HHS Secretary Extends HHS-OIG Exclusion Authority to CMS, Expanding the Administration's Anti-Fraud Campaign

On October 13, 2026, U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. formally delegated permissive authority under Section 1128(b) of the Social Security Act (SSA) to exclude individuals and entities from federally funded healthcare programs to the Centers for Medicare and Medicaid Services (CMS) Administrator.¹ The HHS Office of Inspector General (HHS-OIG) meanwhile retains its existing mandatory and permissive exclusion authority.

The delegation of authority follows the HHS Secretary’s announcement during a July 21, 2026, news conference (July 21 Conference) that he would give CMS the authority to exclude individuals and entities from federally funded healthcare programs.² Joined by the Administrator for CMS, the HHS Inspector General, and members of the White House Anti-Fraud Task Force, Secretary Kennedy stated that HHS-OIG and CMS would use their concurrent exclusion authority to “remove bad actors from federal health care programs [(FHCPs)],” in many cases permanently.³

In his delegation of authority, the HHS Secretary stated that “CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations. Formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.”⁴ The delegation notably did not grant mandatory exclusion authority to CMS and did not grant CMS the ability to conduct exclusion hearings or to issue regulations. While HHS-OIG and CMS will both now have the ability to exercise concurrent permissive exclusion authority, the delegation did not otherwise shed further light onto CMS’s approach or how the two agencies will coordinate the exercise of permissive exclusion authority.⁵

The delegation of permissive exclusion authority to CMS became effective immediately.⁶

HHS Permissive Exclusion Authority

Permissive exclusion authority belonged exclusively to HHS-OIG since 1988. Section 1128 of the Social Security Act authorizes the HHS Secretary to exclude individuals and entities from all FHCPs.⁷ The statute gives the Secretary broad discretion to exercise permissive exclusion authority against an individual or entity based on certain categories of conduct.⁸ The consequences of an exclusion are severe. Once excluded, no FHCP may issue payment for any item or service furnished, ordered, or prescribed by an excluded individual or entity, and a nonexcluded person who employs or contracts with an excluded individual or entity may also be liable for civil monetary penalties.⁹

Congress delegated certain aspects of the HHS Secretary’s exclusion authority to HHS-OIG in 1988 through amendments to the Social Security Act, including requiring the HHS Secretary to consult with HHS-OIG before waiving certain mandatory exclusions and requiring states to notify HHS-OIG of responsive actions taken after the state investigates an identified excluded individual or entity.¹⁰ HHS-OIG has since implemented regulations outlining the standards, hearing rights, and appeals that currently govern exclusions.¹¹ HHS-OIG typically exercises its permissive exclusion authority in False Claims Act (FCA) cases, leveraging its authority in exchange for a settlement and/or corporate integrity agreement. In the six-month period ending March 31, 2026, HHS-OIG excluded 1,212 individuals and entities, and its List of Excluded Individuals/Entities (LEIE) currently contains more than 83,000 entries.¹²

Increased CMS Healthcare Fraud Enforcement

Statistics show that CMS is also increasingly using its ability to suspend enrolled provider Medicare payments as an enforcement tool. CMS published on its Crushing Fraud, Waste, & Abuse website a “CMS Accomplishments” update, citing 537 Medicare payment suspensions and 5,586 billing-privilege revocations in 2025 and announced at its July 21 Conference 1,413 revocations in the first quarter of 2026 alone—a record 40% quarterly jump.¹³

Impact on the Healthcare Landscape

The delegation of permissive exclusion authority to CMS could significantly amplify and expedite the government’s exclusion activities. Unlike HHS-OIG, CMS has access to real-time claims and enrollment data and analytics, a nationwide network of Medicare contractors that continuously conducts claims audits, and direct leverage over state Medicaid programs and MFCUs. With authority to exclude individuals and entities on the grounds specified in Section 1128(b) of the Social Security Act, including fraud and abuse violations that do not require a criminal conviction, CMS would gain a powerful tool to enforce healthcare fraud and abuse laws.

CMS has not yet indicated its approach for exercising permissive exclusion authority. Although the delegation is effective immediately, questions remain surrounding CMS’s implementation of exclusion under existing regulations. The delegation does not specify whether additional regulatory changes or administrative guidance will be issued.

The Sidley Healthcare team will continue to monitor these developments closely to determine the potential future impact of CMS exclusion authority on the healthcare industry. Please contact the attorneys below or your regular Sidley contact to discuss these and related enforcement developments.

---

¹Centers for Medicare & Medicaid Services Statement of Delegation of Authority, Statement of Delegation of Authority, 91 Fed. Reg. 65219 (Oct. 14, 2026).
²C-SPAN, HHS Secy. Kennedy, Dr. Oz, and Others News Conference on Combating Fraud (July 21, 2026), https://www.c-span.org/program/news-conference/hhs-secy-kennedy-dr-oz-and-others-news-conference-on-combating-fraud/683173 [hereinafter July 21 News Conference].
³Id.
⁴91 Fed. Reg. at 65219.
⁵Id.
⁶Id.
⁷42 U.S.C. § 1320a-7.
⁸See id.
⁹42 U.S.C. § 1320a-7a(a)(6); see OIG, Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (May 8, 2013).
¹⁰42 U.S.C. § 1320a-7(c)(3)(B), (e)(3).
¹¹See generally 42 C.F.R. pts. 1001, 1005.
¹²HHS-OIG, Semiannual Report to Congress: Spring 2026 (2026), https://oig.hhs.gov/documents/sar/11794/Spring_2026_SAR.pdf; HHS-OIG, LEIE Database & Supplement Downloads, https://oig.hhs.gov/exclusions/leie-database-supplement-downloads/#leie-database-download (last visited Aug. 27, 2026).
¹³CMS, Center for Program Integrity Data Dashboard (Jan. 2026), https://www.cms.gov/files/document/cpi-data-dashboard-january-update.pdf; July 21 News Conference.