HHS delegates permissive exclusion authority to CMS while preserving OIG authority
Oct 18, 2026 edition · GC-2026-0370 · Published 2026-10-18 · Version 1 · Effective
The October14 notice delegates Social Security Act section1128(b) permissive exclusion authority to the CMS Administrator. OIG retains its authority; hearings and regulation issuance are excluded from the CMS delegation. This is an agency-authority change, not an exclusion of a named provider.
What happened
HHS published a delegation to the CMS Administrator of the Secretary’s permissive exclusion authority under section 1128(b) of the Social Security Act on October 14. The notice explains that CMS requested the authority so it can investigate, identify and develop the evidentiary basis for permissive exclusions while administering Medicare and Medicaid. It revises limitations in the earlier delegation and states that the delegation is effective immediately. The notice does not provide a separate signature date that would support assigning a different calendar effective date.
The authority may be redelegated under applicable departmental policies, procedures and regulations. The delegation expressly excludes conducting hearings and issuing regulations, and it does not diminish the Inspector General’s earlier delegated authority or actions under that delegation. HHS also affirms and ratifies earlier exercises of the delegated authority by the Administrator or subordinates. The announcement does not itself exclude an organization or create a new substantive exclusion ground; provider-specific consequences still require the applicable authority and action.
Scope and timing
- Authority status
- Effective
- Applicability
- Operationally relevant
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- Federal
- Responsible owner
- Compliance
Why it matters
Provider organizations should recognize CMS as an additional source of permissive-exclusion action and route notices to counsel promptly. Existing OIG exclusion monitoring remains relevant because the delegation expressly preserves OIG authority.
Recommended action
Have Legal and Compliance review exclusion-notice intake and escalation so CMS communications receive appropriate attention alongside OIG actions. Confirm each actual notice’s grounds, appeal process and scope; do not infer an exclusion from this delegation alone. Playbook dates are internal targets.
Implementation playbook
- Recommended internal target: update intake routing for CMS permissive-exclusion correspondence while preserving OIG monitoring. Compliance · Due 2026-10-23
- Recommended internal target: confirm counsel review of authority, hearing rights and effective scope for any actual exclusion notice. Legal · Due 2026-10-30
Sources
- HHS Statement of Delegation of Authority, FR2026-21001Official · HHS; CMS · 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →