Earlier this year, the federal government promised a sweeping crackdown on fraud, waste, and abuse in the healthcare industry. That promise is now taking shape through a series of concrete enforcement actions, with the Centers for Medicare & Medicaid Services (“CMS”) at the center.
Recently, the U.S. Department of Health & Human Services (“HHS”) and CMS deferred more than $1 billion in federal Medicaid payments to California and Minnesota—approximately $867.5 million and $199 million, respectively—pending a review of high-risk claims.[1] That same day, HHS Secretary Robert F. Kennedy Jr. (“Secretary Kennedy”) made a second, less publicized (but potentially more significant) announcement that he was delegating to CMS the authority to exclude individuals and entities from federal healthcare programs, an authority that had historically belonged exclusively to the HHS Office of Inspector General (“OIG”).[2]
Taken together, these actions suggest CMS is expanding beyond its traditional role of administering the Medicare and Medicaid programs and is positioning itself as a frontline enforcer, with both greater financial leverage and a meaningful role in removing providers from federal programs.
The California and Minnesota Payment Deferrals
In late July 2026, CMS deferred approximately $867.5 million in federal Medicaid payments to California after focused financial reviews flagged spending growth in certain in-home care programs and other claims that far exceeded national trends. Similarly, across the country, CMS deferred approximately $199 million in Minnesota payments after reviewing claims in 14 high-risk service areas, identifying expenditures linked to providers flagged through program integrity reviews and other claims with potential eligibility or billing concerns.
Dr. Mehmet Oz, CMS Administrator, explains that CMS is “done trying to chase down stolen and misused funds after they’ve already left the building,” and CMS is now deferring payments with respect to certain high-risk services within Medicaid programs as part of “[CMS’s] new approach to program integrity.”[3] In support of Dr. Oz’s and CMS’s deferrals, Secretary Kennedy stated, “States that receive federal Medicaid funding must demonstrate that every dollar meets federal requirements. When they cannot, we will not release federal funds until they do.”[4]
Deferral vs. Payment Cut: What This Means for the States
Secretary Kennedy’s quote encapsulates how the CMS deferrals work. Rather than making broad, permanent payment cuts, CMS is instituting a document-driven, temporary payment deferral tied to high-risk claim categories. Thus, if a state’s funding is deferred, like California or Minnesota, the state will have the opportunity to submit documentation showing how the claims meet federal Medicaid requirements. Once adequate support is submitted, the funds will be released.
These payment deferrals are likely a practical tool to help limit waste and fraud while not completely cutting off funding. However, some providers and stakeholders are concerned these payment deferrals could also lead to cash-flow disruptions for legitimate claims and place additional burdens on state Medicaid agencies by requiring further supporting documentation for claims in higher-risk categories.
CMS’s New Exclusion Authority: A Potentially Bigger Development
While CMS was deferring payments to California and Minnesota, Secretary Kennedy was also announcing his plans to delegate to CMS the “exclusion authority” previously within the exclusive domain of HHS-OIG, granting CMS the power to exclude individuals and entities from participation in federally funded healthcare programs.[5] With this expansion of authority, Secretary Kennedy states that now both CMS and HHS-OIG “will be able to use that authority to remove bad actors from federal health care programs and in many cases to permanently ban them from returning.”[6]
How Exclusion Authority Has Traditionally Worked
Exclusion is not something to take lightly, and until now, Congress had granted only HHS-OIG this exclusion authority. For HHS-OIG, exclusion is a harsh tool often used in conjunction with the U.S. Department of Justice to combat fraud, abuse, and certain healthcare violations by preventing providers from participating in federally funded healthcare programs individually and through future-formed corporate entities or employment arrangements. Once excluded, parties cannot receive payment from federal healthcare programs, meaning they cannot bill or be paid by Medicare or Medicaid. Between just October 2025 and March 2026, HHS-OIG excluded 1,212 individuals and entities, generating $5.56 billion in monetary impact and more than $447 million in potential cost savings.[7]
What Changes Now That CMS Shares This Power
Although no guidance or details have been released with respect to the extent and scope of CMS’s new authority, HHS Inspector General T. March Bell described the HHS delegation to be “a force multiplier” aimed to create “additional momentum.”[8] Yet, despite the apparent clear goal for the use of the exclusion authority, several questions remain with respect to how that goal will be accomplished. For example—how will CMS and HHS-OIG divide responsibilities? How will this new authority interact with CMS’s existing Medicare enrollment revocation authority? Will CMS’s involvement help facilitate or delay False Claims Act settlements? Or, what due process would apply to a CMS-initiated exclusion?
What This Means for Healthcare Providers
In line with the government’s “crackdown on fraud,”[9] CMS’s execution of the exclusion authority may expand the government’s overall enforcement capacity and increase the total number of exclusion actions pursued. Moreover, even if CMS does not enforce its new exclusion authority, providers and state agencies should be wary of payment deferrals and requests for supporting documentation, like those seen in California and Minnesota.
Thus, even without clear guidance on how CMS will exercise its new exclusion authority, providers should prepare for a more aggressive and unfamiliar enforcement environment. In particular, providers should expect the possibility of exclusions by CMS and HHS-OIG based on the same underlying conduct, along with increased enforcement activity and potential payment deferrals. Providers with significant Medicare or Medicaid participation should consider taking a fresh look at their compliance programs, fraud-and-abuse controls, and risk-assessment processes. In short, CMS’s heightened scrutiny of Medicaid claims, renewed focus on program integrity, and expanded exclusion toolkit mean providers and state agencies alike should prioritize strong documentation practices, compliance readiness, and proactive risk assessment now.
FOOTNOTES
[1] Press Release, U.S. DEP’T OF HEALTH & HUMAN SERVS., HHS Defers More Than $1 Billion in Medicaid Payments to California, Minnesota Pending Review of High-Risk Claims in Crackdown on Fraud (July 21, 2026), https://www.hhs.gov/press-room/hhs-defers-medicaid-payments-california-minnesota-fraud-review.html.
[2] HHS Secy. Kennedy, Dr. Oz, and Others News Conference on Combating Fraud, C-SPAN (July 21, 2026), https://www.c-span.org/program/news-conference/hhs-secy-kennedy-dr-oz-and-others-news-conference-on-combating-fraud/683173.
[3] HHS Defers More Than $1 Billion, supra note 1.
[4] Id.
[5] HHS Secy. Kennedy, Dr. Oz, and Others News Conference on Combating Fraud, supra note 2.
[6] Id.
[7] Semiannual Report to Congress: October 1, 2025–March 31, 2026, OFF. OF INSPECTOR GEN., U.S. DEP’T OF HEALTH & HUM. SERVS., (Spring 2026), https://oig.hhs.gov/documents/sar/11794/Spring_2026_SAR.pdf.
[8] HHS Secy. Kennedy, Dr. Oz, and Others News Conference on Combating Fraud, supra note 2.
[9] See HHS Defers More Than $1 Billion, supra note 1.