Exclusion screening for health plans & Medicaid MCOs

What CMS actually requires of MA and Part D sponsors

Start with the rule that separates this segment from every other provider type. A solo physician practice screens against the OIG exclusion list because the agency recommends it. A Medicare Advantage or Part D sponsor screens because 42 CFR Part 422 and Chapter 21 of the CMS Medicare Managed Care Manual order it to, on a fixed cadence, with no discretion about how often. Plans have to verify every person and entity against the OIG List of Excluded Individuals and Entities (LEIE) and the GSA SAM.gov exclusion records before a hire or contract begins, then again every month.

"Every person" is broader than most teams assume. It pulls in employees, temporary and contract staff, volunteers, consultants, governing-body members, and the contracted clinicians who deliver care to members. Monthly is the operative word: the LEIE is refreshed each month, SAM.gov changes continuously, and a name that cleared in January can land on a list in February. Skipping a cycle is itself the violation, whether or not anyone excluded happens to turn up.

First-tier, downstream, and related entities are the plan's exposure

Here is the detail that trips up payers more often than any single excluded name: the monthly obligation does not end at your own payroll. CMS extends it across your first-tier, downstream, and related entities (FDRs) — the delegated medical groups, pharmacy benefit managers, billing and claims vendors, and whatever those parties subcontract in turn. You may require an FDR to run its own screening and attest to it, and many plans do exactly that, yet the duty to confirm it happened stays with the sponsor. If a downstream entity employs an excluded biller, the contracting organization is the one CMS questions at audit.

For that reason, a growing number of plans stop leaning on a patchwork of annual attestations and screen the chain centrally. Provider Signals places contracted providers, delegated groups, PBMs, and vendors on the same continuous roster as your own workforce, so the FDR layer is watched on the identical monthly schedule rather than self-reported once a year.

Medicaid managed care runs on the same clock

The Medicaid side arrives at the same place through a different statute. More than 66 million people, roughly 78% of all Medicaid enrollees, now receive coverage through risk-based managed care plans operating in 42 states and the District of Columbia. CMS guidance to State Medicaid Directors instructs those plans to screen network providers against the LEIE and the applicable state Medicaid exclusion and sanction lists, generally on the same monthly basis. Because Medicaid is administered state by state, a provider reinstated federally can stay barred on a state list, so all-state coverage is not a luxury for an MCO. It is the floor. Provider Signals carries every state Medicaid list on every plan, including the free tier.

What one missed exclusion does to a plan's books

An exclusion is a payment prohibition, not a caution. No federal health program will pay for any item or service furnished by an excluded person, whether the billing runs directly or through a delegated network. Once a plan lets one through, the costs stack:

• Up to $25,595 in civil monetary penalties for each item or service the excluded individual furnished. That is the 2025 adjusted ceiling under 42 CFR Part 1003, left in force for 2026, and the OIG can assess it directly against the MA or Part D organization that did the hiring or contracting.
• Assessments of up to three times the amount claimed for the prohibited items or services.
• Overpayment recovery on everything the excluded person touched, layered with False Claims Act liability and the audit scrutiny that tends to follow.

For a payer the damage scales with the network. A single excluded physician group treating thousands of members produces thousands of separate "items or services," each one a countable penalty. In May 2025, 19 skilled nursing facilities paid a combined $1.56 million to settle OIG allegations that they employed people they should have known were excluded. At a plan's claim volume, the same arithmetic runs far higher.

Screening a live network, not a static roster

A health plan is never checking one list once. It is checking a network, a delegated-entity chain, and its own staff, again and again, month after month. Provider Signals is sized for that shape of work:

• Network and FDR coverage on one roster. Contracted providers, delegated groups, PBMs, and downstream vendors sit beside employees and board members in a single view.
• Automated monthly re-screening. Every name is re-checked on each refresh and new contracts are screened the day they are added, which meets the "monthly thereafter" requirement without a manual batch job.
• Volume without per-list upcharges. The platform carries tens of thousands of providers across MA, Part D, and Medicaid lines, and pricing follows the number of providers monitored rather than a fixed enterprise contract.
• Audit-ready records. Each screen and match is captured with a date stamp and exported on demand for CMS program audits, state Medicaid oversight, and annual FDR attestations.

Where we land against legacy screening vendors

The incumbent exclusion-screening platforms are priced for procurement, commonly $15,000 to $200,000 a year, and many still bill all-state Medicaid coverage as a paid upgrade. For an organization whose entire book of business is government-funded care, charging extra for state Medicaid lists has the logic backwards. Provider Signals delivers the same continuous, all-source monitoring self-serve, sized to the network you actually operate.

CMS wants screening before contracting and every month after, the LEIE refreshes monthly, and state lists move on their own schedules. Running it continuously keeps the gap between cycles closed. See how the engine works on the exclusion screening overview, dig into monthly screening, or size your network on the pricing page.

How we match your roster

Exclusion screening is only as good as its matching. We match each person or entity against every source using the full identifier set together — NPI, first name, last or organization name, city, state, and ZIP — never one field alone. NPI alone misses records (the OIG LEIE and many lists don’t carry an NPI for every entry); a name or a location alone produces false matches on common names. When a source record has no NPI, we fall back to name plus location.

Because accuracy depends on your input, provide complete, correct details for every roster entry. When more than one possible match is found, we show you all candidates with their source records so you can confirm, select, or merge — we never auto-flag anyone as excluded. Always verify a match against the primary source before taking any action.

Frequently asked questions