Key Takeaways:
- Two exclusion regulators, not one. CMS may now pursue any Section 1128(b) permissive exclusion ground alongside Office of Inspector General (OIG), whose authority is undiminished.
- Every revocation is now retroactive. The Final Rule makes all revocation grounds effective back to the date noncompliance began, converting enrollment defects into overpayment exposure.
- Owners and operators are targets. Revocation and denial now reach suspensions and license actions involving owners and managing employees, and HHAs undergoing certain changes in majority ownership must reenroll as new providers.
- Act now. Ownership diligence, enrollment hygiene, billing audits, and screening programs should be refreshed before CMS operationalizes these tools.
In its ongoing efforts to “crush fraud, waste, and abuse,” the Centers for Medicare & Medicaid Services (CMS) recently acquired two powerful new levers over suppliers and providers who are enrolled in federal health care programs. On October 14, 2026, the Health and Human Services (HHS) Secretary
delegated to CMS,
effective immediately, the authority to impose permissive exclusions from all federal health care programs under Section 1128(b) of the Social Security Act. On November 4, 2026, CMS issued the
CY 2027 Home Health Prospective Payment System Final Rule (Final Rule), which in addition to addressing home health payment updates and policy changes, significantly expanded CMS’s Medicare enrollment revocation and denial authority. Although the exclusion delegation was issued separately from the Final Rule, the two operate together, and home health agencies (HHAs) should take note.
The New Permissive Exclusion Authority
What it allows. Pursuant to its newly delegated permissive exclusion authority under Section 1128(b) and its implementing regulations, CMS may exclude an individual or entity from receiving payment, directly or indirectly, for any item or service furnished to Medicare, Medicaid, or other federal health care program beneficiaries on seventeen (17) discretionary bases, including misdemeanor health care fraud convictions, license revocation or suspension, false or fraudulent claims, kickbacks, claims for substantially excessive charges or unnecessary services, and false statements on enrollment applications. Per the HHS Secretary, “formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.”
Why it matters. Exclusion is often called the “nuclear option” because commercial payers and Medicaid programs typically refuse to deal with excluded parties, rendering most health care businesses nonviable. Until now, CMS’s comparable lever was enrollment revocation. Pairing exclusion with CMS’ claims data, contractor network, and stated “crush fraud” agenda gives the agency an end-to-end ability to detect, revoke, and exclude. Important open questions remain: whether CMS will redelegate the authority internally, which hearing and appeal procedures will govern (CMS cannot itself issue regulations or hold hearings under the delegation), and whether CMS will condition exclusion waivers on compliance obligations akin to Corporate Integrity Agreements.
Expanded Enforcement Authority Under the CY 2027 Final Rule
In the Final Rule, CMS finalized several changes to Medicare enrollment that significantly expands its enforcement authority and tightens enrollment requirements for all Medicare providers and suppliers. The changes include:
- Retroactive revocations. Under current regulations, certain Medicare enrollment revocations became effective prospectively – specifically, 30 days after notice of revocation to the affected provider or supplier. Now, all revocation grounds are retroactive to the date noncompliance began, enabling CMS to recoup payments for the entire noncompliant period. CMS projects this change will save approximately $82 million annually.
- Adding or Expanding Bases for Revocation or Denial. CMS added several new grounds and expanded existing grounds for revocation or denial of enrollment, including:
- Change in majority ownership. HHAs, hospices, and DMEPOS suppliers experiencing certain changes in majority ownership must reenroll as new providers and undergo a new survey or accreditation; failure to do so is a basis for denial or revocation.
- Owner and managing employee suspensions. CMS expanded its right to deny or revoke enrollment if a provider: (1) has a suspended/revoked license in another state; or (2) is suspended/revoked from Medicaid or another federal healthcare program to include similar suspensions/revocations involving the provider’s owners or managing employees/organizations.
- Abuse of Billing Privileges. The four factors listed under 42 CFR 424.535(a)(8)(ii)(A) though (D) which CMS was required to consider when determining whether a “pattern or practice” of non-compliant claims exists to demonstrate an “abuse of billing privileges” were eliminated.
- False or Misleading Information. CMS expanded 42 CFR 424.535(a)(4) to allow revocation based on the submission of false or misleading information on or associated with any CMS or Medicare enrollment-related form. This ground for revocation was previously limited to false or misleading information on the enrollment application.
- Private Equity (PE)/Real Estate Investment Trust (REIT) Disclosure. CMS expanded PE/REIT ownership disclosures (previously applicable to only skilled nursing facilities (SNFs)) to Medicare Part B providers and suppliers and Medicare Diabetes Prevention Program suppliers (i.e., Forms 855B, 855S, and 20134. This move signals CMS’ continued concern regarding the quality of healthcare services rendered in settings, including physician practices, in which PE/REITs are involved.
Conclusion
CMS is no longer merely a payor that revokes billing privileges; it is now an exclusion authority with retroactive recoupment tools and reach into the ownership and management of the providers it pays. For HHAs, the practical effect is that enrollment compliance, ownership governance, and fraud and abuse risk are now a single integrated exposure. Agencies that act now to tighten enrollment hygiene, screening, and transaction planning will be best positioned as CMS operationalizes these authorities. Foley Hoag’s Healthcare and White Collar teams are monitoring implementation closely and are available to assist with risk assessments, enrollment audits, and enforcement matters.
