Barred but order-eligible: excluded providers still cleared to order and refer in Medicare

170 providers cleared to order and refer in Medicare carry an active exclusion or sanction. The CMS Order and Referring file is the federal roster of clinicians eligible to order items and refer patients in Medicare; the exclusion ring — the OIG LEIE, the GSA SAM.gov registry, and ten state Medicaid exclusion lists — is the opposite list. A name should never sit on both. This study counts the 170 that do, matched on the National Provider Identifier and never on a name, and frames each match for what it is: a flag for review, not a proven claim against any person.

The finding, in one number

170 currently-excluded providers are still cleared to order and refer. Of the 2,008,019 distinct NPIs in the CMS Order and Referring file, 170 also carry an in-force exclusion on at least one of the three sources in the ring. That is 0.0085% of the order/refer-eligible population — a small residual, not a rate of systemic failure. The screening machinery, in aggregate, does what it is supposed to: 2,007,849 order-eligible NPIs carry no active exclusion at all.

But it is the residual that carries the weight. Ordering items or referring patients into Medicare while excluded exposes the provider — and any supplier that fills the order — to civil monetary penalties under a "knew or should have known" standard. Each of the 170 is a live order-and-refer clearance that an automated payer edit could wave through.

An exclusion is a wall around the federal programs. One hundred seventy providers are standing on the wrong side of it, still cleared to order and refer.

How order-and-referring eligibility is supposed to track exclusions

An exclusion and a CMS enrollment action are separate administrative acts, run by separate authorities on separate clocks. The OIG, GSA, or a state Medicaid agency adds a party to its exclusion list; CMS, on notice, is expected to drop the matching provider from the Order and Referring file so the clinician can no longer order or refer. The design intent is that the exclusion leads and the Order and Referring removal follows within one processing cycle.

The follow-through is not instantaneous because the two systems are keyed differently. The Order and Referring file is keyed to enrollment identity — the NPI and enrollment record — while an exclusion is published against a person or entity. CMS must match the excluded party to the right enrollment, effect the removal, and let it propagate into the next public extract. Each step adds latency, and the public files are snapshots pulled on different dates: the Order and Referring file here was released 2026-06-12, the OIG LEIE 2026-05-08, SAM.gov was ingested 2026-06-13, and the ten state lists carry exclusions through 2026-06-08. A provider excluded in the days before a release can still appear order-eligible in a file pulled later, with the removal simply not yet processed. We documented the analogous gap between a triggering event and CMS deactivation in the lag between a termination event and CMS deactivation, and the federal-versus-state screening blind spot in the federal-state exclusion gap.

Where the 170 sit — by exclusion source

The matches are spread unevenly across the three sources. State Medicaid lists carry the overwhelming share, federal sources the rest. Because a single provider can sit on more than one list, the per-source counts sum to more than 170.

The overlap is itself a finding. Nine of the 170 appear on two or more lists simultaneously, and seven sit on both the federal LEIE and a state Medicaid list — meaning a screen that checked only one register would have missed them. Stripped to single-source matches, 148 are state-only, 10 are LEIE-only, and 3 are SAM.gov-only. The state lists are not a redundant copy of the federal one: they surface a population a federal-only screen never sees, the pattern quantified in the federal-state exclusion gap study.

What they can still do — the order and refer privileges

The Order and Referring file marks which claim types each provider is cleared for. Among the 170, the cleared privileges are broad rather than residual.

Every one of the 170 retains DME ordering eligibility, and a clear majority retain power-mobility, Part B, home-health, and hospice clearance. The breadth matters because these are exactly the order-and-refer channels through which a downstream supplier — a DME vendor, a home-health agency — submits a federal claim citing the ordering clinician's NPI. An excluded provider need never bill Medicare directly for the exclusion to reach a federal claim; a cleared order or referral is enough.

Lag versus standing failure

The split that matters most is by exclusion age, because it separates the cases a refresh cycle explains from the ones it does not. For each matched provider we take the earliest exclusion date across the three lists.

This is where the Order and Referring file diverges sharply from the enrollment picture. Only 24 of the 170 — about one in seven — were excluded inside the last 90 days, the window a benign refresh-lag reading would cover. The other 146 are older than that, 105 are older than a year, and 45 have stood for more than five years. The oldest carries an exclusion dated April 1987. No snapshot-timing argument reaches a 39-year-old exclusion. The center of gravity here is standing records, not processing lag — the opposite balance we found for active Medicare enrollment in the barred-but-enrolled study, where most exceptions traced to a single refresh cycle.

The severity mix on the federal side sharpens the point. Of the 18 LEIE matches, 7 sit on a mandatory §1128(a) exclusion basis — the conviction-driven category covering program-related crime, felony health-care fraud, and felony controlled-substance offenses — rather than the more routine §1128(b) license action. A mandatory exclusion is the most serious bar the OIG issues; seven of them still attached to an order-and-refer clearance is the part of this finding that does not soften with context.

The state-exclusion concentration

The 156 state matches are not evenly spread across the states in the ring. Nine of the ten states contribute at least one match, and New York's OMIG list dominates.

New York alone accounts for 85 of the 156 state matches — a concentration that tracks the size and NPI-completeness of the OMIG Medicaid exclusion file rather than any geographic pattern of conduct, the same ten-state state Medicaid exclusion data that powers Fonteum's per-NPI screen. Georgia, the tenth state in the ring, contributes no order/refer matches at all — its 35 in-force NPIs hold no Order and Referring clearance. The table counts a provider in each state that excluded them, so the rows sum to 164 across 156 distinct NPIs: eight providers are excluded by two states at once. On the federal side, the 6 SAM.gov matches are all individual-classification exclusions — five entered by HHS and one by the Office of Personnel Management.

What this means for screening compliance

The constructive read is that the federal plumbing mostly holds: 2,007,849 of 2,008,019 order/refer-eligible NPIs carry no active exclusion, and the order-and-refer file is, in aggregate, a clean roster. The cautionary read is that "mostly" is not the standard the penalty regime applies. A supplier that fills an order or honors a referral from an excluded clinician is exposed under a "knew or should have known" test whether the exclusion is one week old or thirty-nine years old.

Three operational lessons follow. First, order-and-refer clearance is not an exclusion clearance — a provider can be cleared to order and federally excluded at the same instant, so an exclusion screen has to run against the lists in addition to confirming Order and Referring eligibility, not instead of it. Second, one register is not enough: 156 of these 170 surface only on a state list, and a federal-only screen would have cleared them. Third, standing matters more than lag here — 105 of the 170 are old enough that the refresh-timing defense does not apply, and those are the cases worth a primary-source look. Fonteum exposes all three layers — the federal OIG LEIE and the Medicare enrollment data — through a single NPI lookup, so a "barred anywhere on the lists we hold" answer does not depend on which single register a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds," never as a clearance.

Methodology

Every figure is a direct join between four public, read-only Postgres tables: cms_order_referring (the CMS Order and Referring file, PECOS-derived, federal release 2026-06-12, 2,008,019 NPI-keyed records, each a provider cleared to order and/or refer), oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 active records, 6,880 with an NPI), sam_exclusions (the GSA SAM.gov exclusion registry, snapshot 2026-06-13, 167,582 records, 4,694 with an NPI), and state_exclusions (ten state Medicaid exclusion lists, through 2026-06-08, 22,602 records, 5,124 with an NPI). The join key is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match.

An exclusion record is treated as in force when its reinstatement date — or, for SAM.gov, its termination date — is null or still in the future relative to the publish date, the same test the production exclusion lookup applies. A provider counts as order-and-refer-eligible when its NPI is present in the Order and Referring file, which is by construction the roster cleared to order and refer. The matched set is the subset of order/refer-eligible NPIs that also appear in-force on any of the three exclusion sources; providers on more than one list are counted once in the headline 170 and once per source in the by-source table. The exact SQL is in the reproducibility block below, and the provenance methodology documents the source-provenance contract. Methodology version: excluded-ordering/v1.

Limitations

• A match is a flag, not a finding of wrongdoing. Every count here is an identifier overlap between two snapshots. It flags a record pair for primary-source review; it is not evidence that any provider ordered, referred, or billed while excluded, and no individual is named, ranked, or attached to a provider profile in this study. Treat each match as a question to ask the primary source, not an answer.
• A floor, not the ceiling. Only the NPI-identified share of each exclusion list can be reached by this join; exclusion rows with no NPI cannot be matched by identifier and are out of the matchable denominator, never guessed at by name. The 170 is the count among the matchable records.
• Snapshot, not real time. All four files are point-in-time, pulled on different dates (Order and Referring 2026-06-12; LEIE 2026-05-08; SAM.gov 2026-06-13; state lists through 2026-06-08). A removal in progress between those dates can leave a record looking order-eligible when the matching action is already filed. Figures are exact to these frozen snapshots and will move at the next refresh.
• Eligibility, not activity. Presence in the Order and Referring file is a clearance to order and refer; it is not evidence that the provider has ordered or referred since exclusion. This study counts clearance status, not claims.
• Identity asserted on NPI alone. A shared or reassigned NPI, or a data-entry error in any source, could in principle produce a match that a name-and-date-of-birth check would dissolve. That is precisely why the output is a review flag, signed and reproducible, rather than a conclusion.
• A compliance signal, aggregate-only. This is an enrollment-and-screening signal, never a measure of care quality.

Sources

• CMS Order and Referring dataset — the federal roster of clinicians cleared to order and refer in Medicare, the order-eligible side of the join.
• OIG LEIE — online database and monthly downloads — the federal exclusion list, the bar side of the join.
• OIG — effect of an exclusion (screening duty, civil monetary penalties) — the obligation to screen and the "knew or should have known" penalty standard.
• SAM.gov Exclusions (GSA) — the federal exclusion and debarment registry, healthcare-aligned via HHS-OIG and OPM feeds.
• New York OMIG Medicaid exclusions — the largest state contributor among the ten state Medicaid exclusion lists in the ring.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the mandatory §1128(a) and permissive §1128(b) authorities.