. The change formalises an announcement the Secretary first made on July 21, 2026.
What Did Not Change
The HHS Office of Inspector General (OIG) keeps the exclusion authority it has held since 1988. The notice states that the new delegation does not diminish the earlier delegation to the Inspector General or affect actions already taken under it, so CMS and the OIG now hold the authority in parallel. Two powers were expressly kept out of the CMS delegation: conducting hearings and issuing regulations. The Secretary also retains the authority to send reports to Congress and to issue regulations.
What This Means for Provider Compliance
Exclusion is one of the most serious administrative outcomes a practice can face, because an excluded provider cannot be paid by federal healthcare programs, and organizations that employ or contract with excluded individuals can face penalties of their own. Until now, permissive exclusion decisions sat with one office. From October 14, the agency that runs enrolment, claims and program integrity day to day can also pursue them. For clinic owners and hospital compliance teams, the practical response is unglamorous but important: keep enrolment information accurate, act quickly on any licensing issue affecting a clinician, review billing patterns for services that could look excessive or unnecessary, and keep screening employees and contractors against exclusion lists on a regular cycle rather than only at hiring. Practices that document those checks are in a far better position if either CMS or the OIG asks questions.
Analysis: Two Exclusion Authorities, Open Questions
Analysis (Med Clinic X): How the two authorities will operate side by side is not yet spelled out. Law firm Epstein Becker Green, writing on October 15, observed that the notice does not explain how CMS and the OIG will coordinate, or what the change means for False Claims Act cases, where exclusion risk is often part of settlement negotiations. The FDA Law Blog raised a related point for life sciences companies: CMS has not historically been the counterparty in the corporate integrity agreements that often accompany those settlements, so who monitors compliance is an open question. Those are assessments by outside counsel, not findings in the notice itself, and early enforcement decisions will show how the agencies divide the work. What is already clear is that exclusion risk now belongs in the same routine compliance review as website privacy and data security. Our guide to website security and patient privacy for practices covers the patient-facing side of that review: https://medclinicx.com/blog/website-security-patient-privacy-practices
Sources and References
- Federal Register (US Department of Health and Human Services), Statement of Delegation of Authority, Document 2026-21001, October 14, 2026: https://www.federalregister.gov/documents/2026/10/14/2026-21001/statement-of-delegation-of-authority
- Becker's Hospital Review, CMS gains new authority to exclude providers from Medicare, Medicaid, October 14, 2026: https://www.beckershospitalreview.com/finance/cms-gains-new-authority-to-exclude-providers-from-medicare-medicaid/
- TechTarget RevCycle Management, RFK Jr. gives CMS authority to ban individual providers, October 15, 2026: https://www.techtarget.com/revcyclemanagement/news/366652161/RFK-Jr-gives-CMS-authority-to-ban-individual-providers
- Epstein Becker Green, Health Law Advisor, CMS Receives Its Exclusion Authority: What Happens Now?, October 15, 2026: https://www.ebglaw.com/health-law-advisor/cms-receives-its-exclusion-authority-what-happens-now
- FDA Law Blog, CMS Gains Permissive Exclusion Authority: Implications for Pharma and Medical Device Companies, October 16, 2026: https://www.thefdalawblog.com/2026/10/cms-gains-permissive-exclusion-authority-implications-for-pharma-and-medical-device-companies/
Reporting based on the sources above, accessed October 16, 2026. Med Clinic X did not conduct original reporting or interviews for this article. Corrections: contact us via https://medclinicx.com/contact