CMS Can Now Exclude Providers from Medicare and Medicaid. What Practices Need to Know About the Financial Risk

By Elizaveta Bannova, Billing Department, WCH

A physician practice can submit accurate claims, maintain a full appointment schedule, and collect payments on time while overlooking a compliance risk that could affect its ability to receive federal healthcare reimbursement. Unlike an ordinary claim denial, an exclusion can raise questions about whether certain services are payable at all, including services furnished through other clinicians or organizations.

On October 14, 2026, the Department of Health and Human Services (HHS) formally delegated additional exclusion authority to the Centers for Medicare & Medicaid Services (CMS). The delegation authorizes the CMS administrator to exercise the secretary’s authority under Section 1128(b) of the Social Security Act, which establishes grounds for permissive exclusion from federal healthcare programs. The change took effect immediately.

For practice owners and financial leaders, the announcement raises a practical question: if a provider’s status changes, can the organization identify the affected services, quantify the potential financial exposure, and respond before the issue becomes a larger compliance problem?

What Changed — and What Did Not

Section 1128(b) already identifies circumstances in which an individual or entity may be excluded from federal healthcare programs. Depending on the applicable statutory provision, these include certain misdemeanor convictions related to healthcare fraud or controlled substances, license revocation or suspension, excessive charges or medically unnecessary services, prohibited kickback arrangements, and specified false statements in program enrollment applications.

The distinction between permissive and mandatory exclusion is important. The October delegation concerns permissive exclusion authority; it does not create an entirely new list of offenses or mean that every audit finding, licensing inquiry or enrollment discrepancy automatically results in exclusion. The statutory grounds and the facts of the individual case still matter.

The notice also does not transfer every exclusion-related function from HHS OIG to CMS. OIG retains its existing delegated authority, while hearings and rulemaking remain outside the authority delegated to CMS. The stated rationale is that CMS, as the agency responsible for administering Medicare and Medicaid, is well positioned to investigate potential violations and develop the evidence needed to support exclusion determinations.

For providers, this is a change in enforcement authority, not a new universal screening mandate. The notice does not automatically suspend payments to every provider under investigation. The financial implications depend on whether an exclusion occurs, which services fall within its scope, and which program rules apply.

Exclusion Is Not the Same as Medicaid Revalidation

The distinction matters because both processes can affect a provider’s ability to participate in a healthcare program, but they address different issues.

Earlier this month, WCH Insights examined New York’s Medicaid revalidation initiative in New York Medicaid Revalidation Is Underway, and the Clock Starts the Day the Notice Goes Out. That article covered the state’s Provider Services Portal, the 123-calendar-day response period after the initial notification, and the importance of keeping enrollment information current.

The CMS delegation concerns a different mechanism: the authority to exclude individuals or entities from federal healthcare programs on specified grounds. It is not another revalidation deadline, and completing revalidation does not resolve an exclusion issue. Conversely, a revalidation notice is not evidence that a provider is subject to exclusion.

The financial consequences may overlap because both issues can affect participation and reimbursement, but the underlying requirements should not be confused. Practices need separate controls for maintaining accurate enrollment records and identifying potential exclusion risks.

Why an Exclusion Can Affect More Than One Provider’s Claims

Revenue-cycle teams are accustomed to correcting denials caused by missing authorizations, coding errors or incomplete documentation. An exclusion presents a different problem because federal healthcare program payment restrictions may apply even when a claim is otherwise accurate.

Under the federal exclusion rules, payment generally cannot be made for items or services furnished by an excluded person, or furnished at that person’s medical direction or on that person’s prescription, within the scope of the applicable rules. The restrictions can also affect services paid for indirectly through another individual or organization.

Changing the billing provider on a claim or asking another clinician to submit it does not necessarily resolve the issue. The practice must establish who furnished, ordered or directed the service, whether the service falls within the exclusion rules, and which payment arrangement applies.

The financial exposure generally falls into three categories.

Future collections. If services are not payable under the applicable exclusion rules, the practice may face an interruption in expected collections. A claim can be technically correct and still be ineligible for payment.

Previously paid claims. Management may need to determine whether payments received for affected services require further review, correction, repayment or disclosure. An exclusion does not automatically make every historical payment repayable; the analysis depends on the exclusion’s effective date and scope, the services involved and the applicable requirements.

Additional costs and potential penalties. The practice may need to arrange replacement coverage, reschedule patients, review contractor relationships and devote staff time to claims analysis. OIG also warns that employing or contracting with excluded individuals or entities to provide items or services payable by federal healthcare programs can expose organizations to civil monetary penalty liability.

The scope of the problem should not be estimated from the affected provider’s job title alone. A physician may generate relatively modest direct collections but play a significant role in ordering diagnostic services, directing treatment or supporting other reimbursable services. Those relationships may require review under the applicable rules.

How to Calculate the Financial Exposure

Consider a physician who generates $80,000 in monthly collections, including $50,000 from Medicare and Medicaid. The physician also orders diagnostic services and participates in clinical workflows supported by other staff.

If the physician becomes subject to an exclusion, it would be premature to classify the entire $50,000 as lost revenue. It would be equally risky to assume that only claims submitted under the physician’s own name could be affected. Finance and compliance must first establish which services fall within the exclusion, the relevant dates and the rules governing each payment arrangement.

A practical exposure assessment should separate the following:

Category	What to review
Future revenue	Collections associated with potentially affected services and providers
Outstanding claims	Submitted claims that may require review before further collection activity
Previously received payments	Payments that may require investigation or corrective action
Operational costs	Replacement staffing, rescheduling, reduced capacity and compliance review

The assessment should use actual claims and collection data. Medicare fee-for-service, Medicare Advantage, Medicaid fee-for-service and Medicaid managed care should be identified separately rather than combined into one federal-program revenue figure. The applicable rules and contractual obligations may differ, so the analysis must reflect the particular program and services involved.

Management should also distinguish confirmed exposure from amounts that remain under investigation. An outstanding claim is not automatically a loss, and a potential exclusion match is not the same as a confirmed exclusion. The purpose is to produce a defensible estimate that supports informed decisions rather than inflate the projected financial impact.

Exclusion Screening Requires More Than One Source of Information

Credentialing and enrollment processes establish whether a provider meets professional and payer participation requirements. Exclusion screening addresses a separate question: whether an individual or entity is excluded from participation in federal healthcare programs.

HHS OIG maintains the List of Excluded Individuals/Entities (LEIE), which identifies individuals and entities currently excluded by OIG. OIG recommends that healthcare organizations screen prospective employees and contractors and periodically review the status of existing personnel. It also explains that monthly screening best minimizes potential overpayment and civil monetary penalty liability because the LEIE is updated monthly.

There is an important distinction between a recommended control and a universal legal requirement. OIG states that federal statute and regulation do not require every provider to check the LEIE at a prescribed frequency. Separate requirements apply to state Medicaid agencies, and additional obligations may arise under particular programs, state rules or contracts. Practices should establish their obligations under the requirements relevant to their operations rather than assume that one screening schedule applies universally.

For organizations seeking a practical baseline, monthly screening is a reasonable control to consider. The process should specify who is screened, who performs the checks, how potential matches are verified, how results are documented and who receives an alert when a possible issue is identified.

A name match alone does not establish that a person is excluded. OIG’s guidance describes how to verify an individual’s identity and recommends retaining documentation of the initial search and any additional checks used to resolve a potential match. Practices should avoid making employment, scheduling or billing decisions based solely on an unverified name match.

The new CMS delegation makes it particularly important not to treat the LEIE as the only possible source of information about exclusion status. The list is maintained by OIG; the October notice does not establish that checking the LEIE alone will identify every action that might be taken under CMS’s newly delegated authority. Practices should monitor relevant official communications and establish a process for escalating government notices or other credible indications of a change in participation status.

Outsourcing screening does not eliminate the need for oversight. If a staffing company or credentialing vendor performs the checks, management should confirm what the contract covers, how frequently screening occurs and how results are communicated. The practice needs a clear process for acting on a verified finding, not simply a vendor report stating that screening was completed.

Five Actions Practice Leaders Should Take Now

1. Document the screening process.

Confirm which individuals and entities are covered, how often checks are performed and who owns follow-up. Keep dated evidence of completed screening and the resolution of potential matches. OIG’s official LEIE database, search tools and instructions are available on its website.

2. Establish an escalation pathway.

Licensing notices, enrollment issues, government communications and possible exclusion matches should reach the appropriate compliance and legal personnel. Billing and finance must receive clear instructions if the issue could affect claims or reimbursement. A licensing inquiry alone is not proof of exclusion, but it should be evaluated promptly.

3. Maintain provider-level financial data.

Finance should be able to identify each provider’s payer mix, collections, outstanding claims and role in relevant service lines. Where necessary, the analysis should also identify services ordered, prescribed or directed by the provider. This information allows the practice to estimate potential exposure without assuming that all revenue is equally affected.

4. Prepare a response protocol for a confirmed exclusion.

Involve qualified healthcare counsel and compliance leadership to establish the affected person’s identity, the effective date, the applicable program and the scope of the exclusion. Review relevant services and claims, determine whether operational changes are required, and assess any repayment, disclosure or corrective-action obligations. Preserve supporting records and communicate documented instructions to the relevant teams.

5. Test the process across departments.

A screening policy is useful only if the right people receive the result and act on it. Test a realistic scenario involving a potential exclusion or provider-status change. Confirm who verifies the facts, who assesses the legal implications, who identifies affected claims, and who authorizes operational changes. Include multiple locations and external vendors where relevant.

What This Means for Practice Finance

CMS’s new authority does not mean that every provider faces an immediate increase in exclusion risk, and it should not be interpreted as a warning that ordinary billing errors automatically lead to exclusion. It does reinforce the need to identify compliance issues that may affect participation in federal healthcare programs before they become payment problems.

Practices should also avoid assuming that every payer arrangement responds identically. Federal exclusion rules, state Medicaid requirements, managed-care contracts, and commercial payer provisions may differ. The effect on a particular claim or provider relationship requires analysis of the applicable rules, the services involved, and the facts of the case.

The most useful next step is to establish whether the practice can identify a relevant status change, quantify the affected revenue, and direct the appropriate response without delay. That requires coordination between credentialing, compliance, billing, and finance — not simply an accurate claim submission process.

For practice owners, the takeaway is straightforward: provider eligibility is part of revenue integrity. Regular screening, a documented escalation process, and provider-level financial reporting cannot eliminate every enforcement risk, but they can help the organization identify problems earlier and respond with better information.

Editorial Note: This article provides operational and financial analysis for healthcare practices and is not legal advice. Specific exclusion, repayment, and billing questions should be reviewed with qualified healthcare counsel.

Sources

Federal Register. “Statement of Delegation of Authority.” October 14, 2026. 91 FR 65219, Document No. 2026-21001.
https://www.federalregister.gov/documents/2026/10/14/2026-21001/statement-of-delegation-of-authority

Social Security Act, Section 1128(b). Permissive exclusion authorities, 42 U.S.C. § 1320a-7.
https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320a-7&num=0&edition=prelim

U.S. Department of Health and Human Services, Office of Inspector General. “Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs.” May 8, 2013.
https://oig.hhs.gov/exclusions/special-advisory-bulletin-and-other-guidance/the-effect-of-exclusion-from-participation-in-federal-health-care-programs/

U.S. Department of Health and Human Services, Office of Inspector General. “LEIE Quick Tips & Instructions.”
https://oig.hhs.gov/exclusions/leie-quick-tips-instructions/

U.S. Department of Health and Human Services, Office of Inspector General. “LEIE Database & Supplement Downloads.”
https://oig.hhs.gov/exclusions/leie-database-supplement-downloads/