How Often Should You Check the OIG Exclusion List?

If you run compliance for a provider group, the question usually comes up the same way. Someone asks whether the new billing contractor was screened, or an auditor asks for proof that every employee was checked against the OIG exclusion list last quarter, and you realize nobody agreed on how often the check is supposed to run. This post answers that question and covers what goes around it: what the list is, why monthly is the standard, what a name match does and does not mean, and what to keep as evidence.

If you want to run a check while you read, our free OIG exclusion list search searches up to 25 names at once against the current LEIE file.

What the OIG exclusion list is

The List of Excluded Individuals and Entities, usually called the LEIE, is published by the HHS Office of Inspector General. It lists people and companies that OIG has excluded from Medicare, Medicaid and all other federal health care programs.

Exclusions fall into two groups. Mandatory exclusions follow certain criminal convictions, such as program-related fraud and patient abuse or neglect. Permissive exclusions are at OIG's discretion and cover a wider range of conduct, such as the loss or surrender of a license. Either way, the effect is the same: federal health care programs will not pay for items or services that an excluded person furnishes, orders or prescribes.

That rule reaches further than most people expect. It applies to an excluded nurse on your payroll, an excluded billing company processing your claims, and an excluded supplier whose products end up in a claim. It does not matter whether the excluded person ever sees a patient.

Why monthly is the standard

OIG updates the LEIE every month. Each update adds the people excluded in the previous month and removes those who were reinstated. A person who was not on the list when you hired them can be on it six weeks later.

That is the whole argument for monthly screening. If the list changes monthly and you check annually, you can go eleven months paying someone whose services federal programs will not pay for. A monthly check limits that gap to the time between OIG's update and your next run.

Federal law does not set one screening frequency for every provider, and OIG's own guidance leaves the frequency to the organization while pointing out that the list is updated monthly. In practice, monthly has become the expectation, for two reasons.

The first is the rule for state Medicaid agencies. Under 42 CFR 455.436, a state Medicaid agency must check the LEIE and the federal exclusion records now held in SAM.gov no less frequently than monthly, for its enrolled providers and for the people with an ownership or control interest in them, and their agents and managing employees.

The second is what states ask of providers. CMS guidance to state Medicaid directors asked states to require their providers to screen employees and contractors every month, and many states wrote that into provider agreements and state rules. If you bill Medicaid, check what your state's agreement says. It is often more specific than federal law.

Who to screen

Screen everyone whose work touches a claim, directly or indirectly. In most provider groups that means:

• Employees, clinical and non-clinical, including part-time staff
• Physicians and other practitioners, whether employed or contracted
• Contractors and temporary staff, including people placed by a staffing agency
• Vendors and suppliers, especially billing companies, labs, pharmacies and equipment suppliers
• Owners, board members and managing employees

The list is longer than "clinicians" because the payment rule is broader than clinical care. An excluded person in your billing office or an excluded vendor in your supply chain can create the same problem as an excluded physician.

Screen at hire, then every month

The first check belongs before the person or vendor starts. Put it in the onboarding checklist next to the license and background checks, so nobody starts work and gets screened later. For vendors, run it before the contract is signed and the vendor is set up in accounts payable.

After that, rescreen the whole population every month, ideally soon after OIG publishes its update. A monthly run against a full roster is where most manual programs break down: one person, a spreadsheet and the OIG search page, one name at a time. That is the part worth automating. Our provider roster check takes a list of NPIs and checks each one against NPPES and the LEIE in one pass, which helps with the clinicians in a roster, though the non-clinical staff and vendors still need a name check.

What happens if an excluded person slips through

Two things, and both are worth taking seriously.

First, payment. Claims for items or services furnished, ordered or prescribed by an excluded person are not payable by federal health care programs. If you find out after the fact, the payments tied to that person may be overpayments that you have to report and return.

Second, penalties. OIG can impose civil monetary penalties on an organization that employs or contracts with an excluded person to provide items or services payable by a federal health care program. OIG also runs a self-disclosure process for providers who find this problem themselves, which is generally a better position than having it found in an audit.

The cost of a monthly check is small next to either outcome. The cost of not documenting it is close to the same as not doing it, because you cannot show an auditor a check you did not record.

A name match is a possible match

The LEIE identifies people by name, address, date of birth and other details, but it often has no NPI for a listed person. Many people share a name, so a name search will turn up matches that are not your employee.

Treat every hit as a possible match. To confirm it, go to exclusions.oig.hhs.gov, search the name, and use the verify option on the matching record. You enter the person's Social Security number, or an entity's EIN, and the site tells you whether it matches that record. Compare the date of birth, address and any other details as well.

Two rules keep this honest. Do not act on an unconfirmed match, because you can wrong an employee who simply shares a name with someone on the list. And do not treat a search that returned nothing as proof of anything beyond what it is: no possible match on the file you searched, on the date you searched it.

Document each check

For every check, keep:

• The date of the check and who ran it
• The list and the file date checked against
• The names or identifiers searched
• The result, and for any possible match, how it was confirmed or ruled out, with a screenshot or saved copy of the official verification

Keep these records with the employee or vendor file, and keep them for as long as your record retention policy and payer contracts require. When an auditor asks whether a contractor was screened in March, the answer should be a record, not a recollection.

The OIG list is not the only list

The LEIE covers federal health care program exclusions. It does not cover:

• SAM.gov exclusions, which list people and companies suspended or debarred from federal contracts and many kinds of federal assistance, across every federal agency
• State Medicaid exclusion and termination lists, which many states publish separately and which can include providers the state has terminated but OIG has not excluded
• The OFAC sanctions lists, which are about sanctions rather than health care programs

Most compliance programs check the LEIE and SAM.gov together, and add the state lists where they operate. We cover the difference between the federal lists in OIG LEIE vs SAM.gov exclusions, and the state side in State Medicaid exclusion lists.

Where this fits in a larger verification workflow

Exclusion screening is one check among several. Credentialing teams also verify licenses, board certifications, DEA registrations and payer enrollment, and each source has its own site and its own way of failing. We built and run a provider credentialing verification platform that checks state licensing boards, certification boards, OIG, OFAC and SAM sanctions lists, DEA registries and payer portals at the source, at about 30,000 verifications a day across 641 source configurations, and saves proof for every check.

To start with one list, run your names through the free OIG exclusion list search, or use the combined exclusion check to search OIG, SAM.gov and OFAC together and get the full report by email.

Talk to us

If your monthly screening is a person, a spreadsheet and a browser tab, we can help you build it into your credentialing or HR workflow, with the file dates, matches and confirmations recorded for every run. Contact us and tell us what you screen today and where it breaks.