CMS New Exclusion Authority Is Constitutionally Vulnerable and Providers Must Act Fast

HHS has handed CMS a career-ending enforcement tool. The agency still must obey the Constitution, the statute, and its own regulations.

By Chapman, Dowling & Mallek

October 15, 2026

Healthcare Enforcement

The federal government has just changed who can pull one of the most destructive levers in healthcare enforcement. Effective October 14, 2026, the Secretary of Health and Human Services delegated to the Administrator of the Centers for Medicare & Medicaid Services the Secretary’s permissive-exclusion authority under Section 1128(b) of the Social Security Act. CMS can now seek to bar individuals and entities from Medicare, Medicaid, and other federal healthcare programs.

An exclusion is not a routine billing adjustment. It can stop federal program reimbursement, disqualify a provider from work involving federal healthcare dollars, trigger reports to state licensing agencies and other organizations, and publicly brand the provider as excluded. For a physician, pharmacy, laboratory, home-health agency, or healthcare company, the practical effect can be immediate and existential.

When CMS imposes that punishment before a provider receives meaningful notice, access to the evidence, and a fair opportunity to be heard by a neutral decisionmaker, the process is constitutionally defective. The government may call exclusion “permissive” and “remedial,” but labels do not answer the Fifth Amendment question. The Constitution looks to what the government actually does, when it does it, and whether the process can prevent an erroneous deprivation before the damage becomes irreversible.

What changed on October 14

The Federal Register notice delegates the HHS Secretary’s existing Section 1128(b) authority to the CMS Administrator. It does not create new statutory grounds for exclusion. It creates a new enforcement center inside the agency that administers Medicare and Medicaid, controls enormous amounts of provider data, conducts program-integrity reviews, and makes enrollment and payment decisions.

Section 1128(b) already permits exclusion on broad grounds, including certain misdemeanor fraud and controlled-substance convictions, license revocation or suspension, exclusion from another healthcare program, excessive charges or unnecessary services, kickbacks or other prohibited conduct, failure to provide information or access, false statements in enrollment applications, and failure to return certain overpayments.

The limits in the notice matter. CMS did not receive authority to conduct hearings or issue regulations. The Secretary retained rulemaking authority, and the HHS Inspector General’s existing exclusion authority remains intact. CMS must exercise the delegated power under established HHS policies, procedures, guidelines, and regulations. The authority may be redelegated, and the notice purports to affirm and ratify exclusion-related actions that CMS personnel took before October 14.

Those limits create legal fault lines. Existing exclusion regulations repeatedly assign notice and decisional functions to the OIG. CMS cannot use an internal delegation to invent new substantive standards, bypass binding procedures, or make policy through unpublished instructions. And a sentence purporting to ratify earlier conduct does not erase a provider’s right to challenge whether the actor had authority, whether fair notice existed, or whether retroactive application is lawful.

Why the new structure raises a constitutional problem

1. Exclusion can occur before process becomes meaningful

Under the current regulations, many exclusions become effective 20 days after the exclusion notice. The provider generally has 60 days after receipt to request an ALJ hearing, but the request does not automatically undo the exclusion. Some categories receive a notice of intent and 30 days for written submissions; other categories follow different procedures. In certain proposed-exclusion matters, a timely hearing request can delay effectiveness unless HHS finds that patient health or safety requires immediate action. The details depend on the asserted statutory ground, which is why the first days after notice are decisive.

The Supreme Court’s test in Mathews v. Eldridge asks courts to weigh the private interest at stake, the risk of error and value of additional safeguards, and the government’s interest. Applied to a disputed permissive exclusion, that balance can demand more than a paper response followed by a hearing after the provider has already lost patients, contracts, employees, and reputation. When there is no genuine emergency, a prompt pre-exclusion hearing, disclosure of the evidence, and a neutral assessment are modest safeguards compared with the catastrophic cost of a mistaken exclusion.

2. Providers have a serious due-process interest even though the courts disagree about its label

The government will argue that participation in Medicare or Medicaid is not protected property. Several courts agree. The Sixth Circuit, for example, held in Parrino v. Price that a provider lacked a property or liberty interest in continued federal-program participation. The Fourth Circuit reached the opposite conclusion in Ram v. Heckler, recognizing an expectation of continued Medicare participation as property protected by the Fifth Amendment. Other cases distinguish future participation from payment already earned for services rendered.

That disagreement does not give CMS a constitutional blank check. A provider’s strongest claim may involve earned payments, a state-created entitlement, a professional license, a contract right, or a liberty interest arising when the government’s stigmatizing public action also changes the provider’s legal status. The theory must be built from the provider’s actual facts, governing state law, contracts, and downstream consequences. A generic objection is easy to dismiss; a documented deprivation is not.

3. Concentrating investigation and charging power increases the need for neutral review

CMS requested this authority because it is positioned to investigate, identify, and develop the evidence supporting exclusions. That concentration is the point of the delegation. It is also the constitutional concern. Withrow v. Larkin holds that combining investigative and adjudicative functions is not automatically unconstitutional. But the Supreme Court also recognized that the facts of a particular case can create an intolerably high risk of unfairness. Where the same enforcement pipeline selects the data, defines the alleged violation, withholds key context, and makes exclusion effective before neutral testing, due process demands close scrutiny.

4. CMS cannot impose new standards without fair notice and lawful procedure

The delegation is a notice, not a regulation. It expressly withholds rulemaking authority from CMS. If CMS attempts to broaden terms such as “unnecessary services,” “substantially excessive charges,” “false statement,” or “failure to return an overpayment” through internal manuals, data screens, or enforcement custom, providers may have strong fair-notice and Administrative Procedure Act arguments. The agency must identify the legal standard that existed when the conduct occurred, explain how the evidence satisfies it, and follow the procedures that bind HHS.

How Chapman Dowling and Mallek will fight a CMS exclusion

The defense must begin before the exclusion becomes a fait accompli. Our response will be tailored to the statutory ground, the forum, and the client’s operational risk, but the core methods include the following.

1. Control the clock and seek immediate relief. We will identify every response and appeal deadline, contest defective service, request that exclusion be held in abeyance, and, where the law and jurisdiction permit, seek emergency administrative or judicial relief before the business suffers irreparable harm.

2. Force CMS to identify its authority and evidence. We will demand the precise Section 1128(b) ground, the valid chain of delegation or redelegation, the governing regulation, and the complete factual basis. We will challenge undisclosed criteria, unsupported extrapolations, hearsay presented as proof, and attempts to shift the government’s burden.

3. Attack the statutory predicate. A license action may lack the required nexus to competence, performance, or financial integrity. A misdemeanor may not relate to the delivery of healthcare. A billing dispute may not establish medically unnecessary services. An enrollment answer may be accurate under the question CMS actually asked. The words of the statute are limits, not suggestions.

4. Build the clinical and data record. For medical-necessity, coding, utilization, or statistical cases, we will work with qualified clinicians, coding specialists, data analysts, and investigators to test the sample, expose denominator errors, restore missing clinical context, and distinguish documentation imperfections from fraud or untrustworthiness.

5. Press constitutional and administrative-law challenges. We will preserve due process, fair-notice, bias, retroactivity, unauthorized-action, and arbitrary-and-capricious arguments from the first submission. We will challenge any effort by CMS to create a new substantive rule without notice and comment or to rely on pre-delegation action that cannot lawfully be ratified.

6. Challenge the length and collateral consequences. Even when some basis exists, the period may be unreasonable. We will develop mitigating facts, proportionality arguments, patient-access concerns, remediation evidence, and narrower alternatives, while coordinating the response to licensing boards, employers, managed-care plans, credentialing bodies, and parallel civil or criminal matters.

7. Create the record for federal court. ALJs and the Departmental Appeals Board may be unable to invalidate statutes or regulations on constitutional grounds, but the issues still must be preserved. We will build a clean record for ALJ review, DAB review, and judicial review, while analyzing whether any claim can proceed immediately despite Medicare’s demanding channeling and exhaustion rules.

What an excluded or targeted provider should do now

Do not assume that an informal call, corrective-action plan, voluntary repayment, or cooperation with an audit protects your appeal rights. Preserve the notice and envelope, calendar the presumed and actual receipt dates, stop informal communications until counsel understands the record, and secure the emails, claims data, medical records, enrollment forms, licensing documents, and contracts that bear on the asserted ground. Do not alter records or attempt a rushed “cleanup.” Preservation and disciplined response are part of the defense.

Also assess the operational perimeter immediately: who bills federal programs, who employs or contracts with the targeted person, which patients could be affected, what state reporting duties may be triggered, and which private payors or credentialing bodies could act based on the federal exclusion. The exclusion case and the continuity plan must move together.

The government moved immediately and so should you

CMS now has another direct path to threaten a provider’s livelihood, reputation, and ability to care for patients. That power is not self-justifying. It is bounded by Section 1128, HHS regulations, the Administrative Procedure Act, and the Fifth Amendment. When CMS crosses those boundaries, Chapman, Dowling & Mallek will challenge the evidence, the procedure, the decisionmaker, and the lawfulness of the exclusion itself.

If you received an exclusion notice, a notice of intent, a CMS data request, or an audit that could lead to exclusion, contact Chapman, Dowling & Mallek immediately for a confidential assessment. Waiting can cost the right to a hearing and allow the government’s version of the facts to harden. The best time to protect your practice is before the exclusion takes effect. The next best time is now.

REQUEST A CONFIDENTIAL CONSULTATION

chapman.law