A Medicare payment suspension and exclusion are two different federal enforcement actions that can end a healthcare career, and they come from two different agencies. The Centers for Medicare & Medicaid Services (CMS) uses payment suspensions to freeze money going out to a provider while it investigates suspected overpayments or fraud. The Office of Inspector General (OIG) uses exclusions to bar a provider from every federal healthcare program for a set number of years. Both are administrative rather than criminal, but the financial fallout can be worse than a fine.
What Triggers a Payment Suspension
CMS or a Medicare Administrative Contractor (MAC) can freeze payments when it has reliable evidence that a provider received overpayments or that future payments may be incorrect.1eCFR. 42 CFR 405.371 – Suspension, Offset, and Recoupment of Medicare Payments to Providers and Suppliers of Services The common triggers are billing for services never delivered, misrepresenting the care provided, and coding patterns that go beyond honest mistakes.
The most powerful trigger is a “credible allegation of fraud,” defined as an allegation that has been verified and carries some indication of reliability. It can come from a law enforcement investigation, a fraud hotline tip backed by other evidence, claims data mining, or patterns spotted during an audit.2eCFR. 42 CFR 455.2 – Definitions The fraud label matters because it changes how long the suspension can last.
A suspension can also hit without any fraud allegation. If a provider fails to hand over documentation the MAC needs to verify claims, the contractor can halt payments immediately, and the usual advance notice requirement does not apply.3eCFR. 42 CFR 405.372 – Proceeding for Suspension of Payment Ignoring an audit request is one of the fastest ways to lose your revenue stream.
How the Suspension Works
The provider normally receives a written notice explaining the reasons and the effective date. The MAC then intercepts incoming claims and places the funds in a holding account. If the investigation clears the provider, the money is released. If it confirms overpayments, the held funds are applied against the debt.
After the notice arrives, a provider has at least 15 days to submit a rebuttal arguing that the suspension should be lifted or modified.3eCFR. 42 CFR 405.372 – Proceeding for Suspension of Payment The suspension typically takes effect on the date stated in the notice whether or not you file a rebuttal, so treat the notice as urgent.
How Long a Suspension Lasts
The general cap is 180 days. Investigators who need more time can request a single 180-day extension, bringing the maximum to roughly one year for non-fraud cases.3eCFR. 42 CFR 405.372 – Proceeding for Suspension of Payment
Fraud-based suspensions play by different rules. When the suspension rests on credible allegations of fraud, the 180-day cap and the one-time extension do not apply. CMS instead reviews the suspension every 180 days, evaluates whether good cause exists to continue it, and asks law enforcement to certify that the investigation is still active.4eCFR. 42 CFR 405.371 – Suspension, Offset, and Recoupment of Medicare Payments to Providers and Suppliers of Services As long as the investigation continues, so can the suspension. Complex cases can keep payments frozen for well over a year.
Interest on Confirmed Overpayments
If the investigation confirms overpayments, interest accrues on the debt. As of April 2026, the Medicare overpayment interest rate is 11.375 percent.5Centers for Medicare & Medicaid Services. Notice of New Interest Rate for Medicare Overpayments and Underpayments – 3rd Quarter Notification for FY 2026 The rate is recalculated quarterly and typically runs well above commercial lending rates, so unresolved overpayments grow quickly.
The 60-Day Overpayment Return Rule
This is where many providers get into trouble they never saw coming. Federal law requires anyone who receives a Medicare overpayment to report and return it within 60 days of identifying it, or by the date any applicable cost report is due, whichever is later.6Office of the Law Revision Counsel. 42 USC 1320a-7k – Medicare and Medicaid Program Integrity Provisions “Identified” is defined broadly: you have identified an overpayment when you knowingly receive or retain one, using the same “knowingly” standard from the False Claims Act.7eCFR. 42 CFR 401.305 – Requirements for Reporting and Returning of Overpayments
Miss the deadline and the retained money becomes an “obligation” under the False Claims Act, opening the door to treble damages and per-claim penalties far exceeding the original overpayment.6Office of the Law Revision Counsel. 42 USC 1320a-7k – Medicare and Medicaid Program Integrity Provisions A provider who spots billing errors during an internal audit cannot sit on the findings while deciding what to do. The clock starts the moment you know, or should know, the money was not yours.
Mandatory Exclusion From Federal Healthcare Programs
Exclusions are governed by a separate statute and administered by the OIG. Mandatory exclusions leave the agency with no discretion. The law requires removal from every federal healthcare program when certain criminal convictions occur, in four categories:8Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs
- Any conviction for a criminal offense connected to delivering an item or service under Medicare or a state healthcare program.
- Any conviction for patient neglect or abuse in connection with healthcare delivery.
- A felony conviction for fraud, theft, embezzlement, or other financial misconduct connected to a healthcare program.
- A felony conviction for unlawfully manufacturing, distributing, prescribing, or dispensing a controlled substance.
Every mandatory exclusion carries a minimum of five years. The OIG can go longer based on aggravating factors, but it cannot go shorter. A narrow waiver exists for a sole community physician or sole source of essential specialized services, but only at the program administrator’s request and after consulting with the OIG.
The definition of “convicted” is deliberately broad. It includes guilty pleas, no-contest pleas, and participation in deferred adjudication or first-offender programs where the court withheld a formal judgment.8Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs Providers who negotiate deferred adjudication in criminal court sometimes believe they avoided a conviction. Under federal healthcare law, they did not.
Permissive Exclusion
Permissive exclusions are judgment calls the OIG makes based on the facts rather than actions required by statute. Common grounds include misdemeanor convictions for healthcare fraud, theft, or financial misconduct; misdemeanor controlled substance convictions; state license revocations or suspensions; and failure to provide care that meets professionally recognized standards.8Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs
The default term is three years. The OIG can shorten it for mitigating circumstances or lengthen it for aggravating ones such as prior offenses, high dollar amounts of harm, or conduct that continued over an extended period. Even three years away from every federal program is enough to destroy most practices.
What an Exclusion Actually Blocks
An OIG exclusion does not just cut off Medicare billing. It bars participation in every federal healthcare program, including Medicaid, TRICARE, and the Veterans Affairs system.9Office of Inspector General. Special Advisory Bulletin on the Effect of Exclusions From Participation in Federal Health Programs No federal dollars can pay for any item or service the excluded person furnishes, orders, or prescribes, regardless of who submits the claim.
The prohibition reaches beyond direct patient care. An excluded person cannot hold an administrative or management role at a healthcare organization if federal program funds cover any portion of their salary, expenses, or benefits. The OIG has specifically named billing agents, claims processors, accountants, utilization reviewers, and administrative staff as roles caught by the exclusion when the employer receives federal healthcare reimbursement.9Office of Inspector General. Special Advisory Bulletin on the Effect of Exclusions From Participation in Federal Health Programs In practice, most healthcare employers simply cannot hire an excluded person in any capacity.
The downstream effect catches employers off guard. If an excluded physician orders a lab test, the lab that performs it cannot be reimbursed. Healthcare organizations that knowingly employ or contract with an excluded person face civil monetary penalties of up to $25,595 for each item or service the excluded person furnishes and that gets billed to a federal program, plus an assessment of up to three times the amount claimed.10Federal Register. Annual Civil Monetary Penalties Inflation Adjustment The organization itself can also be excluded. That is why the OIG maintains the List of Excluded Individuals/Entities (LEIE) as a public, searchable database, and why employers are expected to screen all employees and contractors against it regularly.11Office of Inspector General. Exclusions
Challenging an Exclusion
A provider who receives an exclusion notice has 60 days from the date of receipt to request a hearing before an Administrative Law Judge.12eCFR. 42 CFR Part 1001 Subpart E – Notice and Appeals The hearings are adversarial, may involve expert testimony, and can be held in person or by video.13U.S. Department of Health & Human Services. Appeals to DAB Administrative Law Judges (ALJs) Miss the 60 days and you forfeit the right to a hearing.
If the ALJ rules against the provider, the next step is an appeal to the HHS Departmental Appeals Board. After the DAB issues a final decision, the provider can seek judicial review in federal district court.14Office of Inspector General. Background Information and Exclusion Authorities Expect the administrative process to take many months. The exclusion stays in effect the whole time.
Self-Disclosure Before the Government Finds You
Providers who discover potential fraud internally can report it voluntarily through the OIG’s Provider Self-Disclosure Protocol. The main benefit is avoiding the cost and disruption of a government-directed investigation. The SDP is open to healthcare providers, suppliers, and other individuals subject to the OIG’s civil monetary penalty authorities.15Office of Inspector General. Health Care Fraud Self-Disclosure
There is no fixed formula for the resolution. The OIG determines appropriate damages case by case based on the specific facts. Self-disclosure does not guarantee leniency, but it signals good faith and tends to produce outcomes less severe than what follows a government-initiated investigation. Providers already operating under a Corporate Integrity Agreement must contact their OIG monitor before submitting a self-disclosure.
Corporate Integrity Agreements as an Alternative to Exclusion
When a healthcare entity settles a federal fraud investigation, the OIG often negotiates a Corporate Integrity Agreement (CIA) in place of exclusion. A CIA is a detailed compliance contract: the entity agrees to overhaul its internal controls in exchange for staying in business.16Office of Inspector General. About Corporate Integrity Agreements The standard term is five years.
A typical CIA requires a dedicated compliance officer, a compliance committee, written policies, employee training, a confidential disclosure program, LEIE screening, and an Independent Review Organization that audits claims on an ongoing basis.17Office of Inspector General. Corporate Integrity Agreement FAQs CIAs include breach and default provisions that let the OIG impose stipulated monetary penalties for noncompliance, and a material breach is itself an independent basis for exclusion.16Office of Inspector General. About Corporate Integrity Agreements
Reinstatement Is Not Automatic
When the exclusion period ends, the provider is not automatically back in. Reinstatement requires a written application to the OIG.18Office of Inspector General. Applying for Reinstatement Getting a new provider number from a Medicare contractor or state program does not restore eligibility, and acting on that misconception creates fresh violations.
The OIG looks at whether the applicant has had any new legal issues, whether all terms of prior sentencing have been fulfilled, and whether the applicant holds a current professional license. If the request is granted, the OIG sends a formal written reinstatement notice. Only then can the provider re-enroll and start billing federal programs again. Furnishing services before the reinstatement letter arrives creates further exposure.
If the OIG denies the application, the provider has 30 days to submit additional evidence and arguments, including a written request for oral argument before an OIG official.19eCFR. 42 CFR 1001.3004 – Denial of Request for Reinstatement If the denial holds, no new application can be filed for at least one year. Unlike the underlying exclusion decision, a reinstatement denial is not subject to administrative or judicial review.