By: Anita Browning, FRP

Historically, the HHS Office of Inspector General (OIG) acted as the sole gatekeeper for excluding bad actors from federal health care programs under Section 1128 of the Social Security Act. That dynamic has fundamentally shifted. 

HHS Secretary Robert F. Kennedy Jr. officially delegated independent Section 1128 exclusion authority directly to the Centers for Medicare & Medicaid Services (CMS). Working alongside broadened revocation powers under 42 C.F.R. § 424.535, CMS is no longer just processing enrollment forms, it operates as a primary enforcement agency with “force multiplier” authority to cut off billing privileges and exclude entities entirely. The mechanics of how providers are being caught, where screening gaps exist, and the active enforcement push demonstrate why compliance programs must adapt.

Rather than relying on retrospective audits months after money has gone out the door, CMS has overhauled its detection infrastructure to catch questionable entities before claims are paid.

• Predictive AI Screening: CMS has deployed artificial intelligence models trained to detect anomalies across billing patterns, ownership changes, and affiliation networks in real time.
• Automated Data Mapping: Automated cross-checks link Medicare enrollment disclosures (Form CMS-855) against federal and state exclusion lists, state licensing boards, and corporate registry databases.
• Pre-Payment Claims Interception: Flags generated by backend analytics automatically defer payments or trigger immediate administrative scrutiny prior to disbursement.
• The “One-Link” Trap: If an entity within your administrative, real estate, or capital structure has a single tainted individual, CMS’s interconnected data network flags the entire corporate family—not just the bad actor.

Catching problematic relationships requires looking past direct W-2 employees. Under CMS’s expanded disclosure and enrollment framework, an undisclosed, inaccurate, or excluded entity at any layer of your operational tree exposes an otherwise compliant facility to immediate revocation.

Exclusion checks and background screenings must now cover five specific operational tiers:

EXPANDED EXCLUSION SCREENING NET
1. Capital & Ownership	Investors, PE sponsors, holding companies
2. Real Estate Partners	REITs, facility landlords, property entities
3. Corporate Structure	Publicly traded parent entities & affiliates
4. Clinical Leadership	Contracted directors, medical staff managers
5. Operational Partners	Any third-party manager/financial partner

A gap or reporting delay anywhere in this chain grants CMS immediate grounds to initiate revocation or exclusion proceedings under § 424.535.

Aggressive Enforcement: By the Numbers

The impact of this consolidated authority and algorithmic tracking is already taking effect:

Enforcement Metric	Q1 2026 Volume	Trend / Impact
CMS Provider & Supplier Revocations	1,413	+40% jump over previous quarter
Enforcement Strategy	Pre-payment intervention	Immediate loss of Medicare billing privileges
Risk Profile	High across all tiers	Applies to entities with zero history of prior wrongdoing

Federal officials have explicitly framed these updates as an aggressive posture toward fraud prevention.

Waiting for a payment deferral or a § 424.535 revocation notice is the most costly way to identify a disclosure flaw. Our Health Care Practice Group actively assists healthcare entities in mitigating risk through focused interventions:

• 360° Exclusion Screening Implementation: Upgrading your background check workflows so screening extends continuously across your entire ownership, management, landlord, and investor network.
• CMS-855 Enrollment Audits: Reviewing submitted enrollment records to eliminate discrepancies in disclosable relationships, management contracts, and capital entities.
• Compliance Policy Restructuring: Rewriting internal compliance protocols to reflect CMS’s direct Section 1128 exclusion powers and proactive risk monitoring.
• Rapid Response Defense: Providing immediate legal intervention, evidence gathering, and administrative representation if CMS defers payments or issues an inquiry.