CMS Gets Direct Exclusion Authority Over Medicare and Medicaid Providers
The Centers for Medicare & Medicaid Services now has direct authority to exclude individual physicians and healthcare entities from participation in federal healthcare programs, including Medicare and Medicaid. The move arrived through an immediate delegation from HHS Secretary Robert F. Kennedy Jr., who transferred permissive exclusion authority to the CMS administrator in a notice published in the Federal Register on Oct. 14.
The change matters because exclusion is one of the strongest enforcement tools available in federal healthcare oversight. Once a provider or entity is excluded, participation in Medicare and Medicaid can be cut off, a consequence that can quickly affect billing, patient access, and the financial viability of a practice or facility.
CMS requested the delegation, and the notice frames the transfer as a way to consolidate investigative and enforcement work inside the agency most directly responsible for administering the two programs. The language in the notice is unusually explicit about the rationale: CMS is described as being uniquely positioned to investigate, identify and develop the evidentiary basis for permissive exclusion decisions, while bringing those functions under one operating division is meant to reduce redundancy and improve program integrity outcomes.
What Conduct Can Trigger Permissive Exclusion
The statutory grounds for permissive exclusion remain broad and reach far beyond classic fraud cases. Under Section 1128(b) of the Social Security Act, exclusion may be used for misdemeanor convictions tied to healthcare fraud or controlled substances, license revocations or suspensions, billing substantially excessive charges, furnishing unnecessary services, kickbacks and other prohibited conduct, and false statements on program enrollment applications.
In practice, the reach of those categories gives CMS a powerful tool in cases where the government believes a provider has crossed an ethical or legal line even if the conduct does not rise to the level of a felony conviction. A license action by a state board, for example, can now sit closer to the center of federal exclusion review if the agency determines the facts support it.
One sentence captures the policy shift plainly: CMS is now closer to the levers of federal exclusion than it has been before.
HHS Kept Some Powers and the Inspector General Role Stays Intact
The delegation does not erase the HHS Office of Inspector General from the process. The inspector general already received exclusion authority in 1988, and the new notice states that this authority remains untouched. Existing OIG authority continues in full, and the delegation to CMS does not diminish prior actions taken under that framework.
Two powers remain outside CMS’ reach under the notice. CMS did not receive the authority to hold hearings or issue regulations. Those functions stay with HHS Secretary Robert F. Kennedy Jr., who retains authority to issue regulations and submit reports to Congress. In other words, CMS can now act on permissive exclusion authority, but the legal and procedural architecture around that authority still leaves the department secretary with important supervisory responsibilities.
The separation matters for hospitals, physician groups and compliance teams because enforcement authority and rulemaking authority are not identical. An agency can investigate and act within a delegated lane, yet still remain bound by departmental rules and procedures that define how exclusion decisions are made and challenged.
Practical Consequences for Physicians, Hospitals and Compliance Programs
For providers, the immediate concern is not abstract governance. It is whether an internal compliance issue, a licensing problem, or a billing pattern can now move more quickly from investigation to exclusion decision inside CMS itself.
That possibility gives compliance officers and legal teams a stronger reason to focus on the facts that most often trigger federal scrutiny: documentation integrity, enrollment accuracy, billing patterns, referral relationships, and license status. Because CMS is the same agency that administers Medicare and Medicaid, the delegation places investigative and programmatic functions under one roof. For organizations that depend heavily on federal reimbursement, that convergence could shorten the distance between suspicion and sanction.
Hospitals and physician groups also need to pay attention to the notice’s affirmation and ratification language. The notice ratifies actions that the administrator or subordinates took under the authority before the delegation became effective. That retroactive validation suggests CMS had already been operating with some form of internal authority and now has explicit delegated power to continue.
A second sentence stands out because of what it means operationally: exclusion risk may now be managed less as a distant HHS issue and more as a day-to-day CMS enforcement concern.
Redelegation, Oversight and the Boundaries of the New Power
The notice also allows for redelegation. Any redelegations or edits must be reviewed by the Division of Performance and Organizational Programs within CMS’ Office of Human Capital, which adds an internal review step before authority can move further down the chain.
CMS must use the authority in line with existing HHS policies, procedures, guidelines and regulations. That requirement is important because it limits the delegation to the current legal and administrative framework rather than creating a blank check for new enforcement practices.
The result is a stronger CMS role, but not an unconstrained one. The agency can now make exclusion determinations under the permissive exclusion statute, yet it still has to operate within established HHS rules and the broader statutory structure that governs federal healthcare program participation.
Why the Notice Changes the Enforcement Conversation
For physicians, the change raises the stakes of routine compliance failures. Billing errors, enrollment misstatements, or unresolved licensing issues may now carry more direct implications in the agency that oversees payment participation. For hospitals and other entities, the delegation adds another reason to audit internal processes that touch claims submission, credentialing, contractor conduct and licensing records.
The notice does not rewrite the statute. It reassigns who inside HHS can act under it.
That distinction is operationally significant. Exclusion authority has always existed within federal healthcare law, but concentrating it within CMS may alter the tempo of enforcement and the way providers respond to investigations. The agency that pays the claims is now more directly empowered to decide who can remain in the program.
For organizations that live or die by Medicare and Medicaid participation, that is not a theoretical change. It is a governance shift with immediate implications for risk management, legal review and administrative preparedness.