The excluded-provider landscape: no single list catches them all

A provider barred from Medicare in one system is not necessarily barred everywhere a screener looks. The United States has no single master registry of excluded health-care providers. Instead it has a patchwork: the federal OIG List of Excluded Individuals and Entities (the LEIE), the government-wide SAM.gov debarment list run by the General Services Administration, and a Medicaid exclusion program in each state, every one of them maintained on its own authority and its own clock. This study assembles every exclusion source Fonteum holds into one picture and asks the question a compliance officer actually has to answer: how many providers are barred somewhere — and how much does any single list miss?

The excluded-anywhere population, in one number

10,020 distinct providers with a National Provider Identifier are barred from a public health program across the three exclusion layers Fonteum holds. That is the de-duplicated union of the federal OIG LEIE, the federal SAM.gov debarment list, and the five live state Medicaid exclusion programs, counting each provider once however many lists name them, and restricted to records that are in force and carry an NPI.

The number that matters next to it is what the single most complete list covers. The OIG LEIE — the list compliance programs treat as the federal master — names 6,880 of those 10,020, or 68.7%. Screen the LEIE alone and 3,140 barred providers, 31.3% of the excluded-anywhere population, return as having no exclusion on file. There is no source that names more than roughly two-thirds of the population by itself.

Count by source

Each list is large in records but smaller in NPI-identified providers, because most exclusion records carry no NPI at all. The table below reports each source at two grains: distinct in-force providers that carry an NPI (the matchable population), and the in-force records that carry no NPI (reported separately, never matched by name).

The "excluded anywhere" row de-duplicates on NPI: 6,880 + 4,694 + 3,939 sums to 15,513, but the distinct union is 10,020, because thousands of providers appear on more than one list. The no-NPI column is a record count, not an entity count — those rows cannot be de-duplicated across lists because there is no identifier to join them on.

Overlap: how much each list misses

The three exclusion layers are complementary, not redundant. 5,341 of the 10,020 barred providers — 53.3% — appear on only one of the three, and just 814 appear on all three. A screener who checks two of the three lists still cannot reach the more than five thousand providers who sit on a single list.

Broken out by which list carries the single-source-only providers, the LEIE and the state lists each hold a large block that no other source names:

The pairwise overlaps show where the lists reinforce each other. The federal pair — LEIE and SAM.gov — agree most often, which is expected because SAM.gov ingests OIG exclusion actions as part of the government-wide debarment feed. The state lists overlap the federal lists far less.

There is no master list. The most complete single source names 68.7% of barred providers; check it alone and you clear nearly a third of them as having nothing on file.

The state Medicaid layer

3,939 distinct NPI-identified providers are barred by a state Medicaid program, and that layer is the one federal-only screening misses most — it overlaps the federal lists less than the federal lists overlap each other. As we documented in the federal–state exclusion gap study, most state-barred providers carry no matching federal LEIE record at all.

State Medicaid agencies act under their own authority and timeline. A state can bar a provider for a Medicaid-specific reason — a state license action, a fraud referral, an administrative termination — without a federal exclusion ever following. The OIG may adopt many of these under its permissive §1128(b) authority, but adoption is discretionary and lagged, which is why a large standing block of state bars never reaches the LEIE.

Compromised but operating: agreements and penalties

A separate layer marks providers under federal monitoring or penalty who are not excluded — still enrolled, still billing, but flagged. Fonteum holds two such sources: OIG Corporate Integrity Agreements and CMS civil money penalties. Together they cover 127 active agreements and 16,277 penalties across 6,884 facilities — and neither can be matched to the exclusion universe, because neither carries an NPI.

An OIG Corporate Integrity Agreement is a negotiated settlement under which an entity accepts years of compliance obligations in exchange for staying in the federal programs. There are 127 agreements in force out of 333 distinct entities in the file. The list is keyed to an entity name and a slug; it publishes no NPI.

A CMS civil money penalty is a fine or payment denial levied on a facility — most often a nursing home — short of termination. Fonteum holds 16,277 such penalties across 6,884 distinct facilities over the rolling reporting window. The penalty file is keyed to a CMS certification number (CCN), the facility identifier; it, too, publishes no NPI.

Because both sources are identifier-disjoint from the NPI-keyed exclusion lists, they are reported here as their own layer and are never joined to the 10,020-provider population. A facility under a civil money penalty or an entity under an integrity agreement is a different — and weaker — signal than an exclusion: it says the provider was penalized or is monitored, not that it is barred from billing.

The providers with no NPI at all

222,830 in-force exclusion records carry no NPI, and they are a screening problem of their own. The matchable population of 10,020 sits inside a far larger body of records: 148,860 no-NPI records on SAM.gov, 61,030 on the OIG LEIE, and 12,940 on the state Medicaid lists. The LEIE in particular carries an NPI on only about one record in ten, a limitation we examine in the OIG exclusion-list reference study.

These records name a barred party — by business name, by individual name, by a UEI on SAM.gov — with no identifier that maps to the other lists. Matching them across sources would require a name match, and a name match is not a defensible identity assertion, so Fonteum does not attempt one. They are held out of the matchable universe and counted only as records. The practical implication is blunt: NPI-based cross-list screening cannot reach these parties, so they compound the gap rather than shrink it.

What this means for screening compliance

No single list is a complete exclusion check, and the spread here puts a number on it: the most complete source, the OIG LEIE, names 68.7% of the NPI-identified barred population, and more than half of that population sits on only one of the three layers. The OIG's own guidance is that an employer or contractor must screen against all applicable exclusion lists — federal and the relevant state Medicaid lists — before hiring or contracting, and on an ongoing basis. Employing or contracting an excluded party in a federally billable role carries civil monetary penalty exposure under a "knew or should have known" standard.

The constructive read is that the layers do something together that none does alone. The LEIE is national but NPI-sparse and lagging; SAM.gov is daily and government-wide but mostly entity-keyed; the state lists are current and program-specific but jurisdictionally fragmented; the compromised-but-operating sources catch monitored providers the exclusion lists never name. Checked together, across snapshots signed at the row level, they close gaps in each other. Fonteum exposes every layer through a single NPI lookup — the federal OIG LEIE and the state exclusion data among them — so a "barred anywhere on the lists we hold" answer does not depend on which single list a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds," never as a guarantee that none exists.

Methodology

Every figure is a direct query against public, row-level-signed Postgres tables: oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 records), sam_exclusions (the SAM.gov daily exclusions extract, 167,582 records), and state_exclusions (the State Exclusion Ring — NY OMIG, PA DHS, OH ODM, NC DHHS, GA DCH-OIG). All are RLS Pattern B, public read. The compromised-but-operating layer reads oig_cia_agreements and cms_civil_money_penalties, both also public read.

The join key throughout is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match. A record is treated as in force when its reinstatement date is null or still in the future relative to the publish date — for SAM.gov the equivalent signal is the termination date, where an "Indefinite" term stores as null and stays in force. The matchable universe is the distinct set of in-force, NPI-identified providers across the three exclusion layers; per-source coverage is each source's distinct in-force NPI divided by that universe of 10,020; overlap is the count of the three layers a provider's NPI appears on. The compromised layer is read separately and never NPI-joined, because neither oig_cia_agreements (entity-name keyed) nor cms_civil_money_penalties (CCN keyed) carries an NPI. The exact SQL is in the reproducibility block below, and the provenance methodology documents the row-level signing contract. Methodology version: exclusion-landscape/v1.

Limitations

• NPI is the floor, not the ceiling. 222,830 in-force exclusion records carry no NPI and are excluded from the 10,020-provider universe; they are reported as record counts and never matched by name. The true barred population is larger than 10,020.
• The compromised layer is unmatchable by identifier. OIG integrity agreements and CMS penalties carry no NPI, so the 127 agreements and 16,277 penalties cannot be tied to the exclusion universe or to one another by identifier. They are a distinct, weaker signal reported on their own terms.
• Five states, not fifty. The state Medicaid layer is New York, Pennsylvania, Ohio, North Carolina, and Georgia. The 3,939 figure describes those five, not the nation; state coverage expands one primary source at a time.
• Snapshot, not cumulative. Every list is point-in-time. The LEIE release, the SAM.gov extract, and each state file shift over time; these figures reflect the current ingested snapshots.
• A compliance signal, aggregate-only. Exclusion and penalty counts are an enforcement and screening signal, never a measure of care quality. No individual barred party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — HHS Office of Inspector General, monthly. The federal exclusion list.
• SAM.gov — exclusions — U.S. General Services Administration, daily. The government-wide debarment list.
• OIG — Corporate Integrity Agreements — HHS Office of Inspector General. The monitored-compliance settlements.
• CMS — Civil Money Penalties dataset — Centers for Medicare & Medicaid Services. Fines and payment denials by facility.
• New York OMIG — Medicaid exclusions — the New York state source.
• Pennsylvania DHS — sanctioned providers (Medicheck) — the Pennsylvania state source.
• Ohio Department of Medicaid — provider exclusion and suspension list — the Ohio state source.
• North Carolina DHHS — Medicaid provider sanctions — the North Carolina state source.
• Georgia DCH — Office of Inspector General — the Georgia state source.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the permissive §1128(b) authority.