OIG vs SAM.gov vs state Medicaid exclusion lists

The short answer

The OIG list (the List of Excluded Individuals and Entities, or LEIE) holds everyone HHS’s Office of Inspector General has excluded from Medicare, Medicaid and the other federal health care programs. SAM.gov holds exclusions and debarments entered by every federal agency, and OIG says it includes OIG’s exclusions. A state Medicaid exclusion list holds the providers that one state has terminated, suspended or excluded from its own Medicaid program, and those actions often never reach the federal lists.

So the lists overlap, but none of them contains the others. A practice that checks only the OIG list misses federal debarments and state terminations. A practice that checks only SAM.gov misses state actions and gives up the identifiers that make OIG matches easy to confirm. That is why OIG recommends the LEIE as the primary source for its exclusions, why state Medicaid agencies must check both federal lists every month, and why compliance programs usually add the state lists for every state where they bill Medicaid.

1. The OIG list (LEIE)

OIG excludes people and businesses under section 1128 of the Social Security Act. Some exclusions are mandatory, such as convictions for Medicare or Medicaid fraud, patient abuse or neglect, and certain health care and controlled-substance felonies. Others are permissive, such as a license revoked or surrendered, default on health education loans, or submitting false claims (OIG, exclusion authorities). Each record shows the authority used, so you can see why someone was excluded.

The effect is broad. OIG’s 2013 Special Advisory Bulletin, still its main guidance on the subject, says no federal health care program payment may be made for items or services furnished, ordered or prescribed by an excluded person, and that the ban reaches beyond hands-on care. In OIG’s words, excluded persons are “prohibited from furnishing administrative and management services,” even when those services are not separately billable (OIG Special Advisory Bulletin, 2013). The bulletin’s examples include an excluded person entering prescription information for pharmacy billing, and it says the ban applies whether the person is an employee, a contractor or a volunteer.

How to search it. OIG offers an online search (up to five names at a time) and a downloadable file updated monthly. When a name matches, OIG’s online search can verify the match with the person’s Social Security number or a business’s EIN (OIG, database help). Many entries also include an NPI, a date of birth and an address, which is what makes the LEIE the easiest list on which to confirm or rule out a match.

What it doesn’t show. Exclusions by other federal agencies, and state Medicaid actions that OIG has not turned into an exclusion. A record also leaves the downloadable list once OIG reinstates the person; reinstatement isn’t automatic when the exclusion period ends, the person has to apply.

2. SAM.gov exclusions

The System for Award Management is the federal government’s registry for contractors and grant recipients. Its exclusions section replaced the old Excluded Parties List System (EPLS) in 2012 (GSA guide). Any federal agency can enter an exclusion: a debarment or suspension from federal contracts or grants, a prohibition under a specific statute, and OIG’s health care exclusions. OIG’s bulletin puts it simply: “SAM includes OIG’s exclusions but also includes debarment actions taken by Federal agencies” (OIG, 2013).

Why a medical practice checks it. First, it catches OIG exclusions a second time, a useful cross-check. Second, it catches people and businesses debarred by other agencies, which matters for anyone holding federal contracts or grants and is a reasonable red flag for any hire or vendor. Third, state Medicaid agencies are required to check it: federal rules make them check the LEIE and the federal debarment list (the regulation still calls it EPLS) for every provider at enrollment and at least monthly (42 CFR 455.436). Many states pass that expectation on to providers in their Medicaid agreements.

An important limit. OIG says it “has no authority to impose CMPs on the basis of employment of (or contracting with) a debarred person” (OIG, 2013). A debarment by, say, the Department of Defense is not an OIG exclusion and does not by itself bar Medicare payment for that person’s work. It still deserves a look and a documented decision.

How to search it. SAM.gov has a free exclusions search, and GSA publishes the full public list as a daily extract (GSA). SAM records rarely carry an NPI or date of birth, so confirming a match usually means reading the record’s addresses, dates and agency, and sometimes contacting that agency.

3. State Medicaid exclusion lists

Every state runs its own Medicaid program and can terminate or exclude providers from it: for fraud findings, failed audits, licensing actions, refusing a site visit, not revalidating, or because Medicare or another state terminated them. Federal rules require each state to deny or end the enrollment of a provider that Medicare or another state’s Medicaid or CHIP program has terminated, once that termination is in the federal termination database (42 CFR 455.416(c)).

Many of these actions never become OIG exclusions. A provider terminated by a state for cause can keep billing Medicare and other states’ Medicaid programs until someone notices, and a practice that hires them in that state can face Medicaid payment demands. That is why CMS asked state Medicaid directors to require providers to search for excluded employees and contractors monthly (CMS SMDL #09-001), and why many states write that duty into provider agreements.

The hard part: every state is different. Some publish a spreadsheet, some a PDF that changes name every month, some a search page that shows one name at a time, and a few publish nothing at all. Columns, update schedules and even what counts as “excluded” differ. Our state Medicaid exclusion list directory lists what every state publishes and how to search it, and our free exclusion check searches 31 state lists automatically alongside OIG and SAM.gov. It always tells you which states it did not search, with the manual steps for each.

Side by side

Confirming a match on each list

Most possible matches are different people with the same name. What you can use to tell them apart depends on the list:

• OIG LEIE: name, any NPI, date of birth, address, specialty and the exclusion date and authority. OIG’s online search can then verify the person’s Social Security number, or a business’s EIN, against the matched record. This is the strongest confirmation available anywhere.
• SAM.gov: name, addresses, the excluding agency, the type of exclusion and its dates, and sometimes other identifiers. If the details are not enough, the excluding agency named in the record is the place to ask.
• State lists: anything from a full record with NPI and license number to a bare name and city. When the list is thin, call or email the state agency that publishes it.

Write down what you compared and what you concluded, with the date. If you rule a match out, that note is your evidence; if you confirm it, it starts your response file.

How exclusions end

An OIG exclusion has a minimum length (five years for most mandatory exclusions), but it does not end by itself: the person must apply to OIG for reinstatement, and stays excluded until OIG grants it (OIG). Reinstated people are removed from the LEIE. SAM.gov records carry a termination date where the action has one, and many show “indefinite”. State lists follow each state’s own rules, and some keep old entries with a reinstatement date. When you see an old entry, read its dates before assuming it still applies, and when an entry disappears, make sure the right list was searched rather than assuming the person was reinstated.

Five examples

The people and businesses below are invented to show common situations. The rules they illustrate come from the sources cited above.

1. Excluded by OIG: found on two lists

A dental office screens a new hygienist, Dana. Her name appears on the OIG list with an exclusion under 1128(a)(1), a program-related conviction, and the same exclusion appears on SAM.gov with “HHS” as the excluding agency. The LEIE record shows a date of birth that matches her application, and OIG’s online search confirms the Social Security number. The office does not hire her and keeps a printout of both records and the verification in its compliance file.

2. Debarred, not excluded

A billing company is about to sign a software vendor. The vendor’s owner shows up on SAM.gov, debarred by a non-health federal agency after a procurement case; he is not on the OIG list. OIG’s bulletin says it cannot impose penalties for contracting with a person debarred by another agency, so this is a business judgment rather than a Medicare payment problem. The company asks its lawyer, records the decision and the reasons, and chooses another vendor because it also holds a federal contract.

3. Terminated by a state, invisible federally

A home health agency in Texas hires an aide, Marcus, who worked for years in another state. He is not on OIG or SAM.gov. But that state’s Medicaid program terminated him after an audit, and his name is on its list. Because the agency screens the lists of the states where staff have recently worked, it catches the termination, asks Marcus about it and calls the other state’s agency before deciding. Without the state check, nothing would have flagged it.

4. Same name, different person

A clinic screens a nurse named Maria Lopez and gets a possible match on a state list. The state entry gives a provider type of “pharmacy” and a city 400 miles away, with no license number. The clinic compares the details, finds no overlap with its Maria Lopez, and writes a short note: list, date, why it is a different person. That note is what an auditor wants to see; OIG’s bulletin notes it is the provider’s responsibility to determine whether its staff are excluded.

5. An administrative employee

A practice manager assumes the front-desk and billing staff don’t need screening because they don’t treat patients. OIG’s bulletin says the opposite: excluded persons may not furnish administrative and management services paid directly or indirectly by federal programs, even when those services are not billed separately. The practice adds every employee, contractor and volunteer to its monthly screen.

A screening routine that covers all three

Our free tools do most of this in a few minutes. The single exclusion check searches OIG, SAM.gov and 31 state lists for one name, business or NPI, and the bulk check screens up to 500 names at once. Both produce a dated PDF record that names each list and the date of each copy used. The policy generator writes this routine into a one-page policy, and the cost calculator shows what a missed exclusion can cost.

Six common mistakes

1. Screening only clinicians. Billing, scheduling, IT and management staff count too, because the ban covers administrative and management services.
2. Screening only at hire. Exclusions happen after people are hired. A clean result in January says nothing about June.
3. Checking SAM.gov only. It does include OIG exclusions, but OIG recommends its own list as the primary source, and SAM.gov has no state Medicaid actions.
4. Checking only your own state. Staff and contractors move. Many practices add the states where a person worked in recent years.
5. Treating a name match as a verdict. It is a reason to check identifiers, not to fire someone.
6. Keeping no record. If you can’t show the dates and lists you checked, an auditor may treat the screen as not done.

What our tools can and can’t do

• They search the official OIG and SAM.gov data and the state lists that can be downloaded automatically. The result lists every state that was not searched and how to check it by hand.
• They match on names, businesses and NPIs. They cannot see Social Security numbers, so a possible match must be confirmed on the official source.
• Lists change. Each record shows the date of each copy used; re-screen monthly.

Questions

Sources

1. HHS OIG, Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (May 2013) — what the LEIE and SAM.gov contain, monthly screening, contractors, administrative services, the “knows or should know” standard, self-disclosure
2. HHS OIG, Background Information and Exclusion Authorities — OIG’s exclusion authorities and the effect of exclusion
3. HHS OIG, LEIE downloadable database — the LEIE download and its monthly updates
4. HHS OIG, Exclusions database help — verifying a match by Social Security number or EIN
5. SAM.gov, exclusions search — searching SAM.gov exclusions
6. GSA, SAM.gov Entity/Exclusions Extracts Download API (daily public exclusions extract) — the daily public SAM.gov exclusions extract
7. 42 CFR 455.436, Federal database checks (state Medicaid agencies) — state Medicaid agencies must check the LEIE and the federal debarment list at least monthly
8. 42 CFR 455.416, Termination or denial of enrollment — states must end the enrollment of providers terminated by Medicare or another state
9. CMS, State Medicaid Director Letter #09-001 (January 16, 2009): providers should search for excluded employees and contractors monthly — CMS asks states to require providers to search monthly for excluded employees and contractors
10. HHS, Annual Civil Monetary Penalties Inflation Adjustment (Federal Register, January 28, 2026) — the 2026 civil money penalty amount
11. 42 U.S.C. § 1320a-7a (civil monetary penalties) — civil money penalties for items or services by excluded persons

Checked October 27, 2026. This page is general information, not legal advice. Exclusion rules and state Medicaid requirements change and vary by state, payer and contract; for a specific situation, ask a health care lawyer. Examples use invented people and businesses.