Main blog; Chat GPT essay on elective exclusion case law
Here: Alternative from Claude
#
Two Hands
on One Lever:
CMS,
Permissive Exclusion, and Forty Years of Case Law
CLAUDE OPUS Oct 24, 2026 · @Bruce Quinn
On October 14, 2026, Secretary Kennedy published a one-page
Statement of Delegation of Authority that may turn out to be the most
consequential program-integrity document of the year. It hands the CMS
Administrator the Secretary's permissive exclusion powers under section 1128(b)
of the Social Security Act, 42 U.S.C. § 1320a-7(b). The Office of Inspector
General keeps everything it had. The delegation withholds two things, the
authority to conduct hearings and the authority to issue regulations, and it ratifies
any exclusion-related action CMS took before the notice appeared. CMS may
redelegate within the agency.
Nothing in the statute changed. What changed is who may pull
the lever, and that turns out to matter a great deal, because section 1128 has
spent four decades being interpreted on the assumption that the entity pulling
it was a law-enforcement office rather than the payer. The question for law
professors is what the accumulated case law has to say to a new actor; the
question for policy people is whether that case law will discipline CMS the way
it has disciplined OIG, or whether a payer with its own data warehouse and its
own grievances will find the doctrinal fences less constraining than they look.
The statute CMS inherited
Exclusion predates OIG's custody of it. The 1977
Medicare-Medicaid Anti-Fraud and Abuse Amendments gave the Secretary authority
to bar providers convicted of program-related crimes, and the Medicare and
Medicaid Patient and Program Protection Act of 1987 reorganized the authority
into the structure we still use: section 1128(a) mandates exclusion for a short
list of convictions (program-related crimes, patient abuse, and later felony
fraud and felony controlled-substance offenses), while section 1128(b) permits
exclusion on a longer and more heterogeneous list. The Secretary delegated both
to OIG in the 1980s, and OIG has run the machinery, and written the regulations
at 42 C.F.R. Part 1001, ever since. The Affordable Care Act added grounds in
2010, including section 1128(b)(16) for false statements on enrollment
applications, a provision that sits squarely in CMS's own territory.
The permissive grounds are worth reading as a list, because
their diversity is the point. Some require a conviction: misdemeanor fraud,
obstruction of an investigation, misdemeanor controlled-substance offenses.
Some require no conviction at all: loss of a state license, exclusion from
another federal program, furnishing unnecessary or substandard services,
charging substantially in excess of usual charges, engaging in kickback or
false-claims conduct found administratively, being an owner or officer of an excluded
entity, defaulting on health-education loans. "Permissive" describes
the Secretary's discretion once a ground is established; it says nothing about
how much process preceded the finding. A conviction-based permissive exclusion
rides on a judgment entered by a court. A section 1128(b)(6) exclusion for
unnecessary services rides on a medical-review file assembled by the agency,
which, as of this month, may be the same agency that decides whether to
exclude.
The consequences are also worth stating plainly for the
non-lawyers. Exclusion is not revocation. Revocation under 42 C.F.R. § 424.535
removes a supplier's Medicare billing privileges and is appealed through the
enrollment track. Exclusion bars payment by every federal health care program
for any item or service furnished, ordered, or prescribed by the excluded
person; it lands the name on the public LEIE; it exposes any employer who bills
for the excluded person's work to civil monetary penalties; and it is appealed
through an ALJ and the Departmental Appeals Board under 42 C.F.R. Part 1005,
with judicial review after that. CMS has for years run a smaller version of
this, the Medicare Advantage and Part D preclusion list and a seldom-used set
of Part 402 exclusion grounds, but those were the minor leagues. Section
1128(b) is the real thing.
Exclusion is remedial, which is why the courts let it be
harsh
The foundational line of cases established that exclusion is
not punishment, and nearly every later doctrine depends on that
characterization.
The problem arose because excluded providers were often also
prosecuted, and after United States v. Halper (1989) it was briefly
fashionable to argue that a civil sanction imposed on top of a criminal
conviction was a second punishment. Dr. Manocchio, a physician who pleaded
guilty to filing a false Medicare claim and then received the mandatory
five-year exclusion, made exactly that argument. The Eleventh Circuit rejected
it in Manocchio v. Kusserow, 961 F.2d 1539 (11th Cir. 1992), holding
that exclusion serves to protect the programs and their beneficiaries from
untrustworthy providers rather than to punish, and so raises no double-jeopardy
problem. The Ninth Circuit reached the same conclusion from the ex post facto
direction in Travers v. Shalala, 20 F.3d 993 (9th Cir. 1994), where a
physician's offense predated the 1987 amendments that created the five-year
mandatory minimum; because the sanction was remedial, applying the longer term
to earlier conduct was permissible.
The remedial label did enormous work. It is why exclusion
need not be proportioned to culpability in the way a sentence must be, why it
can follow a conviction without constitutional objection, and why the
government may act before a full hearing. For CMS, the label is a gift and a
warning. It is a gift because an agency that excludes to protect beneficiaries
need not prove much about the provider's state of mind. It is a warning because
the remedial rationale has to be true in the individual case. Hanlester,
discussed below, is what happens when a court decides it is not.
No hearing first, usually
A second early cluster of cases settled that due process
does not generally require a hearing before exclusion takes effect, provided
the provider has notice, a chance to respond in writing, and a prompt hearing
afterward.
Ritter v. Cohen, 797 F.2d 119 (3d Cir. 1986),
involved a Pennsylvania physician suspended from Medicare on findings that he
had furnished excessive and unnecessary services. He argued that his livelihood
could not be taken without a prior evidentiary hearing. Applying Mathews v.
Eldridge, the Third Circuit held that written notice, an opportunity to
submit evidence and argument, and a post-suspension hearing were enough, given
the government's interest in stopping harm to patients and the program. Two
years later the Eighth Circuit faced the same argument from Dr. Ruben Thorbus,
a rural Minnesota physician whose clinic drew roughly sixty percent of its
patients from Medicare and Medicaid and whom federal medical reviewers accused
of performing excessive diagnostic endoscopies and delivering substandard care.
HHS imposed a five-year exclusion after he had an opportunity to respond, and
he sought a preliminary injunction to keep practicing while his administrative
appeal proceeded. Thorbus v. Bowen, 848 F.2d 901 (8th Cir. 1988),
affirmed the denial. The court found no likely due-process violation and, in
the balance of harms, put the risk to patients ahead of the physician's
financial and reputational loss, even in a community where he was one of few
available doctors.
Congress later carved out one important exception.
Exclusions under section 1128(b)(7), the ground for kickback and false-claims
conduct found administratively rather than by a court, do not take effect until
after a hearing, unless the Secretary determines that the provider's continued
participation poses a risk to health or safety. The distinction is sensible: a
conviction or license revocation has already been adjudicated somewhere,
whereas a (b)(7) exclusion asks the agency to prove the underlying violation
itself. CMS now holds (b)(7) authority, and if it is tempted to lean on the
health-or-safety override to skip the pre-exclusion hearing, the Thorbus
and Ritter line will be read against it: those courts tolerated speed
because the statute and regulations supplied prompt review afterward, not
because the agency's say-so about danger was self-validating.
"Related to" is capacious, but the length must
be explained
The most important modern appellate decision on permissive
exclusion is Friedman v. Sebelius, 686 F.3d 813 (D.C. Cir. 2012), and it
cuts both ways.
The facts are familiar to anyone who followed the opioid
litigation. Purdue Frederick had marketed OxyContin with claims that it was
less addictive and less prone to abuse than competing opioids. In 2007 the
company pleaded guilty to felony misbranding, and three senior executives, the
chief executive, the general counsel, and the chief medical officer, pleaded
guilty to misdemeanor misbranding under the responsible corporate officer
doctrine. That doctrine, which dates to Dotterweich and Park,
imposes liability on an officer who had authority to prevent or correct the
violation, without proof that he knew about it. OIG then excluded all three for
twelve years under section 1128(b)(1), which reaches misdemeanor convictions
"relating to" fraud in connection with the delivery of a health care
item or service.
The D.C. Circuit answered two questions. First, was a
strict-liability misdemeanor "related to" fraud? Yes. The court read
the phrase broadly: the conduct underlying the conviction was fraudulent
misbranding, and the executives' pleas admitted a relationship to it, even
though their own offense required no fraudulent intent. That holding gives the
government a long reach; it means an executive can be excluded for a crime that
required nothing more than being in charge. Second, was twelve years lawful?
Not as explained. OIG had never before imposed anything close to that length on
individuals in comparable circumstances, and the agency's decision did not
grapple with its own prior practice. Under ordinary administrative-law
principles, an agency may change course, but it must acknowledge that it is
doing so and say why. The court vacated the twelve-year term and remanded; the
executives ultimately received substantially shorter exclusions.
For CMS, Friedman is the case to tape to the wall.
The agency arrives with a mandate, voiced by the Secretary in July and in the
delegation notice itself, to remove bad actors more aggressively than OIG has.
Nothing in section 1128 forbids that. But the baseline against which any CMS
exclusion will be measured for arbitrariness is OIG's forty-year corpus of
decisions, aggravating and mitigating factors at 42 C.F.R. §§ 1001.102 and
1001.201, and the Board's settled rule that an ALJ reviews the length of a
permissive exclusion for reasonableness rather than substituting his own
judgment. Because the delegation withholds rulemaking, CMS cannot write itself
a new set of factors; it must apply OIG's, and it must explain any departure
from how OIG has applied them. A payer that wants to signal toughness by
handing out fifteen-year exclusions for conduct OIG historically treated with
five will be writing briefs for the D.C. Circuit.
When exclusion stops being remedial: the laboratory case
Hanlester Network v. Shalala, 51 F.3d 1390 (9th Cir.
1995), is the decision diagnostics people already know, usually for its
(since-overruled) holding on anti-kickback intent. Its exclusion holding
deserves more attention than it gets.
Hanlester Network organized three clinical laboratory joint
ventures in California, selling limited-partnership interests to physicians who
were, not coincidentally, in a position to refer specimens. SmithKline
BioScience Laboratories managed the labs and performed most of the testing
under contract. A Hanlester marketing agent told physician investors, in
substance, that their returns would track their referrals. The Inspector
General found anti-kickback violations and sought permissive exclusions under
section 1128(b)(7) against the network, the three joint-venture laboratories,
and several individuals.
The Ninth Circuit affirmed that the entities had violated
the statute, through the agent's conduct, on a theory of vicarious liability.
It then reversed the exclusions. The court's reasoning was the remedial
rationale turned around and pointed at the government: exclusion exists to
protect the programs from providers who are likely to cause future harm, the
entities' culpability was derivative of an agent who had long since departed,
and there was no evidence on the record that they remained untrustworthy. A
violation had occurred; exclusion was still unwarranted.
Two cautions. The intent holding in Hanlester, which
required proof that the defendant knew the conduct was unlawful and
specifically intended to violate the statute, was legislatively displaced in
2010 when the ACA added section 1128B(h). And Hanlester does not stand
for the proposition that firing the salesman cures the company; its outcome
depended on a thin record of ongoing risk. But the structural point survives:
the statutory ground and the remedial justification are separate inquiries, and
a court will police the second. For CMS, which will often be acting on data
showing that a laboratory or a physician billed aberrantly in 2024, the
question a reviewing tribunal will ask is whether that history establishes
untrustworthiness now.
The grounds CMS is best positioned to use, and least
tested in using
The delegation notice says CMS is "uniquely positioned
to investigate, identify, and develop the evidentiary basis" for
permissive exclusions. That is true, and it is also the problem. The grounds
where CMS's data advantage is greatest are precisely the ones with the thinnest
case law.
Section 1128(b)(6)(B), unnecessary or substandard services,
is the Thorbus ground, and Thorbus is a preliminary-injunction
decision about interim relief, not a merits ruling about how many unnecessary
endoscopies make a pattern. Section 1128(b)(6)(A), charges substantially in
excess of usual charges, has never been defined; OIG proposed a rule in 2003
and withdrew it in 2007 after concluding it could not draft a workable
definition, and the ground has lain largely dormant since. A payer that sets
its own fee schedule and then excludes a laboratory for charging
"substantially in excess" of its usual charges would be testing a
provision that has no appellate gloss at all. Section 1128(b)(16), false
statements in enrollment, is new enough that the Board's decisions are sparse,
and CMS already revokes enrollment on the same facts under section 424.535(a)(4);
the delegation lets it convert an enrollment dispute into a program-wide bar
with a different appeal track and far heavier collateral consequences. Section
1128(b)(15), reaching owners and officers of excluded entities, invites exactly
the kind of derivative-liability exclusion that Hanlester reversed.
None of this means CMS lacks authority. It means CMS will be
making law in areas where OIG, for whatever mix of prudence and caseload, chose
not to.
What the cases, read together, tell a new enforcer
Three threads run through the decisions. The statutory
ground must be established as written, and the courts have read "related
to" generously but have not read it to swallow the enumerated list. The
decision to exclude, and the length of exclusion, must be justified on the
record as protective rather than punitive, and must be consistent with the
agency's own prior practice or explain the inconsistency. And the timing of
review is fixed by the statute: ordinarily after the fact, with the (b)(7)
pre-exclusion hearing as the exception, and with district courts disinclined to
enjoin exclusions in the interim.
The institutional novelty is that these constraints were
developed with OIG as the respondent, an office whose culture is prosecutorial
and whose exclusion docket has been dominated by convictions and license
losses, grounds where someone else did the fact-finding. CMS is a payer. Its
instinct is to act on claims data, its grievance is overpayment, and its new
authority is unaccompanied by new regulations, new hearing procedures, or any
public statement about how it will coordinate with OIG, honor OIG's exclusion
waivers in False Claims Act settlements, or treat entities already operating
under corporate integrity agreements. The delegation notice resolves none of
this and, in withholding rulemaking and hearings, suggests the Secretary did
not intend it to.
The case law will not stop CMS from excluding anyone. It
will insist that CMS do what OIG has had to do: name the ground, prove it,
explain the term, and be prepared to defend the exclusion as something other
than a sanction for having annoyed the payer. Friedman and Hanlester
were both decided against an agency that had been doing this for decades. The
first several CMS exclusions to reach the Board, and the first to reach a
circuit, will tell us whether the statute's accumulated discipline transfers
with the delegation or whether, as the Secretary's July remarks implied, the
point of a second hand on the lever was to pull it harder.
Sources
- HHS Statement of Delegation of Authority, 91 Fed. Reg.
65219 (Oct. 14, 2026), as summarized by AAPC
- Sidley Austin, HHS Secretary Extends HHS-OIG Exclusion
Authority to CMS
- Morgan Lewis, Health Law Scan: HHS Secretary Delegates
Permissive Exclusion Authority to CMS
- Hyman Phelps & McNamara, FDA Law Blog: CMS Gains
Permissive Exclusion Authority
- Case
citations are to the reporters as noted in the text. Ritter and Travers
are described from the author's reading rather than re-pulled opinions; a
cite-check before publication is advised.