CMS can now exclude Medicare providers. Is your screening ready?
On October 14, 2026, HHS gave CMS its own power to exclude providers. What it means for exclusion screening, PECOS ownership data, and license monitoring.
What changed on October 14?
On October 14, 2026, HHS Secretary Kennedy signed a notice in the Federal Register (91 FR 65219) giving the CMS Administrator permissive exclusion authority under Section 1128(b) of the Social Security Act, effective the same day. Until now the HHS Office of Inspector General (OIG) has been the only agency using that authority. OIG keeps it, but CMS has it too.
Where will CMS exclusions show up?
CMS hasn't said yet.
| HHS OIG | CMS | |
|---|---|---|
| Exclusions it can impose | Mandatory, 1128(a), and permissive, 1128(b) | Permissive only, 1128(b) |
| Since | 1988 | October 14, 2026 |
| Where exclusions are published | The LEIE | Not announced |
Most of us screen against the OIG List of Excluded Individuals/Entities (LEIE), SAM.gov, and the state Medicaid lists. If CMS ends up keeping its own list and you're only checking the LEIE, you could have a hole in your process.
What can get a provider excluded?
The bigger concern for credentialing teams is what can get someone excluded. The permissive grounds include license revocation or suspension, exclusion by another program, ownership or control by a sanctioned individual, failing to fully and accurately disclose required information such as ownership, and knowingly making false statements or misrepresentations of material fact on an enrollment application. The last two tie straight back to the CMS-855 forms. Bad ownership or managing employee information in the Provider Enrollment, Chain, and Ownership System (PECOS) has always been a revocation risk. Now it could be an exclusion risk, and an exclusion follows you to Medicaid and every other federal program. If you employ or contract with someone who's excluded, you're also exposed to civil monetary penalties and repayment of claims tied to that person's services.
Why could an honest mistake become an exclusion?
The current administration has made big fraud numbers a headline, and agencies tend to deliver what leadership measures. That should worry every healthcare organization, because most of the ownership problems I've run into over the years weren't fraud. A practice added a partner and never updated PECOS, or a manager left and stayed on the file. Under a ground as broad as failing to accurately disclose ownership, a lapse like that could get labeled fraud.
What should credentialing teams do now?
If I were running a credentialing department this week, I'd:
- Confirm we screen monthly against the LEIE, SAM.gov, and every state Medicaid list that applies.
- Pull our ownership and managing employee information out of PECOS, check it against what we have on file today, and fix what's wrong.
- Look hard at license monitoring, because finding out about a suspension at recredentialing is too late.
- Make sure every screen is documented with the date, the source, and the result.
When CMS says where its exclusions will be published, that source goes into the screening process the same day. Two agencies can exclude now, so plan accordingly.
Discuss this post on LinkedIn
Questions, or a different read? Join the conversation where Tony posted it.
About the author
Tony Kuka · Founder, Ziurta
Tony is the founder of Ziurta, a provider enrollment platform for medical practices, health systems, RCM firms, and credentialing companies. He has 30 years in healthcare administration, including 20 building outsourced revenue cycle companies, and founded and sold Medical Business Office and National Credentialing Solutions. He is based in Chattanooga, Tennessee.