More control, broader consequences: CMS’s fraud defense RFI and new exclusion authority

CMS is considering changes to its fraud-investigation contractors at the same time it is acquiring authority to exclude providers from federal healthcare programs. Providers and their counsel should be looking at these developments together.

On October 5, 2026, CMS issued a Request for Information (RFI) concerning future “Fraud Defense Contracts.” The proposed direction would give CMS greater responsibility for developing leads, setting investigative priorities, and directing work now performed by Unified Program Integrity Contractors. Nine days later, HHS formally delegated permissive exclusion authority to CMS under § 1128(b) of the Social Security Act. OIG retains its authority as well.

The concern is straightforward: CMS could have more control over how an investigation develops and greater authority to act on its findings. Before that structure takes shape, providers deserve a clear explanation of how unsupported findings will be challenged and corrected.

Possible changes from the RFI

Unified Program Integrity Contractors (UPICs) are private contractors hired by CMS to investigate suspected fraud, waste, and abuse in Medicare and Medicaid. They work on the federal government’s behalf under CMS oversight, but they are not government agencies or law-enforcement authorities. Unlike routine claims reviews focused on whether particular services meet payment requirements, UPIC investigations can involve broader scrutiny of a provider’s billing patterns and operations. UPICs identify potential problems, investigate leads received from CMS and other sources, and develop cases that may support payment suspensions, other administrative actions, or referrals to law enforcement. A UPIC investigation does not, by itself, establish that a provider committed fraud.

Proposed changes

The RFI proposes giving CMS a larger role in selecting and directing fraud investigations, while asking whether the current contractor structure should be reorganized. Its draft Statement of Objectives describes the investigative work future contractors would perform; the accompanying questionnaire seeks feedback on how that work should be divided, supervised, and paid for. The principal proposals and questions include:

• CMS-led investigative priorities. Under the draft model, CMS would take primary responsibility for proactive analysis, lead generation, prioritization, and law-enforcement vetting. Contractors would focus on developing CMS-assigned investigations. They could still identify potential leads, but opening those investigations would be subject to CMS review and direction.
• Changes to division of contractor responsibilities. CMS asks whether functions such as medical review, law-enforcement assistance, and site verification should remain together or be centralized or assigned separately. It also seeks input on reducing delays and other problems when matters move among UPICs, Medicare Administrative Contractors, and other review contractors.
• Changes to geographic jurisdictions and specialty expertise. CMS asks whether national contractors focused on particular provider types would be preferable to, or should supplement, geographically organized contractors. It also seeks feedback on jurisdictional boundaries and the field presence needed to conduct investigations. These are only options under consideration.
• Reconsideration of contractors covered programs. The draft Statement of Objectives focuses on Medicare, while the questionnaire separately explores future Medicaid program-integrity arrangements and whether Medicare Advantage and Part D investigations should be integrated with fee-for-service investigations. CMS has not announced a final decision to separate or combine those responsibilities.
• Different contractor payment arrangements and performance measures. CMS seeks feedback on fixed-price, fixed-unit-price, and hybrid contracts, including which investigative activities can reasonably be priced that way. It also asks how to avoid incentives that reward the volume of investigations, referrals, or administrative actions rather than the quality of the work.
• Requirements for investigative technology and oversight. CMS asks about analytics, artificial intelligence, model validation, explicability, human review, and government access to contractor-developed tools. The draft also contemplates CMS approval before contractors use non-approved analytical tools, external data resources, AI, or automation.

The RFI would not change the legal grounds for suspending payments, revoking enrollment, or excluding a provider. It could change who develops the allegations supporting those actions and who has authority to reconsider them. Under a more CMS-directed model, the contractor reviewing a provider’s records may not be the decision-maker who selected the investigative target or approved the scope. The final structure should make clear who can narrow or close an investigation when the evidence does not support its premise.

The questions about specialty contractors, separate review functions, and compensation also have practical consequences. Specialized review could improve accuracy, while additional handoffs could cause qualifications or contrary evidence to be lost. Different payment arrangements could affect the resources devoted to complex cases. CMS’s questionnaire recognizes part of that concern by asking how to avoid rewarding the volume of investigations, referrals, and administrative actions over their quality. Appropriate case closure and correction of errors should count as successful performance, too.

Larger impact with CMS’s new exclusion authority

The impact of the RFI may be compounded coming off the heels of HHS formally delegated permissive exclusion authority under § 1128(b) of the Social Security Act to CMS on October 14, 2026, following its July announcement. OIG retains its existing authority. HHS describes the change as aligning “investigative and enforcement responsibilities within a single operating division.”

CMS could assume more responsibility for selecting and directing investigations while also deciding whether the resulting evidence supports exclusion. Exclusion is distinct from Medicare enrollment revocation and carries broader federal healthcare program consequences. Several permissive exclusion grounds do not require a criminal conviction, although each has specific statutory requirements. A disputed audit finding does not automatically establish those requirements.

The question is whether CMS has the capacity to exercise these responsibilities with the scrutiny they require.

CMS capacity

That uncertainty matters because the proposal would make contractors more dependent on CMS decisions. The questionnaire recognizes this by asking what approvals, decision timelines, and data access CMS must provide for contractors to perform effectively.

Selecting a provider for investigation is only the beginning. Determining whether an unusual billing pattern reflects improper claims may require clinical review, knowledge of a particular payment rule, and consideration of the provider’s patient population. CMS must have the resources to evaluate that information and not simply identify the initial concern. The risk is not necessarily random selection. It is that the system may identify potential targets faster than it can distinguish legitimate variation from improper billing and resolve unsupported cases.

Regulatory hearing process

Delays in reconsidering an investigative premise become more consequential when findings may support a payment suspension, enrollment revocation, or exclusion recommendation. These actions have different legal requirements. A more centralized investigative process must preserve those distinctions rather than allow an initial allegation to become the accepted basis for each successive action while also essentially making the process almost impenetrable and inaccessible, with the contractors being but mere paper pushers to CMS.

The exclusion delegation does not eliminate procedural protections. Section 1128(f) preserves notice, hearing, and judicial-review rights. For § 1128(b)(7) exclusions, it generally provides an opportunity for an ALJ hearing before exclusion takes effect, subject to the statutory health-or-safety exception. The delegation also excludes authority to conduct hearings or issue regulations.

Those protections are important, but they do not resolve the operational question: Who will assess the provider’s evidence before CMS pursues an action, and will that person have the time, expertise, and authority to reject an unsupported finding?

Room for improvement

CMS should explain how it will staff the decisions it proposes to retain, establish response timelines when contractors need direction, and identify who may narrow or close an investigation. It should also describe the review contractor findings will receive before supporting an exclusion recommendation, including how contrary evidence and unresolved clinical or legal objections will be considered.

Greater CMS involvement could improve consistency and coordination. But reserving more decisions to CMS without sufficient capacity could leave providers caught between a contractor carrying out an assignment and an agency that has not reconsidered it. The final structure should make correcting an unsupported allegation at least as workable as opening the investigation.

CMS issued the RFI on October 5, 2026, and is accepting responses through November 4, 2026, at 11:00 a.m. EST. The 30-day response period gives interested vendors an opportunity to address both the proposed operating model and the practical requirements for implementing it. Responses must use CMS’s designated Interested Vendor Response form.