CMS Now Has the Power to Exclude Providers from Medicare and Medicaid

What Does the CMS Exclusion Authority Mean for Medical Billing Businesses?

As of October 2026, the Department of Health and Human Services delegated permissive exclusion authority to CMS under Section 1128(b) of the Social Security Act, giving CMS the power to investigate and permanently exclude individual providers and entities from Medicare, Medicaid, and all other federal healthcare programs. For medical billing business owners and aspiring entrepreneurs, this compliance escalation signals growing demand for billing partners who understand federal program rules and can help practices stay enrolled.

• What happened: HHS published a Federal Register notice on October 14, 2026, granting CMS the same exclusion powers previously held only by the HHS Office of Inspector General (OIG). The delegation is effective immediately.
• Why it matters for practices: Providers now face two federal agencies with the authority to permanently remove them from Medicare and Medicaid, which raises the compliance stakes for every billing decision a practice makes.
• The business signal: When compliance risk rises, practices accelerate their search for trained billing partners who can prevent the errors that trigger enforcement action.

What Changed on October 14, 2026

On October 14, 2026, the Department of Health and Human Services published a Statement of Delegation Authority in the Federal Register, formally granting the Centers for Medicare and Medicaid Services the power to exclude individuals and entities from participation in federal healthcare programs. The delegation covers the permissive exclusion authority under Section 1128(b) of the Social Security Act.

Before this change, exclusion authority sat exclusively with the HHS Office of Inspector General. The OIG has maintained the List of Excluded Individuals and Entities (LEIE) since 1988 and has used that authority to bar providers convicted of healthcare fraud, patient abuse, felony controlled substance offenses, and other program integrity violations from billing Medicare, Medicaid, TRICARE, and every other federally funded healthcare program.

The October 14 delegation does not take that authority away from the OIG. Instead, it gives CMS parallel power to run its own investigations and issue its own exclusion determinations. According to HHS, the reasoning is straightforward: CMS is the agency that directly administers Medicare and Medicaid, which positions it to identify misconduct and build the evidentiary basis for exclusion faster than a separate agency working at a distance from the claims data.

This is not a proposed rule or a policy discussion. It is effective immediately. As the American Hospital Association reported on the same day, the delegation grants CMS similar authority to exclude and permanently ban providers as the OIG has following investigations.

Who Does the CMS Exclusion Authority Apply To?

The permissive exclusion authority under Section 1128(b) applies to any individual or entity that participates in federal healthcare programs. That includes physicians, nurse practitioners, therapists, medical groups, hospitals, ambulatory surgery centers, home health agencies, laboratories, durable medical equipment suppliers, and third-party billing companies that submit claims on behalf of providers.

The scope is not limited to large health systems. Solo practitioners, small group practices, and independent billing operations all fall under the same statutory authority. If an entity submits claims to Medicare or Medicaid, or if an individual orders, prescribes, or furnishes services paid for by those programs, the exclusion authority reaches them.

This is a point that aspiring billing business owners need to understand clearly. In our experience helping people launch billing companies, one of the first questions practice managers ask is whether you understand compliance. They want to know that handing off their billing to you will reduce their risk, not increase it. The CMS exclusion expansion makes that question more urgent, because the consequences of getting it wrong just became more immediate.

Exclusion is not the same as Medicare enrollment revocation. Revocation removes a provider’s ability to bill Medicare. Exclusion is broader. It bars the provider from Medicare, Medicaid, TRICARE, Veterans Affairs programs, and every other federally funded healthcare program. Depending on the basis, the ban can last years and in some cases is permanent.

Why HHS Moved Enforcement to CMS

The delegation did not happen in isolation. It is part of a broader federal enforcement escalation that has been building throughout 2026. In February 2025, Executive Order 14221 declared that progress on healthcare price transparency had stalled and directed the Secretaries of the Treasury, Labor, and HHS to take immediate action. In March 2026, the FTC launched its Healthcare Task Force. In July 2026, HHS announced it would defer approximately $867.5 million in Medicaid payments to California and $199 million to Minnesota over fraud concerns. In October, the FTC sent warning letters to 24 of the largest health systems about deceptive pricing practices.

The CMS exclusion delegation fits into this pattern. HHS stated in the Federal Register notice that formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes. In practical terms, that means CMS can now act on what it finds in claims data without waiting for the OIG to open a separate investigation.

For practice owners, the signal is clear: compliance is no longer a background concern. It is a front-of-mind operational priority. Providers who have been deferring their billing and compliance infrastructure are now operating in an environment where two federal agencies can independently decide to remove them from the programs that generate the majority of their revenue.

How Does This Create Demand for Medical Billing Businesses?

Every time the federal government raises the stakes on compliance enforcement, practices that have been handling billing in-house with limited staff or outdated processes face a harder choice. They either invest heavily in internal compliance infrastructure or they partner with an outside billing company that already has the training, the software, and the compliance knowledge built in.

This is the pattern we see playing out across the providers who come to us. Practices do not typically outsource billing when things are going well. They outsource when the cost of doing it wrong becomes too high to ignore. The CMS exclusion authority is exactly that kind of inflection point.

Consider what a small practice faces now. They need staff who understand Medicare enrollment rules, claims submission accuracy, documentation requirements, modifier usage, and the difference between a coding error that gets corrected and a pattern that triggers an investigation. They need systems that flag unusual claims patterns before a federal reviewer does. They need someone monitoring payer bulletins, fee schedule changes, and program integrity alerts. Most five-provider groups do not have the bandwidth or budget to build that internally.

That is the gap a medical billing business fills. You are not just processing claims. You are providing the compliance infrastructure that keeps a practice enrolled in the programs it depends on. The October 2026 delegation makes that value proposition stronger and easier to articulate in every client conversation.

The revenue cycle management market supports this trajectory. Industry projections estimate the medical billing outsourcing market will grow from approximately $19.5 billion in 2026 to more than $55 billion by 2035, driven by regulatory complexity, staffing shortages, and the rising cost of compliance errors. You can review the full income breakdown for medical billing businesses to see what that demand translates to in real revenue.

What Should New Billing Companies Do Now?

If you are building or planning a medical billing business, the CMS exclusion expansion gives you a concrete talking point and a set of operational priorities. Here is what to focus on.

1. Learn the exclusion and revocation rules. Understand the difference between Medicare revocation under 42 CFR 424.535 and exclusion under Section 1128 of the Social Security Act. Know which violations trigger mandatory exclusion and which fall under the permissive authority CMS now holds.
2. Build exclusion screening into your onboarding. Every provider and staff member touching a claim should be screened against the OIG LEIE before onboarding and at regular intervals after. This is a baseline compliance step that many small practices skip.
3. Position compliance in your sales conversations. When you meet with a practice manager, do not lead with price. Lead with the compliance gap. Ask whether they are screening their staff against the LEIE. Ask when they last reviewed their claims for patterns that could trigger a review. Most will not have a good answer, and that is your opening.
4. Monitor CMS program integrity updates. CMS has proposed new grounds to deny or revoke Medicare enrollment as part of the CY 2027 Home Health Proposed Rule, with provisions that apply to all provider types. Stay ahead of these changes so you can advise your clients before they are affected.
5. Document your own compliance infrastructure. Practices will ask how you protect them. Have a written compliance plan that covers HIPAA, claims accuracy, coding oversight, and payer requirement monitoring. This is what separates trained billing companies from data entry services.
6. Use the October 2026 news as a prospecting tool. Forward the AHA or Federal Register coverage to prospects with a short note explaining what it means for their practice. This positions you as the informed partner they need, not a cold sales call.

Common Misconceptions About the Exclusion Expansion

The announcement generated coverage from law firms, trade associations, and healthcare media, and some of the initial reactions overstated or understated what actually changed. Here is what the delegation does and does not mean.

Understanding these distinctions is part of what makes a billing company credible. When you can explain to a practice manager exactly what exclusion means, how it differs from revocation, and what steps you take to prevent it, you have moved past the price conversation and into a trust conversation. That is where billing contracts close.

Frequently Asked Questions

Next Steps

• The CMS exclusion authority is one more signal in a long line of developments that point in the same direction: practices need billing partners, and the demand is not slowing down.
• If you want to understand what a billing business can earn, start with the full income breakdown for medical billing businesses.
• If you are already thinking about client acquisition, review our guide on getting medical billing leads to see what works for new billing companies.
• And when you are ready to move forward, the path starts with a conversation.