Delegation of permissive Medicare and Medicaid exclusion authority raises questions and may further politicize fraud enforcement

The Trump Administration Secretary of the Department of Health and Human Services (HHS) has officially added the Administrator of the Centers for Medicare & Medicaid Services (CMS) to the list of individuals with the authority to exclude entities from participation in Medicare and Medicaid. This action is expected to further politicize fraud enforcement – a consistent theme of the Trump Administration.

In a formal delegation notice published in the Federal Register on October 14, HHS Secretary Robert F. Kennedy, Jr. officially delegated permissive exclusionary authority under Section 1128(b) of the Social Security Act (SSA). The delegation comes three months after the move was announced in a press conference by Secretary Kennedy, CMS Administrator Mehmet Oz and HHS Inspector General T. March Bell. At that press conference, none of the HHS officials provided any concrete details of how the new authority would work and the types of exclusion cases on which CMS would focus. 

The formal delegation notice also leaves many of those details unresolved. However, the notice does provide that the new delegation of authority will not change the prior delegation made to the HHS Office of Inspector General (OIG) in 1988. During the July press conference, HHS Inspector General Bell said the new delegation would help OIG in its efforts to remove bad actors from the federal health care programs.

We address below the delegation, the likely impact, and the potential implications on health care fraud settlements, including unanswered questions with arguably a second “prosecutor” with discretion over the same covered conduct.

What authority has been delegated?

According to the notice, the HHS Secretary is delegating permissive exclusion authority under only Section 1128(b). This is a key distinction. Under Section 1128(a) of the SSA the Secretary is required to exclude from program participation entities that are convicted of criminal fraud in the Medicare and Medicaid programs as well as certain other types of felony convictions. These mandatory exclusion actions are still the exclusive province of OIG.

Under the new delegation, both OIG and CMS will have the authority to seek exclusion under Section 1128(b), which permits HHS to exclude entities that have been convicted of lesser offenses, usually misdemeanors. Additionally, permissive exclusion is often used to punish entities that are owned by excluded individuals, entities that participated in kickback schemes, or entities that intentionally failed to disclose required information or made material misrepresentations of fact to CMS.

What will be the likely impact of this delegation?

While the press conference in July announced the delegation of authority, it became official with the notice published in the Federal Register. The notice is effective immediately, and so starting October 14, CMS has co-equal permissive exclusion authority with OIG. Under the delegation of authority, HHS retains the ability to make reports to Congress and to issue regulations governing the permissive exclusion authority.

It is unclear what division within CMS would take the lead on exclusion requests, as the agency does not have its own criminal investigative or enforcement division and has traditionally relied on the enforcement sections of OIG and the Office of Counsel to the Inspector General to bring criminal Medicare and Medicaid fraud charges. CMS does not have its own lawyers as this function is found in the HHS Office of General Counsel. 

One example of a group where this authority could ultimately land may be the Center for Program Integrity within CMS, which has a Provider Enrollment and Oversight Group. This authority, if exercised, would be done by individuals who are not historically enforcement attorneys.

Beyond questions about which CMS component would exercise the authority, the delegation also raises practical issues for health care fraud resolutions, including settlements that have a corporate integrity agreements (CIA). Defendants typically enter into CIAs in return for a release of OIG’s permissive exclusion authority. In other words, an agreement not to bring a permissive exclusion action is the government’s consideration for the contractual CIA. 

Now that CMS also has permissive exclusion authority, there will arguably be a second “prosecutor” with discretion over the same covered conduct. Will CMS need to align with OIG on whether to enter into a CIA and release the permissive exclusion authority? Otherwise, an entity that settles fraud allegations and fulfills its obligations under a CIA could potentially be subject to exclusion, as CMS is not a signatory to the agreements and the agreements usually state that any claims not explicitly released by the agreement remain reserved. 

What about settlements where the parties did not enter into a CIA because OIG decided that the conduct did not require an agreement and OIG essentially exercised its discretion without a formal agreement? Would CMS be able to exercise permissive exclusion authority on past settlements?

These questions underscore the need for additional guidance on how CMS and OIG will coordinate their respective exclusion authorities. Potential answers and the details of the exercise of this delegated authority may be addressed in future regulation or as the result of litigation from entities who are excluded under the authority.

Reed Smith will continue to follow developments related to health care fraud enforcement. If you have any questions about this delegation of authority or about the health care fraud enforcement environment, please do not hesitate to reach out to the authors of this post or your contacts at Reed Smith.