CMS Can Now Ban Providers From Medicare: 3 Checks to Run
Two federal agencies can now ban providers from Medicare. Here are the exclusion triggers, who is at risk, and the 3 checks to run on your roster this month.
CMS Can Now Ban Providers From Medicare: 3 Checks to Run
For 38 years, exactly one federal agency could ban a clinician from Medicare and Medicaid. As of Oct 14, 2026, there are two.
HHS Secretary Robert F. Kennedy Jr. signed a statement of delegation of authority that handed exclusion power to CMS Administrator Dr. Mehmet Oz, alongside the HHS Office of Inspector General. Put plainly: the agency that pays your claims can now also build the case to cut you off from them. Your providers may now be banned by CMS, not just by OIG.
The numbers behind that sentence are worth sitting with. HHS-OIG has banned nearly 85,000 entities since permissive exclusions began, and the September 2026 LEIE database file lists 84,093 active exclusions.
In the same week as the delegation, HHS and CMS ripped 189,000 deceased and duplicate enrollees off ACA marketplace plans, clawing back $738 million in improper payments with a $1.5 billion year-end target. This is not a memo. It is an enforcement wave, and your practice is swimming in it.
Here is what that means for a 6-provider practice in Edison. Exclusion still targets fraud, abuse, false claims, and license actions. A coding error does not put a provider on the LEIE, and an ordinary billing mistake will not get your practice banned. What changed overnight is the math: twice as many agencies can now open a file on you, and the one that just got the pen already holds every claim you have ever submitted.
Key takeaways
- Two federal agencies can now ban a provider from Medicare and Medicaid. Until Oct 14, 2026, only HHS-OIG could.
- Exclusion reaches fraud, false claims, license revocation, and ownership ties to sanctioned entities. Ordinary billing errors sit outside this list.
- The LEIE held 84,093 active exclusions in the September 2026 database. OIG updates it by the 10th of every month.
- CMS asked for this authority itself and proposed widening the grounds in July 2026. Those proposals are not final.
- Three checks cover the exposure: screen every provider monthly, keep enrollment records current, and audit your ownership disclosures.
What did the CMS provider exclusion delegation actually change?
Kennedy issued the statement on the morning of Oct 14. It moved the authority to exclude individual providers from federal health programs to the administrator of CMS, which administers Medicare and Medicaid directly.
His stated rationale was operational. As he put it, CMS "is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations." Formalizing the delegation puts investigative and enforcement responsibilities in one operating division, which reduces redundancy and improves program integrity outcomes.
There are real limits, and they matter. Oz works alongside the HHS Office of Inspector General. Under this delegation he cannot conduct hearings. He cannot issue regulations. He is not replacing OIG. He is adding a second agency capable of building an exclusion case, and that second agency happens to process every Medicare claim in the country.
What changed | What did not |
|---|---|
CMS can initiate permissive exclusions alongside HHS-OIG | HHS-OIG retains its existing authority |
The administrator investigates and develops the evidentiary record | No authority to conduct hearings |
Program integrity sits in the division that administers Medicare and Medicaid | No authority to issue regulations |
CMS requested the delegation itself | No change to the exclusion grounds in force today |
Background matters for reading the risk. HHS-OIG has held sole exclusion authority since 1988, when the secretary centralized the power to ban providers from Medicare and Medicaid under the Social Security Act. That consolidation allowed administrative sanctions and civil remedies to expand into permissive exclusions, covering situations like a provider submitting false claims or losing a license through a state action.
What actually gets a provider excluded from Medicare?
Practices hear "exclusion" and imagine a billing error. The regulatory grounds tell a different story. Read this list the way an investigator would.
Exclusion authority comes from sections 1128, 1128A, 1128B, and 1156 of the Social Security Act, and the mechanics live in 42 CFR Part 1001. Part 1001 splits into Subpart B, mandatory exclusions, and Subpart C, permissive exclusions.
The mandatory list at 42 CFR 1001.101 covers convictions: criminal offenses tied to Medicare or a state health program, patient neglect or abuse, felonies relating to fraud, theft, embezzlement, or breach of fiduciary duty after Aug 21, 1996, and felonies involving controlled substances.
Permissive exclusions are discretionary. OIG's own authority table runs through 16 statutory grounds under section 1128(b). A practice can be excluded on these:
Ground | Citation | What it looks like in practice |
|---|---|---|
Conviction relating to program or health care fraud | 42 CFR 1001.201 | Felony or misdemeanor fraud conviction tied to care delivery |
Conviction for obstruction of an investigation | 42 CFR 1001.301 | Interfering with an audit or federal inquiry |
Conviction relating to controlled substances | 42 CFR 1001.401 | Felony drug conviction, scope reaches owners and managing employees |
License revocation or suspension | 42 CFR 1001.501 | License pulled for competence, performance, or financial integrity |
Exclusion under another federal or state program | 42 CFR 1001.601 | Already barred by Medicaid or another payer |
Excessive claims or unnecessary services | 42 CFR 1001.701 | Volume or substandard care pattern |
False or improper claims | 42 CFR 1001.901 | False claims submitted to a federal program |
Fraud and kickbacks | 42 CFR 1001.951 | Referral arrangements and prohibited inducements |
Failure to disclose certain information | 42 CFR 1001.1101 | Ownership, control, or business relationships not reported |
Failure to grant immediate access | 42 CFR 1001.1301 | Records or access withheld from an audit |
Entity owned or controlled by a sanctioned person | 42 CFR 1001.1001 | Ownership link to an already-excluded person |
Individual with ownership or control interest | 42 CFR 1001.1551 | Being an owner, officer, or managing employee of a sanctioned entity |
Two of those deserve extra attention for an independent practice.
License revocation carries a floor, not a ceiling. Under 42 CFR 1001.501, an exclusion based on license action cannot be shorter than the period the license is actually suspended or revoked. Aggravating factors can extend it further, including a documented history of wrongdoing or significant adverse impact on program beneficiaries.
Ownership reaches further than most owners realize. Section 1001.1001 excludes entities owned or controlled by a sanctioned person. Section 1001.1551 reaches individuals holding an ownership or control interest. If your practice has a management services arrangement or a silent partner, that relationship sits inside the exclusion perimeter.
Where does the risk actually land for your roster? Most practices carry exposure through the people they employ or contract with, not through their own billing. OIG states plainly that anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties. One unchecked hire can put the whole practice in the penalty column.
That is a different risk from the one your own documentation creates. Where an audit targets a provider's own claims, the 2026 OIG Work Plan lists the enforcement areas OIG says it is prioritizing this year, and our medical billing audits in 2026 guide covers how those audits get scoped.
What is CMS proposing to add to the exclusion list?
CMS asked for the exclusion delegation itself, per Kennedy's statement. The agency also proposed expanding the grounds over the summer of 2026. Every item in this section is proposed rulemaking, not current law.
The proposal came in the Calendar Year 2027 Home Health Prospective Payment System Proposed Rule (CMS-1844-P), released July 6, 2026. CMS estimated the expanded authority would save taxpayers about $82 million a year.
The enrollment proposals would apply to every provider and supplier type participating in a federal health program, including home health.
Proposed ground | Detail | Why a practice should care |
|---|---|---|
Geographic concentration | Revocation where an area has an "excessive" number of providers and suppliers, which CMS treats as elevated fraud risk | Saturation alone becomes a basis for revocation |
Misdemeanor convictions | Denial or revocation for a misdemeanor related to sexual assault or financial misconduct within the past 10 years | The bar drops from felony to misdemeanor for these categories |
Owner or managing organization in trouble | Action when owners or managing organizations hold a suspended or revoked license in another state, or are in trouble with Medicaid or another federal program | Your billing vendor's or MSO's record becomes your exposure |
Change of majority ownership | Home health, hospice, and DME suppliers must re-enroll and complete required accreditation or survey after a majority ownership change | A sale or equity restructure triggers a re-credentialing event |
Retroactive revocation | Revocation effective immediately upon noncompliance, replacing the 30-day notice for some provider types | CMS can claw back improper payments retroactively |
That third row is the one independent practices should flag. If your practice shares ownership or management with an entity that has Medicaid problems in another state, the proposed rule would pull your enrollment into that case.
The same enforcement push has touched enrollment itself. In May 2026 the administration issued a six-month moratorium on hospice and home health agency enrollment in Medicare. Earlier in 2026 it paused enrollment of durable medical equipment, prosthetics, orthotics, and supplies companies.
3 checks to run on your provider roster this month
None of this requires new software. All of it requires someone owning the task by name.
# | Check | Frequency | Owner | What good looks like |
|---|---|---|---|---|
1 | Screen every employed and contracted provider against the LEIE | Monthly, by the 10th | Credentialing lead or practice manager | Documented search with date, name, SSN or EIN verified, result stored |
2 | Confirm enrollment and credentialing records are current | Quarterly, plus at every change event | Credentialing lead | Reassignments, terminations, and address updates reflected in PECOS and NPPES |
3 | Audit ownership and managing-employee disclosures | Twice a year and at every equity change | Owner or compliance lead | Full disclosure set on file for every person with ownership or control interest |
Check 1 is the one practices skip and regulators expect. OIG updates exclusion information by the 10th of every month. It recommends downloading the full updated LEIE database rather than relying on monthly supplements, because supplements carry only one month of actions. For a handful of names, the online search handles up to 5 individuals or entities at a time.
One detail that catches experienced staff. OIG states it is not sufficient to find a matching first and last name on the LEIE.
Identity verification requires an SSN for an individual or an EIN for an entity, entered through the online search. A name match alone is not a finding, and a missed SSN check turns a clean result into an undocumented one.
Check 2 matters because exclusions travel through paperwork. A lapsed revalidation, a stale reassignment, or an unreported address change is the kind of gap that turns into an audit question rather than a billing correction.
Our Medicare revalidation control calendar walks through the cadence.
Check 3 is the one that has no precedent in most practices. There is usually no process at all, because ownership structure does not change often enough for anyone to build one.
Starting now, while the exposure is theoretical, costs a day of work. Starting after a notice of intent costs considerably more.
Want someone to run checks 1 and 2 with your practice? Our free billing and compliance audit screens your provider list against the LEIE and reviews your enrollment records, then shows you the gaps. Request a free audit.
We also screen every provider on your roster as part of our credentialing services, because the LEIE check and the enrollment record check belong in the same workflow rather than two separate systems.
What does this signal for 2027?
Two agencies can now end a provider's ability to bill federal programs. One of them already holds a list with more than 84,000 names on it, updates it every month, and can fine you for hiring anyone who appears there.
The posture is not theoretical. 189,000 enrollees purged in a single week. $738 million clawed back, $1.5 billion targeted by year end. Kennedy's own words at the press conference: some cases begin with an error, others may reveal deliberate abuse. Translation: they are looking, and they are finding.
For a compliant practice, this is still a housekeeping problem. But housekeeping with a deadline is a different animal than housekeeping someday. Get the three checks running with a name attached, and the exposure closes before anyone ever opens a file with your practice's name on it. Our compliance resource library tracks the rest of the federal requirements that land on a practice manager each year.
Frequently asked questions
No. Exclusion grounds under 42 CFR Part 1001 cover convictions, license actions, false or improper claims, kickbacks, undisclosed ownership interests, and failure to cooperate with audits. An ordinary billing mistake, a missed modifier, or a claim submitted with a coding error does not appear in that list. Exclusion is a fraud and abuse enforcement tool, not a billing correction mechanism.
As of Oct 14, 2026, two agencies. HHS Secretary Robert F. Kennedy Jr. delegated exclusion authority to CMS Administrator Dr. Mehmet Oz, who now works alongside the HHS Office of Inspector General, which held sole authority since 1988. Under the delegation, Oz cannot conduct hearings or issue regulations.
OIG has banned nearly 85,000 entities since permissive exclusions began, per reporting on the delegation. The September 2026 updated LEIE database file contains 84,093 active exclusion records. OIG publishes the list by the 10th of every month and recommends downloading the full updated database rather than relying on monthly supplement files.
Yes. OIG states that anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties. That is why OIG directs health care entities to check the list routinely for new hires and current employees, and why it requires identity verification by SSN or EIN rather than name matching alone.
Under the proposed July 2026 rule, yes. CMS proposed expanding revocation grounds to reach providers whose owners or managing organizations hold a suspended or revoked license in another state, or are in trouble with Medicaid or another federal program. That expansion is proposed rulemaking and is not current law. Existing rules already reach entities owned by a sanctioned person.
Not sure whether anyone on your roster is exposed? Our free billing and compliance audit screens your provider list, enrollment records, and denial patterns, then shows you exactly where the gaps sit. Request a free audit.