CMS Exclusion Authority Without a Conviction: 2026 Delegation
The agency that pays the claims can now ban the provider. On October 14, 2026, the Secretary of Health and Human Services delegated permissive exclusion authority under Section 1128(b) of the Social Security Act to the CMS Administrator, effective immediately. For 38 years that authority sat with the HHS Office of Inspector General alone. CMS now holds it too, with the largest body of health care claims data in the country behind it. A provider flagged by CMS analytics can be excluded from every federal health care program without a charge, a conviction, or a referral to OIG.
Exclusion Moves to the Agency That Holds the Data
The Secretary delegated all of Section 1128(b) to the CMS Administrator in a one-page notice published at 91 Fed. Reg. 65219, filed October 13 and effective October 14, 2026. Mandatory exclusion under Section 1128(a) stays with OIG. OIG also keeps its own permissive authority. Two agencies now hold the same power over the same providers.
The principal permissive grounds require no conviction. Excessive or unnecessary services under (b)(6), fraud or kickbacks the agency determines occurred under (b)(7), and false enrollment statements under (b)(16) rest on agency findings, proven by a preponderance of the evidence. CMS builds those findings from claims analytics, medical review, and contractor audits it already runs.
The notice withholds hearing and rulemaking authority from CMS, ratifies any exclusion-related action CMS took before the effective date, and says nothing about how CMS and OIG will coordinate. The 30-day response to a notice of intent remains the only stage at which a provider can stop an exclusion before it takes effect.
The delegation arrives in an enforcement cycle built on data. The June 2026 National Health Care Fraud Takedown paired 455 criminal defendants with 1,079 CMS payment suspensions and 1,403 billing privilege revocations. CMS has spent two years expanding its Center for Program Integrity, publishing provider-level claims datasets, imposing moratoria on new enrollment in high-risk sectors, and proposing new enrollment denial and revocation grounds. We covered the administrative side of that campaign in our analysis of CMS payment suspensions and DEA immediate suspension orders. Exclusion authority gives those efforts a permanent consequence.
Duration and reach separate exclusion from every other CMS tool. A payment suspension ends. A revocation can be cured by reenrollment when the bar runs. An exclusion follows a provider across every federal program, every state, and every employer, for a term the agency sets and extends. For a practitioner, it ends a career in federally funded health care for as long as it lasts.
The Secretary announced the plan at a July 2026 press conference with the CMS Administrator and the Inspector General. The Federal Register notice made it law. This analysis covers what the notice does, which grounds require no conviction, how CMS claims data will drive exclusion cases, what procedural rights remain, what an exclusion costs beyond Medicare, and four points the early commentary has missed.
What the October 14 Notice Does
The Statement of Delegation of Authority is one page. It does four things.
It Delegates All of Section 1128(b)
The statute, codified at 42 U.S.C. § 1320a-7(b), lists sixteen grounds on which the Secretary “may” exclude an individual or entity from federal health care programs. The delegation covers every one of them. The notice revises a 2011 delegation, published at 76 Fed. Reg. 13618, that had withheld this authority from CMS.
It Leaves Mandatory Exclusion With OIG
Section 1128(a) requires exclusion after a felony conviction for health care fraud, patient abuse or neglect, or a controlled substance offense. That authority was not delegated. OIG still handles it. OIG also keeps its own permissive exclusion authority under the 1988 delegation at 53 Fed. Reg. 12993. The notice states that nothing in the new delegation diminishes that earlier grant. Two agencies now hold the same permissive power over the same providers, and the notice does not say which one acts first.
It Withholds Hearing and Rulemaking Authority
CMS cannot conduct exclusion hearings and cannot write exclusion regulations. The Secretary retains rulemaking. The notice states the authority will be exercised under the Department’s existing policies, procedures, guidelines, and regulations. Those regulations, at 42 C.F.R. Part 1001, were written for OIG and refer to OIG throughout. How CMS will operate under rules that name a different agency is unresolved.
It Ratifies Prior Actions
The Secretary affirmed and ratified any exercise of the delegated authority by the Administrator or subordinates before the effective date. That clause is unusual in a delegation notice. It suggests CMS took steps toward exclusion before October 14. Any provider who received exclusion-related correspondence from CMS before that date should read it again.
The notice also permits redelegation within CMS, subject to review by an internal office. Whether the Center for Program Integrity, the regional offices, or the contractors will hold operational authority is not stated.
“CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations.”
Statement of Delegation of Authority, 91 Fed. Reg. 65219 (Oct. 14, 2026)Exclusion Without a Conviction: How Permissive Exclusion Works
Mandatory exclusion follows a conviction. Permissive exclusion does not require one. Most of the sixteen grounds in Section 1128(b) rest on an agency determination, a licensing board action, or a billing pattern. No prosecutor, grand jury, or jury is involved. The grounds most likely to drive CMS exclusions are these.
| Ground | Statute | What Triggers It | Conviction |
|---|---|---|---|
| Excessive charges or unnecessary services | § 1128(b)(6) | Claims substantially in excess of usual charges, services substantially in excess of patient need, or services that fail professionally recognized standards | No |
| Fraud, kickbacks, and prohibited activities | § 1128(b)(7) | The agency determines the provider committed an act described in the civil monetary penalty or anti-kickback statutes | No |
| False statements in enrollment | § 1128(b)(16) | Knowingly false statements, omissions, or misrepresentations of material fact in a Medicare or Medicaid enrollment application | No |
| License revocation or surrender | § 1128(b)(4) | A state board revokes, suspends, or accepts surrender of a license for reasons bearing on competence, performance, or financial integrity | No |
| Exclusion or suspension by another program | § 1128(b)(5) | Any other federal or state health care program suspends or excludes the provider | No |
| Entities controlled by a sanctioned person | § 1128(b)(8) | An excluded or convicted person owns, controls, or manages the entity | No |
| Individuals who control a sanctioned entity | § 1128(b)(15) | An officer, managing employee, or owner of an entity that has been excluded or convicted | No |
| Failure to supply payment information or grant access | § 1128(b)(11), (b)(12) | Refusal to furnish records, or to permit immediate access for audit or inspection | No |
| Misdemeanor convictions | § 1128(b)(1), (b)(2), (b)(3) | Misdemeanor health care fraud, obstruction, or controlled substance offenses | Yes |
Subsection (b)(7): The Agency Decides
Subsection (b)(7) is the broadest. The statute says the Secretary “determines” the conduct occurred. The regulation at 42 C.F.R. § 1001.901 confirms that a criminal conviction, civil judgment, or administrative penalty is not required. The agency makes its own finding. If the provider contests it, the standard of proof at the hearing is a preponderance of the evidence under 42 C.F.R. § 1005.15. That is the civil standard, the same one that decides a False Claims Act case.
Subsection (b)(6): No Intent Element
Subsection (b)(6) requires no finding of intent at all. A pattern of unnecessary services, established by claims data and medical review, is enough. A provider who argues good faith under (b)(6) is answering a question the statute does not ask. The answer has to be medical necessity, patient by patient, in the chart.
Length of Exclusion
The minimum term for a mandatory exclusion is five years. Permissive exclusions carry benchmark terms set by regulation. A (b)(7) exclusion starts at a three-year benchmark that aggravating factors can extend. A (b)(6) exclusion also starts at three years. A (b)(4) exclusion runs as long as the license action. OIG has imposed permissive exclusions of ten, twenty, and fifty years. There is no statutory cap.
How CMS Claims Data Will Drive Exclusions
The notice gives the reason for the delegation in one sentence. CMS, as the agency that administers Medicare and Medicaid, is best placed to investigate, identify, and develop the evidence for permissive exclusion. That sentence describes a data operation.
CMS does not need a witness to start an exclusion case. It has the claims. Every Part B service, every DME order, every home health episode, and every Part D prescription runs through CMS systems before payment. The Center for Program Integrity runs predictive analytics on that stream through the Fraud Prevention System, which screens claims before payment and scores providers against peers. Unified Program Integrity Contractors investigate the outliers. State Medicaid data flows into the same environment through the Transformed Medicaid Statistical Information System.
The analytics flag billing patterns. A physician billing a procedure at ten times the specialty median. A lab with referral volume concentrated in a handful of ordering providers. A DME supplier whose beneficiaries live hundreds of miles from the shipping address. A clinic whose daily service hours exceed the hours in a day. Each pattern has an innocent explanation in some cases. Each also maps directly to a permissive exclusion ground. Outlier volume is evidence under (b)(6). Referral concentration is evidence under (b)(7). Enrollment discrepancies are evidence under (b)(16).
The Referral Gap Is Closed
Before October 14, that data produced a payment suspension, a revocation, or a referral to OIG and DOJ. The referral created a gap. OIG had to open its own file, develop its own evidence, and decide whether exclusion was warranted. OIG’s exclusion docket is small relative to the number of providers CMS flags each year. Most data-driven cases ended at suspension or revocation.
That gap is closed. The contractor that builds the data case for a payment suspension can now build it for an exclusion. The medical reviewer who finds a service unnecessary for a UPIC audit can supply the (b)(6) finding. No referral is required.
Three features of CMS data separate this from OIG practice. Scale: CMS processes more than a billion Medicare claims a year, and its analytics run on every one of them, while OIG opens investigations on a fraction of that universe. Speed: prepayment review and suspension are imposed within weeks of a flag, and an exclusion built on the same file can follow the suspension rather than wait for a criminal case to resolve. Standard: the data case does not need to prove intent, only a pattern substantially in excess of need or usual charges, which is a statistical question the agency answers with its own numbers.
CMS Will Use Exclusion the Way It Uses Suspension
CMS’s record with payment suspension predicts how it will use exclusion. The suspension regulation requires only a credible allegation of fraud, and CMS has treated a machine-learning flag as enough. In 2025 it suspended $5.7 billion in Medicare payments and revoked 5,586 providers and suppliers. In 2026 it suspended roughly 800 hospices and home health agencies in Los Angeles in one sweep, imposed a six-month nationwide enrollment moratorium on both sectors, and announced 1,079 suspensions alongside the June takedown. By the administration’s own account, about 90 percent of suspended providers never responded. We described that campaign in our analysis of CMS payment suspensions and DEA immediate suspension orders.
The laboratory sector shows the method at full scale. In August 2026, CMS reported that its analytics had stopped $1.6 billion in Medicare laboratory payments since January 2025. It investigated 600 labs, suspended 185, revoked 157, and referred 85 to law enforcement. The algorithm was the allegation. No lab saw the model, the data run, or the analyst’s memo before the money stopped. We examined that announcement in our article on Medicare laboratory payment suspension defense. In every sector, CMS acted on the data first, at volume, and left the provider to prove the data wrong on a 15-day clock.
Nothing in the delegation suggests restraint. CMS asked for the authority. The notice praises CMS as the agency best placed to develop the evidence, ratifies whatever CMS did before the notice issued, and permits redelegation to the offices that already run suspensions. OIG, by contrast, exercised permissive exclusion for 38 years as a case-by-case judgment made by attorneys applying published criteria. CMS has no exclusion criteria, no exclusion staff, and no history of declining to act on a flag. The reasonable expectation is that CMS will exclude on the same evidentiary basis, with the same breadth, and at the same speed it suspends. A provider who treats the first CMS notice as an audit will meet the exclusion unprepared.
A provider should expect that a payment suspension under 42 C.F.R. § 405.371 is now the opening step in a sequence that can end in exclusion, with the same evidentiary file supporting both. The 15-day rebuttal to a suspension is also the first draft of the exclusion defense.
Who Is Exposed
Any provider or supplier whose claims sit outside the peer distribution is exposed. The risk is highest where CMS analytics already concentrate.
Individual Practitioners With Outlier Billing
Physicians, nurse practitioners, and physician assistants whose volume of a specific code, modifier, or drug exceeds the specialty norm. Pain management, dermatology, cardiology, and behavioral health have drawn the most attention. The (b)(6) ground does not require fraud. It requires a pattern.
Suppliers and Ancillary Providers Built on Referrals
Durable medical equipment suppliers, clinical laboratories, genetic testing companies, and pharmacies whose revenue depends on a small set of ordering providers. Referral concentration is the first thing a UPIC looks for. It is also the fact pattern for a (b)(7) kickback determination.
Providers Already Under Payment Suspension
A suspension under the credible allegation of fraud standard already rests on a CMS evidentiary file. The notice ratifies actions taken before the effective date. Providers suspended in the 2026 Takedown should assume that file is now an exclusion file.
Owners, Officers, and Managing Employees
Section 1128(b)(15) reaches individuals who control an excluded entity. Section 1128(b)(8) reaches entities controlled by an excluded individual. One exclusion can spread across an ownership structure. CMS holds the ownership data through the enrollment system and the 42 C.F.R. § 424.519 affiliation disclosure rules.
Providers With Enrollment Discrepancies
A missed disclosure, an undisclosed owner, or a practice location that does not match the application is a (b)(16) ground if CMS finds it was knowing. CMS already uses enrollment discrepancies to revoke. The same finding now supports exclusion.
Hospitals and health systems face a different calculus. A (b)(7) exclusion of a hospital would end Medicare participation for the facility. OIG has historically declined to exclude hospitals and instead imposed corporate integrity agreements. Whether CMS follows that practice is unknown. The agency has no track record.
Procedural Rights in a CMS Exclusion
The statute guarantees reasonable notice and an opportunity for a hearing. Section 1128(f) provides it. The delegation did not change it. What changed is which agency starts the process. The existing procedure under 42 C.F.R. Part 1001 runs in five steps.
Notice of Intent and the 30-Day Response
For exclusions under (b)(6), (b)(7), and several other permissive grounds, 42 C.F.R. § 1001.2001 requires a written notice of intent before the exclusion is imposed. The provider has 30 days to submit documentary evidence and written argument. This is the only stage where the provider can stop the exclusion before it takes effect. Most providers waste it. They treat the notice as a billing dispute rather than the record on which an administrative law judge and a prosecutor will later rely.
Notice of Exclusion
If the agency proceeds, it issues a notice stating the basis, the length, the effect, and the appeal rights. The exclusion takes effect 20 days after the notice is mailed under 42 C.F.R. § 1001.2002. Filing an appeal does not stay it. Claims submitted for the excluded person’s services after the effective date are themselves false claims.
ALJ Hearing
The provider has 60 days from receipt of the notice to request a hearing before an administrative law judge at the HHS Departmental Appeals Board under 42 C.F.R. Part 1005. The agency bears the burden of proving the basis for exclusion by a preponderance of the evidence. The provider bears the burden on mitigating factors. The ALJ cannot review the agency’s choice to exclude where the ground is established. The ALJ can review whether the ground exists and whether the length is unreasonable.
DAB Review and Judicial Review
Either side may appeal the ALJ decision to the Departmental Appeals Board within 30 days. The DAB reviews the record for legal error and for findings unsupported by substantial evidence. The provider may then seek review in federal district court within 60 days of the DAB decision. Section 1128(f) incorporates the review provisions of 42 U.S.C. § 405(g). The court applies the substantial evidence standard to the agency’s findings. Reversal is rare. The record built at the notice of intent and ALJ stages controls the outcome.
Three Open Questions
Which ALJs hear a CMS exclusion? The notice withholds hearing authority from CMS. The Part 1005 ALJs sit at the Departmental Appeals Board, which is independent of both CMS and OIG. The most likely result is that CMS exclusions go to the same ALJs who hear OIG exclusions. No guidance has confirmed it.
Does Part 1001 bind CMS? The regulations refer to OIG throughout. The notice says the authority will be exercised under the Department’s existing regulations. A CMS exclusion that skipped the notice of intent, or shortened the response period, would invite a due process challenge. The ratification clause makes that question live for any action CMS took before October 14.
What happens when OIG and CMS disagree? Both agencies can now act on the same provider. A provider could receive a notice of intent from CMS while negotiating a release of exclusion with OIG in a False Claims Act settlement. The notice does not address coordination. Until it does, a release from one agency does not bind the other.
Reinstatement is not automatic. When the term ends, the provider must apply under 42 C.F.R. § 1001.3001. The agency may deny reinstatement based on conduct during the exclusion period.
What Exclusion Costs Beyond Medicare
Exclusion bars payment from every federal health care program. The consequences reach every employer and most private payers.
No Federal Program Payment, Directly or Indirectly
Under 42 C.F.R. § 1001.1901, no payment may be made by Medicare, Medicaid, TRICARE, the Veterans Health Administration, or any other federal health care program for any item or service furnished, ordered, or prescribed by an excluded person. The bar covers administrative and management services as well as clinical ones. It covers services billed by a hospital or group that employs the excluded person.
Loss of Employment
A hospital, practice, nursing home, or pharmacy that employs an excluded person and bills a federal program for that person’s work faces civil monetary penalties under 42 U.S.C. § 1320a-7a. Employers screen the OIG List of Excluded Individuals and Entities monthly. Most terminate on the first hit. An excluded physician cannot work for a federally funded provider in any capacity, including a non-clinical one.
State Licensing, Medicaid, and Private Payers
State medical, nursing, and pharmacy boards treat federal exclusion as grounds for discipline, and many require self-reporting within days. Every state Medicaid program must exclude any provider excluded by HHS, so relocating does not cure it. Most commercial payer agreements permit termination on federal exclusion, and Medicare Advantage and Medicaid managed care plans must terminate. The practical effect is the loss of most revenue, well beyond the federal share.
Revocation, Reenrollment Bar, and Ownership Contamination
Exclusion is an independent ground for Medicare enrollment revocation under 42 C.F.R. § 424.535(a)(2). CMS can impose a reenrollment bar of up to ten years, and up to twenty for a second revocation. The bar can outlast the exclusion. An excluded individual who holds a five percent or greater interest in a provider exposes that provider to its own exclusion under (b)(8). Divestiture is the usual response. It must be real, documented, and disclosed.
Four Points the Early Commentary Has Missed
OIG’s Own Exclusion Criteria Now Bind CMS
In April 2016, OIG published criteria for exercising its Section 1128(b)(7) authority. They place a provider on a risk spectrum from exclusion at one end to no further action at the other, and they describe when OIG will accept a corporate integrity agreement or release exclusion in a settlement instead. Those criteria are departmental policy. The October 14 notice says CMS will exercise the delegated authority under the Department’s applicable policies, procedures, and guidelines. A provider facing a CMS (b)(7) action has a documented basis to insist that CMS apply the same risk analysis OIG has applied for a decade, and to put the OIG criteria, and OIG’s published exclusion decisions, in front of the ALJ as the governing standard. CMS has no criteria of its own. The defense should supply them.
Discovery at the Hearing Is Documents Only
A data-driven exclusion case rests on three things: the peer group, the model, and the medical reviewer. Under 42 C.F.R. § 1005.7, discovery before the ALJ is limited to the production of documents. There are no depositions and no interrogatories. The defense cannot cross-examine the statistician before the hearing. It must demand, in writing and early, the claims universe used for the comparison, the specialty taxonomy that defined the peer group, the model parameters, the reviewer’s credentials, and the review instructions. A nurse practitioner enrolled under a family medicine taxonomy while working in a pain clinic will show as an outlier against the wrong peers. That error is found in the documents or not at all.
The ALJ Cannot Review Discretion, So the Case Is the Ground
Under 42 C.F.R. § 1005.4(c)(5), the ALJ may not review the agency’s exercise of discretion to exclude or to set a term within the regulatory range. Once the ground is proven, the argument that exclusion was a poor choice is unavailable. For a (b)(6) case, the whole fight is whether the services were “substantially in excess” of need or below “professionally recognized standards.” Both phrases are undefined in the statute. Both are decided by comparing the provider to a standard the agency chose. The defense wins by showing the standard was wrong, the comparison population was wrong, or the chart supports the service. It does not win by showing the provider is a good doctor.
A Settlement Release Must Now Name Two Agencies
For decades, a False Claims Act settlement carried an OIG release of permissive exclusion in exchange for a corporate integrity agreement or a finding of low risk. DOJ signed for the United States. OIG signed for exclusion. CMS was not a party. After October 14, a release signed by OIG alone leaves CMS free to pursue the same conduct under the same statute. Any settlement negotiated now should name CMS in the release or obtain a separate CMS release, and any settlement signed before October 14 without one should be reviewed. The ratification clause means CMS may already hold a file on the conduct the settlement resolved.
Defending a Data-Driven Exclusion
A CMS exclusion built on claims data is won or lost on the data. The agency’s case is a comparison. The provider’s answer has to be a better comparison, backed by the medical record. A response that attacks the statistical model, identifies the patient population that explains the outlier, and documents the medical necessity of the flagged services can end the case at the notice of intent. A response that argues intent misses the point under (b)(6), where intent is not an element.
The same file usually supports a parallel criminal or civil investigation. The exclusion response becomes evidence in that case. It is not privileged. It has to be written with the prosecutor in mind, because the prosecutor will read it.
Armstrong & Bradylyons PLLC: Exclusion, Payment Suspension, and Health Care Fraud Defense
Armstrong & Bradylyons PLLC represents providers, suppliers, executives, and owners in CMS and OIG exclusion, payment suspension, and revocation proceedings and the federal health care fraud investigations that run alongside them, in every federal district.
Scott Armstrong and Drew Bradylyons spent their DOJ careers building and supervising the data-driven health care fraud cases that CMS analytics now generate. Scott served as a leading trial attorney in the DOJ Fraud Section’s Healthcare Fraud Unit, as an Assistant Chief in its Market Integrity and Major Frauds Unit, and as Director of the Appalachian Regional Prescription Opioid Strike Force, which charged more than 120 defendants across 10 federal districts. He led the prosecutors and data analysts who identified targets from claims and prescribing data and built those cases. He has tried sixteen federal jury trials, nine of them healthcare fraud trials, with lead-counsel responsibility for cases totaling over $600 million in false claims.
Drew served as an Assistant Chief in the Health Care Fraud Unit, where he supervised the Miami Strike Force, and as Chief of the Financial Crimes and Public Corruption Unit at the U.S. Attorney’s Office for the Eastern District of Virginia, where he supervised parallel civil, criminal, and administrative fraud proceedings involving more than $1 billion in claims. They know how a peer comparison is built, where it breaks, and how an administrative record is read by the prosecutor who receives it next.
The firm’s attorneys have over 25 years of combined DOJ experience and 25 federal jury trials, including 17 in healthcare fraud cases involving over $2.8 billion in alleged false claims. The firm is based in Washington, D.C. and handles matters in every federal district.
Frequently Asked Questions
Can CMS exclude a provider from Medicare without a criminal conviction?
Yes. The October 14, 2026 delegation gives the CMS Administrator the Secretary’s permissive exclusion authority under Section 1128(b) of the Social Security Act. Most of the sixteen permissive grounds require no conviction. Section 1128(b)(6) covers claims or services substantially in excess of need or usual charges. Section 1128(b)(7) covers conduct the agency determines to be fraud or a kickback. Section 1128(b)(16) covers knowingly false enrollment statements. Each rests on an agency finding, proven at any hearing by a preponderance of the evidence. Mandatory exclusion under Section 1128(a), which requires a felony conviction, was not delegated and remains with the HHS Office of Inspector General. OIG also keeps its own permissive authority, so two agencies can now act on the same provider.
What is a notice of intent to exclude, and what happens if there is no response within 30 days?
A notice of intent to exclude is the written notice the agency must send before imposing an exclusion on most permissive grounds, including Section 1128(b)(6) and (b)(7). Under 42 C.F.R. § 1001.2001, the notice states the basis for the proposed exclusion and gives the provider 30 days to submit documentary evidence and written argument. The agency must consider the submission before deciding whether to exclude. This is the only stage at which a provider can stop an exclusion before it takes effect. If no response is submitted, the agency decides on its own file, the exclusion notice issues, and the exclusion takes effect 20 days after that notice is mailed. The response is not privileged. Anything submitted is available to the agency’s contractors, to OIG, and to federal prosecutors in any parallel investigation. A notice of intent is not required for license-based exclusions under (b)(4) or for most conviction-based grounds.
Does a Medicare payment suspension mean an exclusion is coming?
Not automatically. A payment suspension under 42 C.F.R. § 405.371 requires a credible allegation of fraud and is temporary. An exclusion requires a finding on a statutory ground and is imposed for a fixed term. The delegation connects them. The evidentiary file that supports a suspension is built by CMS and its contractors from claims data and medical review, and the same file can now support an exclusion without a referral to OIG. The notice also ratifies any exclusion-related action CMS took before October 14, 2026. A provider under suspension should treat the suspension record, including the 15-day rebuttal, as the record on which an exclusion decision may be made.
Does a state license surrender or suspension trigger a federal exclusion?
It can. Section 1128(b)(4) permits exclusion of any individual whose license to provide health care has been revoked or suspended by a state licensing authority, or who surrendered a license while a formal disciplinary proceeding was pending, for reasons bearing on professional competence, professional performance, or financial integrity. A surrender made to end a board investigation is treated the same as a revocation. No notice of intent is required before a (b)(4) exclusion, and the exclusion lasts at least as long as the license action. Under 42 C.F.R. § 1001.501, the provider may seek early reinstatement if the license is restored, if a license is obtained in another state, or in some cases after three years without a license. A license decision made during a board matter therefore has a direct federal consequence that should be understood before any agreement is signed.
What is the difference between a CMS exclusion and a Medicare enrollment revocation?
Revocation ends a provider’s Medicare billing privileges under 42 C.F.R. § 424.535. It applies to Medicare only, carries a reenrollment bar of one to ten years, and can be cured by reenrollment when the bar ends. Exclusion under Section 1128 bars payment by every federal health care program, including Medicaid, TRICARE, and the VA, for any item or service the excluded person furnishes, orders, or prescribes. It extends to employment by any federally funded provider, is listed on the public OIG exclusion database, and ends only when the agency grants reinstatement. Exclusion is also an independent ground for revocation. A provider can face both.
Can a Medicare exclusion be appealed, and what are the deadlines?
Yes. Section 1128(f) guarantees notice and an opportunity for a hearing. The provider has 60 days from receipt of the exclusion notice to request a hearing before an administrative law judge at the HHS Departmental Appeals Board under 42 C.F.R. Part 1005. Filing the request does not stay the exclusion, which takes effect 20 days after the notice is mailed. The agency bears the burden of proving the basis for exclusion by a preponderance of the evidence. The ALJ decides whether the ground exists and whether the length is unreasonable, but cannot review the agency’s choice to exclude once the ground is proven. Either side may appeal the ALJ decision to the Departmental Appeals Board within 30 days. The DAB decision is reviewable in federal district court within 60 days under 42 U.S.C. § 405(g), on a substantial evidence standard. The delegation withholds hearing authority from CMS, so CMS exclusions are expected to use the same ALJ process as OIG exclusions.
How long does a permissive exclusion last, and is it permanent?
The statute sets no maximum and no automatic end. The regulations in 42 C.F.R. Part 1001 set a benchmark term for each ground and list aggravating and mitigating factors that adjust it. Exclusions under Section 1128(b)(6) and (b)(7) carry a three-year benchmark. Aggravating factors include the dollar amount of the loss, the duration of the conduct, patient harm, and prior enforcement history. OIG has imposed permissive exclusions of ten years or more in large-loss cases and has imposed terms of fifty years. A (b)(4) exclusion based on a license action lasts until the license is restored. When the stated term ends, the exclusion does not lift on its own. The provider must apply for reinstatement under 42 C.F.R. § 1001.3001, and the agency may deny it based on conduct during the exclusion period. The LEIE listing remains until reinstatement is granted.
Can an exclusion be avoided, shortened, or negotiated?
Sometimes. On the length, 42 C.F.R. § 1001.701 and § 1001.951 list mitigating factors that can reduce the term below the benchmark, including a low loss amount, a prior finding that the conduct was the product of a mental or physical condition, and cooperation that resulted in action against others. On avoiding exclusion, OIG published criteria in April 2016 for exercising its Section 1128(b)(7) authority that rank providers on a risk spectrum and allow resolution without exclusion, through a corporate integrity agreement or a release in a False Claims Act settlement, where future risk is low. The October 2026 notice says CMS will act under the Department’s existing policies, which gives a provider a basis to invoke those criteria in a CMS proceeding. CMS has no settlement track record of its own, and a release from OIG does not bind CMS unless the agreement names CMS. Section 1128(c)(3)(B) also permits a waiver when a state program administrator certifies that the provider is the sole community physician or sole source of essential services.
How does reinstatement after a Medicare exclusion work?
Reinstatement requires a written application under 42 C.F.R. § 1001.3001, which may be submitted no earlier than 90 days before the exclusion term ends. The agency reviews the conduct that led to the exclusion, conduct during the exclusion period, whether the provider has complied with the exclusion, and whether the provider poses a continued risk to federal programs. Reinstatement is not automatic, and a denial may be followed by a new application after one year. For license-based exclusions under Section 1128(b)(4), 42 C.F.R. § 1001.501(c) permits early reinstatement where the license has been restored, where the provider holds a license in another state and the agency finds no continued risk, or in some circumstances after three years. Until reinstatement is granted, the provider remains on the List of Excluded Individuals and Entities and the payment prohibition continues.
Can an excluded provider still work in health care or treat cash-pay patients?
The exclusion bars federal program payment, not practice. Under 42 C.F.R. § 1001.1901, no federal health care program may pay for any item or service furnished, ordered, or prescribed by an excluded person, directly or indirectly, including administrative and management services. An employer that bills a federal program for an excluded person’s work faces civil monetary penalties under 42 U.S.C. § 1320a-7a, so hospitals, practices, and pharmacies screen the LEIE monthly and terminate on a hit. Treating patients who pay cash is not prohibited by the statute, but the excluded provider cannot order tests, prescribe drugs, or refer for services that any federal program will pay for, which includes most prescriptions for Medicare and Medicaid beneficiaries. Commercial payers, Medicare Advantage plans, and Medicaid managed care plans generally terminate on exclusion, and state licensing boards treat exclusion as grounds for discipline. In practice, the exclusion removes the provider from the payer system for its full term.
Where does Armstrong & Bradylyons PLLC defend CMS exclusion, payment suspension, and health care fraud matters?
Armstrong & Bradylyons PLLC represents providers, suppliers, executives, and owners in CMS and OIG exclusion, payment suspension, and revocation proceedings and the federal health care fraud investigations that run alongside them, in every federal district.
Scott Armstrong served as a leading trial attorney in DOJ Fraud Section’s Healthcare Fraud Unit and as an Assistant Chief in its Market Integrity and Major Frauds Unit, and directed the Appalachian Regional Prescription Opioid Strike Force, which charged more than 120 defendants across 10 federal districts. He has tried sixteen federal jury trials, including nine healthcare fraud trials, with lead-counsel responsibility for cases totaling over $600 million in false claims. Drew Bradylyons served as an Assistant Chief in the Health Care Fraud Unit, where he supervised the Miami Strike Force, and as Chief of the Financial Crimes and Public Corruption Unit at the U.S. Attorney’s Office for the Eastern District of Virginia, where he supervised parallel civil, criminal, and administrative fraud proceedings involving more than $1 billion in claims. Special Counsel Andrea Savdie served for four years as a Trial Attorney in the Healthcare Fraud Unit at the Miami Strike Force.
The firm’s attorneys have over 25 years of combined DOJ experience and 25 federal jury trials, including 17 in healthcare fraud cases involving over $2.8 billion in alleged false claims. The firm is based in Washington, D.C.
