Industry Waiting for Clarity over Delegation of OIG Authorities
(Posted Oct. 19, 2026, on LinkedIn)
BOSTON – The news that the Centers for Medicare & Medicaid Services now has authority to exclude life science entities from federal health programs wasn't entirely unexpected, thanks to hints dropped by HHS in July 2026. However, Chris White, general counsel at the Advanced Medical Technology Association (AdvaMed), said the HHS notice in the Oct. 14 issue of the Federal Register is short on detail and hence industry is not clear on precisely how this delegation will work in practice.
The question of this delegated authority for CMS came up during the AdvaMed press briefing at the 2026 episode of the MedTech Conference, taking place Oct. 19-21 in the city nicknamed the Athens of America. The formal announcement of this delegation was foreshadowed when HHS Secretary Robert F. Kennedy, Jr., announced July 21 that HHS would grant CMS this permissive exclusion authority, which was previously the sole domain of the HHS Office of Inspector General (OIG).
Permissive exclusion differs from mandatory exclusion, which is stipulated when the individual or company is convicted of a felony while permissive exclusion is invoked in instances of violations of the civil rather than the criminal code. Fraud has been a consistent theme for HHS and the Department of Justice for a number of years, but the massive abuse of federal health program coverage of skin substitutes has lent the cause new energy. The skin substitutes episode amplified existing concerns over fraud to stimulate a number of developments, such as the formation of a national fraud detection office that is focused on fraud generally, but which is widely construed to be especially pertinent to healthcare fraud.
White said the delegation of exclusion authorities to CMS “is something we've been tracking very closely,” adding that industry is concerned that this kind of functional duplication between OIG and CMS could create problems. He pointed out that there is no detail as to how corporate integrity agreements (CIAs) would be handled, or even whether CMS would issue CIAs.
Another interesting wrinkle is that Section 1128(f) of the Social Security Act seems to stipulate that OIG handle any related investigations, seemingly to the exclusion of CMS. AdvaMed's White raised the question of whether CMS possesses the resources to administer these exclusion cases even if not tasked with any related investigations, not an unusual point given the agency's backlog of requests for national coverage determinations.
Whether CMS will engage in any kind of rulemaking to enact this authority is unclear, but the Administrative Procedures Act (APA) does not seem to stipulate that CMS do so. Indeed, the U.S. Code explicitly states that the general requirements for rulemaking do not apply “to interpretive rules, general statements of policy, or rules of agency organization, procedure or practice.” Affected parties will have to wait for CMS to provide additional insight as to how it will deploy this new authority, assuming any is forthcoming; sub-regulatory guidance may be the vehicle by which the agency chooses to provide that clarity.
Tariff picture still cloudy, but predictability the imperative
AdvaMed President/CEO Scott Whitaker said during the Oct. 19 press briefing that the biggest issue for the med tech industry is “the growing disconnect in how policymakers see our industry and how patients see our industry.” He referenced the growing conversation about prevention of disease, but the fact that prevention can't address all eventualities is “a theme you'll hear from a lot of us going forward,” he stated.
Whitaker said the tariff problem will be front and center for AdvaMed until it's settled, but said predictability is the most important aspect of the tariff situation. “We can manage to a number” so long as the number isn't irrationally high, he added.
Becton Dickinson (BD) announced Oct. 6 that it has negotiated a tariff exclusion deal with the federal government that would shield imported BD products from tariffs under Section 232 of the Tariff Act. In return, the company will invest $22 billion in U.S.-based facilities and operations, $3 billion of which will be directed toward manufacturing infrastructure. Whitaker said many of the details of this BD-Uncle Sam handshake are not well understood, but said industry as a whole deserves credit for the fact that 70% of med tech used in the U.S. is also manufactured in the U.S.
Cybersecurity is another resurgent issue that is particularly keenly felt for connected medical devices, especially given the recent news regarding a Beantown home team, Boston Scientific. There have been calls on the federal government to provide more cybersecurity aid to U.S. companies, given that many of these hackers are state-based entities with significantly greater resources than private-sector entities in the U.S. are able to match.
“I would say they need to lean in on collaboration,” Whitaker said regarding federal government involvement, adding that cybersecurity is a national security issue as well as a patient safety issue. The federal government can help with information and intelligence sharing, along with broad guidance and direction, hopefully without creating oversight that is duplicative of FDA's oversight. Whitaker remarked that either way, cybersecurity will continue “to be a challenge in the coming years.”
