Exclusion screening for credentialing verification organizations

The 30-day clock you are now measured against

Start with the standard, because the standard is what a CVO has to engineer around. NCQA's 2025 credentialing requirements, in effect for surveys conducted on or after July 1, 2025, call for ongoing monitoring of Medicare and Medicaid exclusions (OIG and SAM), sanctions, and license actions on at least a 30-day cycle. Findings cannot simply sit in a log either; an exclusion or sanction surfaced between cycles has to be routed to the credentialing committee or another designated peer-review body so that someone acts on it. URAC's credentialing program sets a parallel expectation of continuous sanction monitoring between full credentialing events. For most provider organizations this is a back-office detail. For a CVO it is the deliverable.

Miss the cadence and the failure does not stay quiet. A practitioner can be clean at credentialing and excluded four months later, well before the 36-month recredentialing window comes around. If your monitoring only fires on that cycle, the gap between events is exactly where an active exclusion hides while claims keep flowing under the client's billing number.

Your files are what the delegation auditor samples first

When a health plan delegates credentialing to you, it does not hand off accountability. The plan remains answerable to NCQA for the work you perform on its behalf, so it audits you to prove the work holds up. Those delegation audits run on file-review sampling rather than a full read of every record. A reviewer pulls a sample of credentialing files, often the familiar eight-and-thirty pattern where an initial set of eight expands to thirty once problems appear, and scores each file against the standards.

Sampling is precisely why a single screening defect is dangerous. One file in the sample with a stale exclusion check, a missing source, or an unaddressed hit can pull the score under the passing threshold and put the delegation agreement under review. The auditor reads that one bad file as evidence of a process gap, not a one-off. And because you are the shared screening function, the same gap repeats across every client roster you maintain. A defect that would embarrass an in-house team at one hospital propagates, in your case, to each plan, IPA, and hospital that relies on your auto-credit.

What a cleared-but-excluded practitioner costs the client

Exclusion carries no de minimis exception. No federal health care program will pay for any item or service furnished by an excluded person, whether the work is clinical, administrative, or buried inside a bundled or per-diem rate. When your verification clears someone who is in fact excluded, the client's exposure compounds:

• Up to $20,000 per item or service furnished by the excluded individual, an amount that rises with the annual inflation adjustment.
• An assessment of up to three times the amount claimed for each item or service.
• Overpayment recovery on everything the excluded person touched, with False Claims Act liability layered on top.

This is not a theoretical tail risk. In May 2025, nineteen skilled nursing facilities settled with HHS-OIG for roughly $1.56 million after employing people they knew or should have known were excluded. The penalty attaches to the client's claims; the contractual fault, and the awkward audit conversation, attach to you.

State Medicaid lists deserve equal weight to the federal LEIE here. Because plans and IPAs draw Medicaid dollars, a practitioner reinstated at the federal level can still sit on an individual state's exclusion list, and a CVO serving clients across several states has to check all of them. Most screening tools price that all-state coverage as a paid tier. Provider Signals includes every state on every plan.

Throughput, every state, and an evidence trail that survives audit

You are not screening one roster. You are screening many clients' rosters at once, against a clock measured in 30-day windows. The product has to match that reality:

• API and bulk verification. Push thousands of practitioners through programmatically and pull structured results straight into your credentialing platform, rather than having staff key names into government portals one at a time.
• Continuous re-screening between cycles. Every practitioner is re-checked on each refresh, which covers the ongoing-monitoring requirement at credentialing, at the 36-month recredentialing event, and in the months between.
• All 50+ sources, every state. OIG LEIE, SAM.gov, OFAC, Medicare Opt-Out, and each state Medicaid list, so a client anywhere is covered with no per-state surcharge.
• Immutable, dated records. Exportable evidence of what was screened, against which sources, and when, ready for NCQA and URAC surveys and for the file-review sampling a delegation audit runs.
• Per-client segmentation. Each delegating plan's roster and its evidence stay separate, so an audit produces exactly the file set that client needs without manual untangling.

How we compare to enterprise screening vendors

Legacy exclusion-screening platforms are sold as enterprise contracts, commonly $15,000 to $200,000 a year, and many still bill state Medicaid coverage as an add-on. That structure fits a single large employer, not a CVO that has to cover every state for every client. Provider Signals offers the same continuous, all-source monitoring on a self-serve footing, with API access and pricing that scales by the roster you actually monitor.

OIG guidance has long recommended screening at hire and monthly afterward, and NCQA now codifies a 30-day cycle. Provider Signals runs continuously, so a verified practitioner is re-checked between recredentialing events instead of resting on a single point-in-time result. See how the engine works on the exclusion screening overview, review other segments on the industry hub, or size your client volume on the pricing page.

How we match your roster

Exclusion screening is only as good as its matching. We match each person or entity against every source using the full identifier set together — NPI, first name, last or organization name, city, state, and ZIP — never one field alone. NPI alone misses records (the OIG LEIE and many lists don’t carry an NPI for every entry); a name or a location alone produces false matches on common names. When a source record has no NPI, we fall back to name plus location.

Because accuracy depends on your input, provide complete, correct details for every roster entry. When more than one possible match is found, we show you all candidates with their source records so you can confirm, select, or merge — we never auto-flag anyone as excluded. Always verify a match against the primary source before taking any action.

Frequently asked questions