CMS Gains Permissive Exclusion Authority: Implications for Pharma and Medical Device Companies

On October 14, 2026, HHS Secretary Robert F. Kennedy, Jr. formally delegated to the CMS Administrator the Secretary’s permissive exclusion authority under Section 1128(b) of the Social Security Act, effective immediately.  See Federal Register Notice here.  Section 1128(b) allows the government to prohibit companies and individuals convicted of certain offenses, including violations of the Federal Food, Drug, and Cosmetic Act, from participating in federal healthcare programs that cover pharmaceutical drugs and medical devices.  This new delegation of authority to CMS does not disturb the authority previously delegated to the HHS Office of Inspector General (HHS OIG), which has exercised this authority solo for almost four decades.  Now, CMS and HHS OIG hold co-equal authority to permissively exclude companies from participating in Medicare and Medicaid programs.

Impact to Our Clients

For medical device and pharmaceutical manufacturers, this new power sharpens the risk calculus around False Claims Act resolutions. FCA cases affecting the life sciences industry frequently rest on FDA-regulated conduct — off-label promotion, GMP failures, misbranding or adulteration, speaker-program kickbacks, and failures to report adverse events — and convictions for this conduct map onto the Section 1128(b) grounds for permissive exclusion.

So. Many. Questions.

Historically, companies faced with an FCA settlement secured a release of HHS OIG’s permissive exclusion authority by entering into a corporate integrity agreement (CIA) with HHS OIG.  CMS has never been a signatory to those CIAs, so it is unclear whether a separate agreement is needed, or whether HHS OIG and CMS will collaborate on a single CIA.  Assuming a single CIA, it begs the question of which agency would be responsible for monitoring compliance to the CIA terms, and whether a company would have reporting obligations to both agencies and under what terms.  Another wrinkle is mandatory exclusion authority, which was not delegated to CMS and therefore remains the exclusive province of HHS OIG.  It would be a nightmare scenario for a company to be stuck between HHS OIG insisting on mandatory exclusion, while CMS argues that permissive exclusion is warranted.

What to Watch

Life sciences companies facing FDA enforcement or qui tam exposure should watch for guidance coming from CMS and HHS OIG clarifying the coordination and collaboration activities between these two offices.  In the meantime, companies engaged in pending government investigations should revisit current settlement strategy, CIA scope, and reserved-rights language.