This week, the Department of Health and Human Services (HHS) granted the Centers for Medicare & Medicaid Services (CMS) sweeping new enforcement powers in its governance of Medicare providers. CMS may now exercise permissive exclusion – the power to exclude individuals and entities from participating in federal health care programs altogether. While the announcement aligns with CMS’ work to combat fraud and abuse in Medicare and Medicaid, HHS offered little explanation of why the new authority is necessary, how it will operate alongside existing responsibilities, or whether it will meaningfully improve program integrity. 

Permissive exclusions allow federal officials to determine (without seeking criminal conviction) whether misconduct – such as filing fraudulent claims, unlawful kickbacks, providing medically unnecessary services, or some licensing violations – warrants barring an individual or organization from federal health care programs entirely. The HHS Office of Inspector General (OIG) has historically exercised these powers. OIG reported 2,837 exclusions in fiscal year 2025, across mandatory and permissive categories. Under the new delegation, OIG retains its authority while empowering CMS as a separate enforcer, exercising the same power concurrently. 

Permissive exclusion sanctions reach much further than CMS’ existing Medicare enforcement mechanisms. CMS can already revoke Medicare billing privileges, restrict reenrollment, and place providers on its Preclusion List, preventing Medicare Advantage and Part D payments for certain services or prescriptions. These measures are hardly inconsequential, and some can affect participation in other programs. But exclusions under Section 1128 of the Social Security Act (under which this authority was granted) bar any payment for services furnished, ordered, or prescribed in a federal health care program by an excluded person or entity. It includes Medicare, Medicaid, and other federally funded health programs. Hospitals and medical practices employing an excluded professional may also lose payment for that person’s services. For a provider relying on public reimbursement, the financial consequences can be existential. 

There is a reasonable case for ensuring CMS can act promptly against providers engaged in serious misconduct. Its access to claims, utilization, and enrollment data allows the agency to detect troubling patterns and develop evidence for enforcement. The notice offers a glimmer of an efficiency argument: Assigning exclusion authority to CMS could align investigative work with the decision to impose sanctions. If credible cases routinely lose momentum in the referral process, CMS should not be required to holster a documented enforcement action while another office begins its own review. 

Yet the notice provides no indication that investigations and enforcement actions are faltering at OIG. HHS asserts that the delegation will reduce redundancy and improve program integrity, without identifying delayed cases, quantifying administrative burdens, or explaining how existing referrals to OIG have impeded enforcement. The absence of that information is notable given the breadth of the newly delegated authority. Administrative efficiency is a legitimate objective, but it is difficult to evaluate a proposed solution when no underlying problem has been described. 

Meanwhile, CMS has demonstrable problems implementing the powers it already holds. A recent OIG audit identified $72 million in Medicare Advantage and Part D payments during 2022–2024 associated with 249 provider identifiers previously revoked from Medicare. The audit described delays and errors involving CMS’ Preclusion List, as well as regulatory gaps that allowed certain improper payments. Those findings do not establish that broader exclusion authority is unwarranted. But if CMS has clear, unaddressed operational problems in policing payments within Medicare, is it wise to add a broader legal mandate and new enforcement authority? 

The CMS/OIG overlap also creates implementation questions. Will the two offices divide cases by program, conduct, or investigative origin? Can both agencies pursue the same provider? Who resolves disagreements? HHS has supplied no public account of how it will avoid duplicative investigations (the inefficiency it claims to address). Nor has it explained whether the agencies will apply the same standards when deciding that exclusion is appropriate. 

Those decisions matter to providers as well as taxpayers. Permissive exclusion requires judgment and, in some cases, proceeds without a criminal conviction. HHS has reserved exclusion hearings for OIG, maintaining an important avenue for independent review. That protection should assuage some concern about procedural fairness, but it does not answer how CMS will apply existing standards or when it will choose exclusion over a narrower remedy. 

Better program integrity should also be measurable. If the expansion of CMS’ authority is intended to accelerate investigations or reduce administrative costs, the agency should establish benchmarks for evaluating those outcomes. The number of additional exclusions alone is an inadequate measure of success. Enforcement should be judged by its effectiveness in preventing improper payments, protecting beneficiaries, and ensuring that sanctions are appropriately applied. 

The administration’s emphasis on combating fraud and protecting taxpayer dollars is warranted. Giving CMS direct access to additional enforcement tools may ultimately prove beneficial. But a delegation of authority with consequences across federal health care programs deserves more than a cursory explanation of administrative efficiency. HHS has established why CMS is capable of exercising permissive exclusion authority. It has done considerably less to establish why CMS needs it.