OIG and Medicaid exclusion list checks for practices

What is the Medicaid exclusion list in Florida?

Clause (5)(r) of Florida’s Non-Institutional Medicaid Provider Agreement (December 2023), the agreement behind Florida Medicaid enrollment, names the three lists and the cadence: search them “monthly to determine whether any employee or contractor has been excluded.”

Sources: provider agreement (5)(r); HHS-OIG Exclusions FAQ (Apr 30, 2026) and 2013 bulletin pp. 14, 17; 48 CFR 9.404; s. 409.913(37), F.S.; AHCA Public Record Search. Read Oct 20, 2026.

How do you check the Medicare exclusion list?

The exclusion that stops Medicare from paying is OIG’s: an LEIE listing covers Medicare, Medicaid and every other federal health care program (42 CFR 1001.1901(a)).

• Search online at exclusions.oig.hhs.gov, up to five names at a time, and confirm a possible match with the person’s Social Security number or the business’s EIN.
• Use the download for long rosters. It carries no SSNs or EINs (the Privacy Act bars them), so confirm every hit online.
• Search every name. The LEIE shows the name OIG knew at the time of exclusion, so search maiden and other names too.
• Keep proof: a dated screenshot or printout of each search, including follow-ups that cleared a possible match (OIG’s 2013 bulletin, p. 14).

OIG exclusion list requirements: is monthly screening a rule?

Monthly checks are OIG advice, not a federal rule for providers. OIG’s bulletin says it plainly, “Providers are not required by statute or regulation to check the LEIE,” and gives the reason to screen monthly anyway: “OIG updates the LEIE monthly, so screening employees and contractors each month best minimizes potential overpayment and CMP liability” (p. 15). The same page has providers check before hiring or contracting, and OIG’s General Compliance Program Guidance (November 2023) lists monthly exclusion screening as routine monitoring (pp. 58, 69). The list moves: OIG excluded 1,212 individuals and entities in the six months to Mar 31, 2026 (Spring 2026 Semiannual Report).

Two texts do set a monthly check:

• State Medicaid agencies must check the LEIE and the federal exclusion list now kept in SAM “no less frequently than monthly” for the providers they enroll, their owners, agents and managing employees (42 CFR 455.436).
• Florida’s provider agreement: clause (5)(r), above.

Who does OIG compliance guidance say to screen?

OIG’s test is the payment: if federal programs pay, directly or indirectly, for a job’s or a contract’s work, screen everyone in it (bulletin, pp. 15–16):

• Every relationship: employees, contractors and volunteers, or anyone with “any other relationship with the provider” (p. 12).
• The front office: at a federally paid provider, an excluded person may not be a “physician practice office manager” or director of human resources, nor do billing, accounting, staff training or HR work “unless wholly unrelated to Federal health care programs” (p. 7).
• Outside firms’ people: OIG recommends screening nurses supplied by an outside firm and billing or coding contractors (p. 16).
• Nurses and aides: Florida’s largest excluded group, 2,611 of its 9,146 records (28.5%). By legal basis, 3,060 Florida exclusions (33.5%) rest on a license revoked, suspended or surrendered (verify a Florida license).

The exclusion search is separate from Florida’s Level 2 background screening (AHCA background screening); both belong in the pre-hire file (HR and staff training).

The same compliance guidance asks every organization for a written screening policy that names who screens, how possible matches are verified and what happens on a match (p. 35). For small practices it adds “at least an annual audit” of their own (p. 69); the outside audits a Florida practice faces are on audit readiness.

What happens if you employ someone on the Medicare exclusion list?

• No payment. No federal program, Medicare Advantage and Part D plans included, pays for an item or service an excluded person furnishes (42 CFR 1001.1901(b)), even work paid inside a bundled or capitated payment (bulletin, p. 6).
• Penalties. If the practice arranged or contracted “by employment or otherwise” with someone it knew or should have known was excluded, OIG can impose up to $25,595 per item or service (the 2025 level, in force through 2026), plus up to 3 times the amount claimed, or up to 3 times the person’s total cost (salary, benefits, taxes) for work not billed separately (42 CFR 1003.200(b)(4) and 1003.210; 45 CFR 102.3).

How long do Medicare exclusions last?

Under 42 U.S.C. 1320a-7(c)(3):

• At least 5 years for the mandatory exclusions (program-related crimes, patient abuse, health care fraud felonies and controlled-substance felonies); at least 10 years with one prior conviction, and permanent with two or more.
• At least as long as the license action when the exclusion rests on a license revoked, suspended or surrendered.
• 3 years for several permissive exclusions, unless mitigating or aggravating circumstances shorten or lengthen it.

“Reinstatement of an excluded individual or entity is not automatic once the specified period of exclusion ends.”

The person applies, no earlier than 90 days before the term ends, and stays excluded until OIG sends written notice; a provider number from Medicare, Medicaid or another program reinstates no one. Reinstated people are removed from the LEIE. When a candidate says an exclusion is over, ask for OIG’s letter.

What does the OIG Self-Disclosure Protocol require after a match?

OIG’s bulletin names the protocol as a way to resolve penalty liability for employing an excluded person (p. 13); whether and how to use it is your attorney’s decision.

1. Tell AHCA. Clause (5)(r) has Medicaid providers notify the agency “immediately” of any exclusion they discover.
2. Mind the overpayment clock. Federal payments for the excluded person’s work are overpayments (bulletin, p. 16). For Medicare Part A and B, 42 CFR 401.305 sets the deadline: 60 days after identification (later if a cost report is due), for overpayments identified within 6 years of receipt. A timely, good-faith investigation of related overpayments suspends it for up to 180 days; OIG’s acknowledgment of a protocol submission suspends it until settlement, withdrawal or removal.
3. Screen everyone first. Before disclosing an excluded employee, the Self-Disclosure Protocol (updated Oct 15, 2026) requires screening all current employees and contractors against the LEIE, then disclosing every excluded person in one submission.
4. Describe what failed. The submission covers the person’s identity and provider number, duties, dates, background checks, the screening process “and any flaw or breakdown” behind the hire, how it was found and the corrective action (§3.C).
5. Know the math. For work not billed separately, damages are the total cost of employing the person (salary, benefits, insurance, employer taxes) times the practice’s federal payor mix; OIG generally applies a multiplier of at least 1.5 and a minimum settlement of $20,000 (§3.C, §8). A medical assistant who cost $42,000 during the exclusion, at a 45% federal payor mix, means $18,900 in damages and $28,350 at the 1.5 multiplier.

What you can do today

1. Build the roster: every employee, contractor, volunteer, managing employee and owner of 5% or more, with each name they have used and their date of birth; collect Social Security numbers only to confirm a possible match.
2. Run the three searches: the LEIE online search, SAM.gov’s exclusions search and AHCA’s Public Record Search (Legal Orders, “Medicaid Sanctioned Providers”).
3. Save dated results for each person and set the next run for the week after OIG’s mid-month update, on the calendar with license renewals and recredentialing.
4. Write the policy: who screens, how a match is confirmed, who is told and what happens next.
5. On a confirmed match, call your attorney the same day.

Advixor’s compliance service develops, reviews and updates compliance programs and policies, the screening policy among them.