A three-physician pediatric practice hired a medical assistant in February. She started rooming patients the following Monday. In May, a payer credentialing packet asked the practice to attest that no employee was excluded from federal health care programs. The office manager ran the new hire's name through the OIG database for the first time and found a match: a 2022 exclusion tied to a Medicaid conviction in another state. By then the assistant had given roughly 300 vaccines and injections that the practice had billed to Medicaid and Medicare.
That is the situation OIG exclusion screening exists to prevent, and the practice had done nothing unusual. Most independent practices we work with screen at hire, if at all, and never again. The rule is simple and the consequences are not: no federal health care program will pay for any item or service furnished, ordered or prescribed by an excluded person, and the practice that employed the person owes the money back plus penalties. This article covers who to screen, which lists to use, how often, what the record should look like, and exactly what to do in the week after a hit.
Two definitions first. An exclusion is a formal action by the Department of Health and Human Services Office of Inspector General (OIG) that bars a person or company from participating in Medicare, Medicaid and every other federal health care program. The LEIE is the List of Excluded Individuals and Entities, the OIG's public database of everyone currently excluded, updated every month.
Key takeaways
- Screen every employee, contractor and vendor whose work touches anything billed to a federal program, not just clinicians, and do it before hire and monthly after that.
- The LEIE is the primary source, but the OIG bulletin also points to SAM.gov, and most states publish their own Medicaid exclusion list that must be checked separately.
- The penalty base is up to $20,000 per item or service furnished by an excluded person (inflation adjusted each year), plus up to three times the amount claimed, so a single excluded medical assistant is a serious exposure.
- A name match is not a confirmed hit; verify with the last four digits of the Social Security number or the EIN on the OIG site before you act.
- Keep a dated log of every screening run, including the ones that found nothing; that log is what an auditor asks for first.
Who has to be screened
The common mistake is screening physicians and nurses and stopping there. The OIG's Updated Special Advisory Bulletin on the Effect of Exclusion, published May 8, 2013, is explicit that the payment prohibition covers items and services that are not separately billed, including administrative and management work. A biller who submits claims, a front desk employee who checks eligibility, a practice administrator who signs contracts, an IT contractor who maintains the EHR, a transcription vendor and a locum tenens physician all fall inside it if their work supports anything paid by Medicare or Medicaid.
Vendors are the group practices skip. Your billing company, your clearinghouse, your coding contractor, the company that manages your patient statements and the staffing agency that sends you a temporary receptionist are all providing services that end up in a federal claim. Screen the company and, where the contract lets you, require the vendor to attest that it screens its own staff monthly. Any billing vendor, ours included, should be able to show you its monthly screening log; ask for it before you sign.
OIG exclusion screening sources: which lists, and how often
Three sources matter for almost every practice.
| Source | Maintained by | What it covers | How to check |
|---|---|---|---|
| LEIE | HHS OIG | All OIG exclusions, with exclusion type, date and the statute cited | Online search by name, verified by SSN or EIN; or download the full file monthly and match it against your roster |
| SAM.gov exclusions | General Services Administration | Government-wide debarments from all federal agencies, including OIG exclusions and non-health actions | Online search; less detail than the LEIE, but catches debarments OIG does not issue |
| State Medicaid exclusion or termination list | Each state Medicaid agency or Medicaid inspector general | Providers excluded or terminated by that state, many of which never reach the LEIE | Each state's own site; check every state whose Medicaid program you bill |
The OIG bulletin recommends monthly screening, because the LEIE is updated monthly and a person clean in January can be excluded in February. Many state Medicaid programs go further and require it as a condition of enrollment, in a provider agreement clause most practice owners have never read. Add the state licensing board to the list for anyone with a license, since license revocation is one of the grounds for permissive exclusion and the board action usually comes months before the OIG one.
On method: for a practice under about 30 people, the free online LEIE search is fine, one name at a time, with a screenshot of each result saved to the compliance folder. Above that, download the LEIE database file and match it against a spreadsheet of employees and vendors, then verify any name match on the website. Paid screening services do the same thing across all three sources and produce the log automatically; worth it once the roster passes a few dozen names.
What a hit actually costs
The civil monetary penalty rules at 42 CFR 1003.210 set a base of up to $20,000 for each item or service furnished, ordered or prescribed by an excluded person for conduct after February 9, 2018, adjusted for inflation every year (the current figures are published in the table at 45 CFR part 102). On top of the penalty, OIG can seek an assessment of up to three times the amount claimed for each item or service, and the employing practice can itself be excluded.
Go back to the pediatric practice. About 300 injections and vaccines over three months, billed to Medicare and Medicaid. Even if the administration fees were modest, a $25 administration code times 300 items is $7,500 in claims that were never payable and must be refunded. The penalty exposure is a different order of magnitude: 300 items at the statutory maximum would exceed $6 million before assessments. OIG rarely pursues the maximum against a small practice that discloses promptly, but the practice cannot know where it will land until the disclosure is resolved. The OIG Self-Disclosure Protocol, revised in November 2021, sets a minimum settlement of $20,000 for most cases that go through it.
The cost that never appears in a settlement is the one we see most: the practice that finds an exclusion and quietly lets the person go without refunding anything. The overpayment does not go away. Under the 60-day rule in the Affordable Care Act, an identified overpayment must be reported and returned within 60 days of identification, and a known overpayment that is kept becomes a False Claims Act problem. The refund is unavoidable; the only choice is whether it is voluntary.
Mandatory and permissive exclusions, and why the type matters
Section 1128(a) of the Social Security Act lists mandatory exclusions (Medicare or Medicaid fraud convictions, patient abuse or neglect, felony health care fraud, felony controlled substance convictions), each carrying a minimum of five years. Section 1128(b) lists permissive exclusions, such as license revocation, misdemeanor fraud and default on health education loans. Two facts surprise practice owners. Reinstatement is not automatic: when the period ends, the person must apply to OIG and receive written notice, and until then they stay on the LEIE. A candidate who says "my five years were up in 2024" may still be excluded today. And an exclusion follows the person, not the license or the state; it applies to any job whose work is paid by a federal program, including jobs that need no license.
The first week after a hit
When a screening run turns up a name match, the order of operations matters, and it starts with not overreacting. Common names produce false positives every month. Verify first: the OIG website lets you confirm a match with the last four digits of the SSN for an individual or the EIN for an entity. If the verification says no match, save the screenshot and move on.
If it confirms, do these things in roughly this order.
- Remove the person from any work that touches federal program items or services the same day, on paid leave if you need time to think. Talk to employment counsel before the termination conversation.
- Pull the exclusion date from the LEIE and the person's start date from HR. The overlap is your exposure window.
- Identify every claim in the window that includes an item or service the person furnished, ordered or supported. For a clinical employee, that is every encounter they documented on or performed a service in. For a biller, it is arguably every claim they touched.
- Quantify the federal program dollars in that set (Medicare, Medicaid, Medicare Advantage, Medicaid managed care, TRICARE). Commercial claims are a separate contract question.
- Decide, with counsel, between the OIG Self-Disclosure Protocol and a refund to the Medicare Administrative Contractor and state Medicaid agency. The protocol resolves the CMP liability; a plain refund does not.
- Fix the process failure. If the person was never screened at hire, that is the finding; write it down and start monthly screening this month.
The record that protects you
Screening only counts if you can prove it. The record we ask practices to keep is a single spreadsheet or a folder per month with the date the check was run, the roster it was run against (names of all employees, contractors and vendors on that date), the sources checked, the result for each name, the verification step for any name match, and the initials of the person who ran it. Keep it six years, matching the False Claims Act look-back.
The OIG's General Compliance Program Guidance, published in November 2023, describes screening as part of a compliance program's basic infrastructure and expects it before hire and periodically after. A monthly log with nothing in it but "no matches" is exactly what that expectation looks like in a practice of 15 people. Our practice audit treats a missing screening log as a finding even when every employee is clean.
Questions we hear
We only bill commercial insurance. Do we still need to screen?
Almost no practice bills only commercial insurance once Medicare Advantage and Medicaid managed care are counted, and both are federal health care programs for exclusion purposes. If you truly have no federal program revenue, the OIG penalty does not reach you, but most commercial payer contracts contain an exclusion warranty, and a state license board may still act. Screen anyway; it costs an hour a month.
Our staffing agency says they screen. Is that enough?
Get it in writing, get the frequency, and screen the individual yourself when they start. The bulletin puts the liability on the provider that bills, not on the agency that supplied the person, and OIG has said as much in settlements. An agency's attestation helps you show good faith; it does not transfer the obligation.
Can we hire someone who was excluded once their exclusion is over?
Yes, once OIG has reinstated them in writing and they are off the LEIE. Ask for the reinstatement letter and check the database yourself. A reinstated person is fully eligible; a person whose exclusion period merely elapsed is not.
What to do this week
- Build the roster: every employee, contractor, locum and vendor with any connection to patient care or billing, with start dates.
- Run every name through the LEIE and SAM.gov, and through each state Medicaid exclusion list you bill in; verify any match by SSN or EIN.
- Save the results with the date and the name of the person who ran them, including the clean results.
- Add a monthly recurring calendar task for the screening and name a backup person.
- Add an exclusion check to your new hire checklist and a screening clause to your vendor contract template.
- If anything confirmed, stop the person's work today and call health care counsel before doing anything else.
