HHS Secretary Announces Intent to Extend HHS-OIG Exclusion Authority to CMS, Expanding the Administration’s Anti-Fraud Campaign

HHS Secretary Robert F. Kennedy Jr. recently announced that he would give CMS the authority to exclude individuals and entities from participation in federal health care programs, an authority previously held only by HHS-OIG. While the announcement has not been formalized since announced in July, the announcement signals a potentially far-reaching expansion of CMS’s enforcement powers, which in turn would have implications for healthcare providers, suppliers, manufacturers, vendors, and other industry stakeholders.

U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. recently announced that he would give the Centers for Medicare & Medicaid Services (CMS) the authority to exclude individuals and entities from federally funded healthcare programs during a July 21, 2026, news conference (July 21 Conference).[1] That authority has belonged exclusively to the HHS Office of Inspector General (HHS-OIG) since 1988. Joined by the Administrator for CMS, the HHS Inspector General, and members of the White House Anti-Fraud Task Force, Secretary Kennedy stated that HHS-OIG and CMS would use their exclusion authority to “remove bad actors from federal health care programs [(FHCPs)],” in many cases permanently.[2]

While a public announcement does not in itself confer exclusion authority on CMS, and the announcement’s legal effect remains uncertain, officials at the July 21 Conference described the change as though it were already operative.

HHS Exclusion Authority

Section 1128 of the Social Security Act authorizes the HHS Secretary to exclude individuals and entities from all FHCPs.[3] The statute prescribes mandatory exclusions, which carry a minimum five-year term and are required upon conviction of certain program-related crimes, as well as permissive exclusions, which give the Secretary broad discretion to exclude an individual or entity based on certain categories of conduct.[4] The consequences of an exclusion are severe. Once excluded, no FHCP may issue payment for any item or service furnished, ordered, or prescribed by an excluded individual or entity, and a nonexcluded person who employs or contracts with an excluded individual or entity may also be liable for civil monetary penalties.[5]

Congress delegated certain aspects of the HHS Secretary’s exclusion authority to HHS-OIG in 1988 through amendments to the Social Security Act, including requiring the HHS Secretary to consult with HHS-OIG before waiving certain mandatory exclusions and requiring states to notify HHS-OIG of responsive actions taken after the state investigates an identified excluded individual or entity.[6] HHS-OIG has since implemented regulations outlining the standards, hearing rights, and appeals that currently govern exclusions.[7] HHS-OIG typically exercises its permissive exclusion authority in False Claims Act (FCA) cases, leveraging its authority in exchange for a settlement and/or corporate integrity agreement. In the six-month period ending March 31, 2026, HHS-OIG excluded 1,212 individuals and entities, and its List of Excluded Individuals/Entities (LEIE) currently contains more than 83,000 entries.[8]

Increased CMS Healthcare Fraud Enforcement

Statistics show that CMS is also increasingly using its ability to suspend enrolled provider Medicare payments as an enforcement tool. CMS published a “CMS Accomplishments” update citing 537 Medicare payment suspensions and 5,586 billing-privilege revocations in 2025 on its Crushing Fraud, Waste, & Abuse website and announced 1,413 revocations in the first quarter of 2026 alone during the July 21 Conference — a record 40% quarterly jump.[9]

Impact on the Healthcare Landscape

If operationalized, the July 21 Conference announcement could significantly amplify and expedite the government’s exclusion activities. Unlike HHS-OIG, CMS has access to real-time claims and enrollment data and analytics, a nationwide network of Medicare contractors that continuously conducts claims audits, and direct leverage over state Medicaid programs and MFCUs. With authority to exclude individuals and entities suspected or convicted of engaging in fraud, CMS would gain a powerful tool to enforce healthcare fraud and abuse laws.

HHS has not yet indicated whether or how it will formally grant CMS exclusion authority. HHS may attempt to issue interim guidance or propose changes to applicable regulations. President Donald Trump could also choose to issue an executive order directing HHS to implement the change.

The Sidley Healthcare team will continue to monitor these developments closely to determine the potential future impact of CMS exclusion authority on the healthcare industry. Please contact the attorneys below or your regular Sidley contact to discuss these and related enforcement developments.

[1]C-SPAN, HHS Secy. Kennedy, Dr. Oz, and Others News Conference on Combating Fraud (July 21, 2026), https://www.c-span.org/program/news-conference/hhs-secy-kennedy-dr-oz-and-others-news-conference-on-combating-fraud/683173 [hereinafter July 21 News Conference].

[2] Id.

[3] 42 U.S.C. § 1320a-7.

[4] See id.

[5]42 U.S.C. § 1320a-7a(a)(6); see OIG, Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (May 8, 2013).

[6] 42 U.S.C. § 1320a-7(c)(3)(B), (e)(3).

[7] See generally 42 C.F.R. pts. 1001, 1005.

[8]HHS-OIG, Semiannual Report to Congress: Spring 2026 (2026), https://oig.hhs.gov/documents/sar/11794/Spring_2026_SAR.pdf; HHS-OIG, LEIE Database & Supplement Downloads, https://oig.hhs.gov/exclusions/leie-database-supplement-downloads/#leie-database-download (last visited Aug. 27, 2026).

[9]CMS, Center for Program Integrity Data Dashboard (Jan. 2026), https://www.cms.gov/files/document/cpi-data-dashboard-january-update.pdf; July 21 News Conference.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.