CMS’ new exclusion authority gives healthcare organizations another reason to examine whether their compliance programs can identify, escalate, and respond to significant regulatory risks.
PYA Takeaway: Healthcare organizations have long used exclusion screening to ensure employees and contractors are not barred from participation in federally funded healthcare programs. On October 14, 2026, the U.S. Department of Health and Human Services delegated to the Centers for Medicare & Medicaid Services authority to impose certain permissive exclusions under Section 1128(b) of the Social Security Act, expanding the agency’s role in identifying and addressing conduct that may warrant exclusion. As a result, compliance leaders should assess whether their compliance programs can effectively detect, escalate, and respond to regulatory risks that could create exclusion exposure.
Healthcare organizations are familiar with exclusion screening. Organizations routinely check the Office of Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) to determine whether individuals or entities have been excluded from participation in federally funded healthcare programs. OIG advises healthcare entities to routinely check the LEIE to ensure all new hires and current employees are not excluded.
A recent change adds another dimension to this familiar compliance responsibility.
On October 14, 2026, the Department of Health and Human Services (HHS) delegated to the Centers for Medicare & Medicaid Services (CMS) authority to impose certain permissive exclusions. HHS explained that CMS is well positioned to investigate, identify, and develop the evidence supporting these exclusion determinations because of its responsibility for administering Medicare and Medicaid.
For healthcare compliance leaders, the significance extends beyond exclusion screening. It raises a broader question:
Does our compliance program have the processes necessary to recognize conduct that could create exclusion risk and ensure those concerns receive appropriate attention?
What Changed in Federal Exclusion Authority?
At a high level, federal healthcare exclusions fall into two categories: mandatory and permissive.
A mandatory exclusion is required when specified conditions are met. A permissive exclusion gives the government discretion to determine whether exclusion is appropriate when certain grounds exist.
CMS’ new authority relates to permissive exclusions. OIG continues to administer mandatory exclusions and retains its existing permissive exclusion authority.
Examples of conduct addressed by the permissive exclusion provisions include certain fraud-related offenses, adverse licensing actions, unnecessary or substandard services, false or improper claims, kickback-related conduct, and certain relationships with sanctioned individuals or entities.
The distinctions between mandatory and permissive exclusions and CMS’ new role can be summarized as follows:
| OIG | CMS |
| Continues to administer mandatory exclusions and retains permissive exclusion authority. | CMS’ new authority relates only to permissive exclusions. |
| Mandatory exclusions can result from certain program-related criminal convictions, patient abuse or neglect convictions, felony healthcare-related financial crimes, and felony controlled-substance offenses. | CMS’ new delegation focuses on permissive exclusions rather than mandatory exclusions. |
| Permissive exclusion grounds include certain fraud-related offenses, adverse licensing actions, unnecessary or substandard services, false or improper claims, and kickback-related conduct. | CMS now also has authority to impose permissive exclusions. The delegation does not detail how CMS will implement that authority in individual cases. |
| OIG maintains the LEIE used by healthcare organizations for exclusion screening. | The delegation does not create a separate CMS exclusion list or explain how CMS-imposed exclusions will be reflected in existing federal screening resources. |
The practical takeaway: Exclusion should no longer be viewed solely as an OIG enforcement issue.
Why Should Compliance Leaders Care About CMS’ New Authority?
The significance of this development is not simply that another federal agency can impose certain exclusions.
CMS already plays a central role in administering Medicare and Medicaid. In announcing the delegation, HHS specifically cited CMS’ ability to investigate, identify, and develop the evidence supporting permissive exclusion determinations.
From a compliance program perspective, this change reinforces the importance of recognizing when an issue that begins in one area of an organization may have broader implications.
For example, certain conduct involving false or improper claims, kickbacks, adverse licensing actions, and unnecessary or substandard services is addressed within the permissive exclusion framework. That does not mean every billing error, overpayment, quality concern, or licensing matter presents exclusion risk. Rather, organizations should have processes that allow potentially significant facts to be recognized and escalated for appropriate review.
The compliance challenge is connecting the dots before an isolated issue potentially develops into a larger regulatory problem.
What Should Healthcare Compliance Leaders Be Asking About CMS’ New Authority?
CMS’ new authority does not necessarily mean healthcare organizations need to create an entirely new exclusion program. Instead, it provides an opportunity to evaluate whether existing compliance processes effectively identify, communicate, escalate, and respond to risk. Compliance leaders should ask key questions:
1. Are We Maintaining Effective Exclusion Screening?
Exclusion screening remains fundamental.
OIG continues to maintain the LEIE and advises healthcare entities to routinely check the list to ensure all new hires and current employees are not excluded.
Organizations should continue established screening practices, investigate potential matches, appropriately document their resolution, and ensure identified concerns receive appropriate follow-up.
2. Are We Looking Beyond the Screening Process?
Exclusion compliance should not be viewed solely as checking names against a database.
Screening helps an organization identify individuals and entities that have already been excluded. An effective compliance program also should be capable of recognizing potentially significant conduct before it possibly develops into a government enforcement matter.
That level of attention requires more than an effective screening process. It requires meaningful risk identification, auditing and monitoring, investigation, escalation, corrective action, and follow-through.
3. Are Potentially Significant Issues Reaching Compliance?
This may be one of the most important practical questions arising from the new CMS authority.
Significant compliance issues may not initially surface within the compliance department. They may first appear in revenue cycle, credentialing, provider enrollment, quality, contracting, internal audit, human resources, or another operational function.
Organizations should consider whether their existing escalation processes allow potentially significant matters to reach the compliance department and, when appropriate, legal counsel for further evaluation.
The question is not whether compliance leaders need to become involved in every operational matter. It is whether the organization has defined pathways for recognizing when an issue has moved beyond routine operations and warrants broader review.
4. Are We Connecting Information Across the Organization?
Compliance risks rarely fit neatly within organizational departments.
A credentialing issue, unusual billing pattern, quality concern, audit finding, or contracting matter may appear isolated when reviewed independently. Information from several functions, however, may reveal a broader compliance concern.
Effective compliance programs create mechanisms for connecting that information. Depending on the organization, this may include communication among the departments of compliance, revenue cycle, credentialing, provider enrollment, quality, internal audit, contracting, human resources, and legal counsel.
An effective compliance program should provide leadership with a view of risk that extends beyond individual departments and isolated events.
5. Can We Demonstrate How We Responded?
Identifying a potential problem is only the beginning.
Healthcare organizations should consider whether they can demonstrate how significant concerns were
-
- Identified
- Escalated
- Evaluated
- Investigated, when appropriate
- Addressed through corrective action
- Monitored to determine whether remediation was effective
This is where CMS’ new authority connects to the broader question of compliance program effectiveness.
The objective is not to build a special CMS exclusion process. Rather, it is to ensure that the organization’s existing compliance infrastructure can identify significant risk and demonstrate what happened after a concern was identified.
6. Are We Monitoring What Comes Next?
The CMS delegation establishes the agency’s new permissive exclusion authority, but the notice does not establish a separate CMS exclusion list or explain how CMS-imposed exclusions will be reflected in federal screening resources.
Healthcare organizations should therefore continue established exclusion-screening practices while monitoring CMS and OIG developments.
As additional guidance or enforcement activity emerges, organizations can determine whether changes to policies, screening practices, education, auditing and monitoring, or escalation procedures are warranted.
The practical response today is straightforward: Continue appropriate exclusion screening; educate relevant stakeholders about the change; ensure potentially significant matters receive appropriate review; and monitor how CMS implements its new authority.
How Healthcare Organizations Should Respond
CMS’ new exclusion authority does not, by itself, require healthcare organizations to rebuild their compliance programs. Instead, it provides an opportunity to evaluate whether exclusion risk is appropriately incorporated into the broader compliance framework.
- Continue established exclusion screening. Maintain appropriate LEIE screening, documentation, and follow-up processes.
- Review exclusion-related policies and education. Ensure policies distinguish between screening for already-excluded parties and identifying conduct that could create broader compliance risk.
- Review escalation protocols. Determine whether potentially significant billing, quality, credentialing, licensing, contracting, and other regulatory concerns can reach the compliance department and, when appropriate, legal counsel.
- Evaluate cross-functional communication. Consider whether compliance leadership receives meaningful information from the operational functions most likely to identify emerging regulatory concerns.
- Assess auditing and monitoring activities. Consider whether existing activities are designed to identify patterns and recurring issues, particularly in areas presenting elevated compliance risk.
- Evaluate documentation and follow-through. Determine whether the organization can demonstrate how significant concerns were evaluated, addressed, and monitored through resolution.
- Monitor CMS and OIG developments. Watch for additional guidance and enforcement activity that may warrant adjustments to existing compliance processes.
Another recent enforcement development is DOJ Directive 26-12 and healthcare compliance, which PYA examines through leadership oversight, risk, analytics, remediation, and reporting culture.
Key Takeaway
The most important takeaway is that CMS now has an additional enforcement tool, and that change provides another reason for healthcare organizations to evaluate whether their compliance programs are equipped to identify and respond to significant risk.
Effective compliance programs connect information across organizational functions. They provide clear escalation pathways. They investigate significant concerns. They document corrective action. And they evaluate whether identified problems have actually been resolved.
CMS’ new exclusion authority reinforces the importance of those fundamental compliance capabilities.
As federal healthcare enforcement continues to evolve, healthcare organizations should focus not only on identifying individuals and entities that have already been excluded but also on maintaining compliance programs capable of recognizing, escalating, and addressing significant risks before they develop into larger enforcement matters.
How PYA Can Help
PYA’s Healthcare Compliance professionals work with organizations to evaluate exclusion-screening processes and, more broadly, the effectiveness of the compliance infrastructure surrounding regulatory risk. This service includes assessing risk identification and escalation processes, evaluating auditing and monitoring activities, reviewing compliance policies and internal controls, and assisting organizations in developing practical approaches to corrective action and ongoing monitoring.
PYA works alongside organizational leadership, compliance teams, operational stakeholders, and legal counsel to strengthen the processes healthcare organizations rely on to identify, communicate, and manage compliance risk.
Sources
• U.S. Department of Health and Human Services, Statement of Delegation of Authority (Oct. 14, 2026)
• Social Security Act § 1128
• 42 C.F.R. Part 1001, Subpart C
• U.S. Department of Health and Human Services Office of Inspector General, Exclusions Program and Background Information & Exclusion Authorities
