CMS exclusion authority brings new fraud enforcement questions for providers

HHS’s decision to grant CMS exclusion authority creates a new enforcement consideration for healthcare providers participating in federal programs.

HHS Secretary Robert F. Kennedy Jr. announced the update during a July news conference, and an Oct. 14 regulatory notice formalized the change, effective immediately. The notice gives CMS permissive exclusion authority under the Social Security Act, allowing CMS to exercise powers previously delegated to the HHS Office of Inspector General (OIG) without removing OIG’s existing authority.

Although CMS already was authorized to revoke a provider’s enrollment and billing privileges in traditional Medicare, exclusion removes a provider from all federal healthcare programs. The punishment tends to be for instances of serious fraud or patient abuse, with the affected organization barred from submitting claims, ordering and prescribing, or furnishing administrative services.

“For many providers, exclusion is more consequential than any monetary penalty because it effectively ends your participation in federally funded healthcare programs, and beyond that, most private payers are not going to work with you,” said Jeff Wurzburg, partner with the law firm of Norton Rose Fulbright. “It really can be a death penalty for a provider, and without knowing where in the process CMS would seek to utilize this exclusion authority, it could have a real chilling effect on providers [in disputing audits].”

CMS also proposes greater control over Medicare fraud investigations

The addition of exclusion authority is not the only area in which CMS is expanding the scope of its enforcement. The agency has proposed to take more direct control over fraud investigations, reducing the traditional autonomy of Unified Program Integrity Contractors (UPICs).

CMS would identify and prioritize fraud investigations, becoming the primary source of leads and investigative decisions, according to an analysis by the law firm of McDermott Will & Schulte. UPICs would shift into a case-development role, conducting analyses, interviews, medical reviews and evidence gathering after CMS assigns cases. Contractors also would help with appeals, hearings, witness testimony and litigation support.

The agency would exercise tighter control over investigative technologies, including AI tools and external data sets. Among the potential consequences are faster investigations and quicker government intervention upon identification of suspicious billing patterns, according to the analysis.

“CMS’s emphasis on centralized lead generation and taking ‘timely action to prevent continued fraudulent payments’ suggests a model focused less on retrospective audits and more on identifying and stopping questionable billing activity earlier in the payment cycle,” the authors wrote. “For providers, that could mean less time between the emergence of a billing pattern and government scrutiny.”

The proposal is in the form of a request for information to which interested parties may submit feedback by Nov. 4.

How expanded exclusion authority could affect hospitals

With respect to CMS’s new exclusion authority, hospitals stand to be less impacted than other provider types and suppliers, given their comparatively robust Medicare and Medicaid compliance programs and the fact that imposing exclusion on a hospital could harm the surrounding community.

Still, hospitals should not take the situation for granted,

“If CMS begins using this authority actively, hospitals may need to pay even closer attention to enrollment, credentialing, quality, billing and program-integrity issues that historically might have resulted in other administrative remedies before escalating to exclusion,” Wurzburg said.

In addition, exclusions involving a physician, billing contractor, lab, supplier or other business partner can create compliance concerns. OIG has said healthcare entities may face civil monetary penalties if they employ excluded individuals.

Compared with OIG, CMS can move faster with data-driven triggers using claims and enrollment information, according to a September analysis co-authored by Wurzburg. Thus, providers cannot assume that exclusion processes will continue to follow OIG-style due process or timelines.

Key questions remain about how CMS will exercise exclusion authority

Much uncertainty followed Kennedy’s July announcement authorizing CMS’s new exclusion powers. The ambiguity largely went unresolved in the recent regulatory notice, which established the formal legal mechanism for the change but included few operational details. While the notice requires CMS to follow applicable policies, procedures and regulations, a more comprehensive release will be needed to get a clear picture.

Questions to monitor, Wurzburg said, include how OIG and CMS will divvy up the circumstances in which they apply exclusion authority.

“Oftentimes, OIG uses its exclusion authority after a long investigation. CMS, on the other hand, is regularly engaged with providers on typically a daily basis in terms of providers submitting reimbursement claims, in terms of Medicare enrollment, and so providers have significantly more touchpoints with CMS,” he said.

Also yet to be explained is “whether CMS will develop enforcement priorities distinct from OIG, how aggressively CMS intends to use the authority, or whether providers should expect procedural approaches that differ from traditional OIG exclusion matters.”

Legal challenges and settlement complications could follow

Such questions may give rise to lawsuits if not explicitly answered before CMS takes action against providers.

“My view would be if CMS just begins enforcing this exclusion authority, it’s probably pretty ripe for challenge,” Wurzburg said. “CMS is going to have to provide some authority, some guardrails, some regulations about how they would use this authority and what rights providers have to challenge an exclusion action.”

Another litigation-related issue that requires clarity is how the changes will affect False Claims Act settlement negotiations, which often involve working with OIG to ensure the provider is not excluded from Medicare and Medicaid.

“The settlement process could become substantially more complicated if providers now need assurance from multiple agencies regarding that exclusion risk,” Wurzburg said. “If I were currently involved in settlement negotiations with the government, that’s a question I would be asking: Are all the relevant parties at the table?”