How often should we check the OIG exclusion list?

The OIG's Special Advisory Bulletin recommends screening at the time of hire and periodically afterwards, and names monthly as the interval that keeps exposure to a single month of claims. Monthly is also what most payer and hospital contracts specify when they specify anything. The list itself is republished monthly, so checking more often than that gains you nothing.

Who has to be screened?

Anyone who furnishes items or services that a federal health care program pays for, which is broader than payroll. Employees, contractors, locums, volunteers and vendors are all in scope where their work contributes to a billed service — and the OIG has been explicit that administrative and management roles count, not only clinical ones. If you are a billing company, that is effectively your whole staff.

Is a name match the same as an exclusion?

No, and treating it that way is the mistake to avoid. The list holds thousands of common names, so a match is usually a different person. The OIG's own verification guidance is to confirm against a second identifier — typically a date of birth or an NPI — before drawing any conclusion. Our product records the match, asks a named person to decide, and requires a note when they confirm one.

What happens if we find a real match?

That is a decision with legal and financial consequences and it is not one software should make for you. The product raises a task, records the determination and keeps the evidence trail; what you do about employment, about claims already submitted and about any repayment obligation is a question for your own counsel. We are not a law firm and do not provide legal advice.

Do you screen state Medicaid exclusion lists too?

Not today. We screen the OIG's federal list at every run, and SAM.gov where an API key is configured. Several states publish their own lists and some contracts require them; if that applies to you, keep doing those separately and record the result — the product will hold the evidence even where it did not perform the search.

Exclusion screening

Screen your staff and vendors against the federal exclusion list, monthly.

Federal health care programs do not pay for anything furnished, ordered or prescribed by an excluded person or entity — and the prohibition follows the money down the chain to you. We compare your workforce, your contractors and the vendors that handle patient information against the OIG's published list every month, and record what was checked, against which edition, and what a human decided about every hit.

Last reviewed August 4, 2026.

Start 14-day free trial See the product tour

You can do this by hand. Almost nobody does it monthly.

The OIG publishes the List of Excluded Individuals/Entities free, and you can search it a name at a time on their website. That is genuinely workable for a practice with four staff and no contractors. It stops being workable the moment you have a workforce, a contractor list and a vendor register that all change — because the obligation is not to search once, it is to keep searching, and the exposure compounds with every month nobody did.

The list changes monthly. A clean search in January says nothing about February.
It is not only your employees. Contractors, locums, vendors and their people are all in scope where they are furnishing items or services you bill for.
The record matters as much as the search. Screening you cannot evidence answers no question a payer or a client asks.

Everyone, automatically

Your workforce comes from your team list and PHI-handling vendors from your register, so nobody has to be re-keyed. Contractors, locums and owners without a login are added by hand once and screened from then on.

Monthly, without remembering

A scheduled run screens every organization on the first of the month against the edition the OIG published most recently. The button exists for a new hire; the schedule is the point.

Which edition, not just when

Every screening record carries the publication date of the list it actually compared against. A record that cannot say that answers the only question a reviewer asks about it.

Matches wait for a person

A hit is a name match on a published list, not a finding. Each one lands undecided, and confirming it requires a note saying what you verified and against what. That decision, its author and its date are what the record is.

A confirmed match becomes work

Confirming a match raises a task rather than leaving a flag on a screen, because a confirmed exclusion has payment consequences and a decision to make, not a box to tick.

It reaches the evidence pack

Screening cadence appears in the Trust Packet and, if you choose, on your public trust page — when it last ran and against which edition. Never a name, and never whether anyone matched.

Why a billing company gets asked this first

Of everything in a HIPAA programme, exclusion screening is the item most likely to appear in a payer contract or a hospital's vendor terms with a stated frequency attached. It is also the one with the clearest financial mechanism behind it: this is not a privacy question, it is a payment-eligibility question.

The payment prohibition is broad: 42 CFR 1001.1901(b) bars payment for items or services furnished, ordered or prescribed by an excluded party — including administrative and management services, and including where the excluded person is several steps from the claim.
It reaches people who never touch a patient: The OIG's guidance is explicit that the prohibition covers services furnished by excluded individuals in administrative and management roles. For a billing company that is most of the staff.
Monthly is the named interval: The OIG's Special Advisory Bulletin on the effect of exclusion recommends checking at hire and periodically after, and identifies monthly as the cadence that limits exposure to a single month of claims. Many contracts simply copy that number.
The liability is repayment, not only a fine: Amounts paid for services furnished by an excluded party can be treated as overpayments and recovered, with civil monetary penalties available on top. Take your own counsel on what that means for you — we do not provide legal advice.

How a name match is resolved

The published list carries thousands of common names. On any real workforce a match is far more often a collision than a finding, so the product treats it as one and asks a person to decide.

The comparison is exact, not fuzzy
Names are normalized — case, punctuation, accents, credentials and legal suffixes — and then compared exactly. Fuzzy matching on a list this size produces dozens of hits a run, and a review queue nobody can finish trains the reviewer to clear everything without looking.
A second identifier narrows it
The list carries a date of birth for most individuals. Where you have recorded one, a mismatch demotes the hit and says so; agreement is reported as agreement, not as proof. An NPI does the same job more decisively.
A person decides, in writing
Every hit is dispositioned as a different party, a confirmed match, or already dealt with. Confirming requires a note. The decision, who made it and when, is recorded and appears in the audit log.
Reinstatement is respected
A party who has been reinstated is not a current exclusion and is not surfaced as one, so a resolved case does not reappear every month as a standing false positive.

What we screen against

The OIG's List of Excluded Individuals/Entities is the authoritative federal list and the one contracts name. It is published as a full extract and refreshed monthly; the July 2026 edition carried 83,665 records.

OIG LEIE — always: Downloaded fresh at every run rather than cached, so a screening always reflects the list as published rather than as we last saw it.
SAM.gov — where configured: The System for Award Management's exclusions extract is the second list many federal contracts name. It needs an API key; where one is not configured, the interface says SAM was not screened rather than implying it came back clean.
State Medicaid lists — not yet: Many states publish their own exclusion lists and some contracts require them. We do not screen those today, and we would rather say so than let a coverage claim do work it cannot support.

Common questions

How often should we check the OIG exclusion list?: The OIG's Special Advisory Bulletin recommends screening at the time of hire and periodically afterwards, and names monthly as the interval that keeps exposure to a single month of claims. Monthly is also what most payer and hospital contracts specify when they specify anything. The list itself is republished monthly, so checking more often than that gains you nothing.
Who has to be screened?: Anyone who furnishes items or services that a federal health care program pays for, which is broader than payroll. Employees, contractors, locums, volunteers and vendors are all in scope where their work contributes to a billed service — and the OIG has been explicit that administrative and management roles count, not only clinical ones. If you are a billing company, that is effectively your whole staff.
Is a name match the same as an exclusion?: No, and treating it that way is the mistake to avoid. The list holds thousands of common names, so a match is usually a different person. The OIG's own verification guidance is to confirm against a second identifier — typically a date of birth or an NPI — before drawing any conclusion. Our product records the match, asks a named person to decide, and requires a note when they confirm one.
What happens if we find a real match?: That is a decision with legal and financial consequences and it is not one software should make for you. The product raises a task, records the determination and keeps the evidence trail; what you do about employment, about claims already submitted and about any repayment obligation is a question for your own counsel. We are not a law firm and do not provide legal advice.
Do you screen state Medicaid exclusion lists too?: Not today. We screen the OIG's federal list at every run, and SAM.gov where an API key is configured. Several states publish their own lists and some contracts require them; if that applies to you, keep doing those separately and record the result — the product will hold the evidence even where it did not perform the search.

Keep reading

Software and researched information, not legal advice. No product can make an organization “HIPAA certified” — no such designation exists under the HIPAA rules, and using this service does not establish that you comply with them.