CMS Can Now Exclude Providers Too: What the October 14 Delegation Changes for Your Practice

Ask most practice managers who can throw a provider out of Medicare and Medicaid, and the answer comes back fast: the OIG — the Office of Inspector General, the watchdog inside the Department of Health and Human Services. For almost four decades that answer was complete. Exclusion, the federal government's power to bar a person or a company from every federal health care program, lived in one office.

That changed on October 14, 2026, in a notice so short you could read it between patients.

What the notice actually says

The document is a Statement of Delegation of Authority, published in the Federal Register on October 14, 2026 (Document 2026-21001). In it, the Secretary of Health and Human Services delegates to the Administrator of CMS the Secretary's permissive exclusion authority under section 1128(b) of the Social Security Act. CMS — the Centers for Medicare & Medicaid Services — is the agency that runs Medicare and Medicaid day to day.

Three words in that sentence deserve a plain translation. "Permissive exclusion" means the government may exclude, after its own determination — it's a discretionary enforcement power, not an automatic penalty that fires on its own. "Delegation" means the power itself didn't change hands at the top; the Secretary still owns it, and another official is now authorized to use it. And "effective immediately" means exactly that: the notice took effect the day it was published, not at the start of a future quarter.

CMS asked for this. The notice says so directly: CMS requested the delegation because, as the agency that administers Medicare and Medicaid, it is "uniquely positioned to investigate, identify, and develop the evidentiary basis" behind exclusion decisions. Two limits are written into the same paragraph. The authority to hold hearings and the authority to issue regulations stay out of the delegation. And the Secretary's earlier delegation of the same authority to the Inspector General — dated April 20, 1988 — is expressly not diminished. Nothing was taken from the OIG. A second holder was added.

What did not change

This matters, because a delegation notice is easy to over-read. October 14 created no new reasons to exclude anyone. The grounds still live in section 1128(b) itself — the same statute the OIG has applied for years. Among the situations that statute covers are license revocations or suspensions, convictions for certain health-care-related misdemeanors, billing substantially excessive charges or furnishing unnecessary services, kickback arrangements, and false statements made on enrollment applications.

Think of it the way you would think about privileges at a hospital your physicians round at. The credentialing committee did not rewrite the bylaws last week. What changed is that a second committee now has the authority to act on the bylaws that were already there. The rules of the game are the same. The number of referees doubled.

What exclusion actually does to a practice

Exclusion isn't a denial, and it isn't an audit refund. It's closer to losing your license to bill the federal government at all. Under the OIG's Updated Special Advisory Bulletin on the Effect of Exclusion (May 9, 2013) — still the governing guidance on scope — no federal health care program payment may be made for items or services furnished, ordered, or prescribed by an excluded person. Read that middle verb again: ordered. An excluded physician's orders don't become payable just because somebody else's name is on the claim. The exclusion follows the person into every practice that hires them, contracts with them, or bills for what they ordered.

Which is why the real exposure for a small, well-run practice is rarely its own conduct. It's a person. A new hire nobody screened. A covering provider a staffing agency sent over. A billing vendor with an excluded owner sitting three layers down. The practice did nothing fraudulent; it simply never checked the list.

The list has a name, and it is free

The list is the LEIE — the List of Excluded Individuals and Entities, maintained by the OIG and searchable online at no cost. The OIG updates it monthly. Its 2013 bulletin gives the screening guidance that still governs: check employees and contractors against the LEIE, because screening each month is what best minimizes a practice's overpayment and civil monetary penalty exposure if an excluded person slips through. A screening done once, at hiring, and never repeated is a snapshot of a list that changes every month — clinically, it's like diagnosing from last year's labs and never reordering the panel.

Four checks to run this month

None of this requires a compliance department. It requires an owner and a calendar:

• Name one person who owns exclusion screening. If the answer is "the biller, probably," nobody owns it. Put a name and a monthly date on it.
• Screen everyone whose work touches a federal claim — clinicians, billers, coders, front desk, contracted and temporary staff — against the LEIE before they start and every month after. Keep a simple log: date, who was checked, result. A screenshot or an export is enough of a record to show the habit exists.
• When a name looks like a match, verify before you panic or bill: the LEIE online search lets you confirm an individual with a Social Security number and an entity with an employer identification number. Until a match is resolved, don't bill for that person's services or orders.
• Re-read your own enrollment file for accuracy — practice addresses, ownership, managing employees, the statements your enrollment applications made. False statements on enrollment applications are one of the grounds written into section 1128(b) itself, and enrollment data is the one part of this risk your practice fully controls.

Our reading of October 14

Here is where we separate the fact from our interpretation, because they aren't the same thing. The fact is narrow: a delegation, effective immediately, OIG untouched, hearings and rulemaking reserved. Our reading at Healthcode RCM is that the practical change is proximity. Until now, the agency that processed your claims and the office that could exclude you were different houses, and a file had to travel between them. CMS investigates, identifies, and builds the evidentiary record — those are the notice's own words — inside the same agency that sees your billing patterns every week. We don't read that as a crackdown announcement, and the notice doesn't claim to be one. We read it as a shorter distance between a billing pattern and an exclusion file. Practices that already screen monthly will feel no change at all. Practices that have never screened are the ones carrying a risk they can't see.

Exclusion used to be somebody else's headline. Since October 14, it is a front-desk habit: check the list, every month, for everyone.