If your practice bills Medicaid or Medi-Cal, the obligation is monthly — and the burden of proof is yours, not the government’s. We run the screen, resolve the matches, and hand you a dated record you can put in front of an auditor.
The lists are public. The obligation is monthly.
The proof is yours to keep.
Federal law does not ask whether you knew. It asks whether you checked — and whether you can show it.
OIG alleged that Riverside employed one excluded individual whose work was billed to federal health care programs. The role was intake coordinator and site manager — not a physician, not a nurse. Someone who scheduled patients and ran the office.
Three quarters of a million dollars. One person. A job most practices would never think to screen.
Read the OIG record — Riverside contested OIG's allegations and no finding of liability was made.
To the practice. A settlement of that size is not a line item — it is often more than a small practice clears in a year. It is typically paid from operating cash or a loan against the practice, on top of repaying the underlying claims. Payroll still runs. Rent still comes due. Practices close over this, and when one does, every person on that payroll loses a job over a check nobody ran.
To the owner personally. Settlements are public and permanent. They are found by payers during credentialing, by hospitals during privileging, by partners during due diligence, and by anyone who searches the practice name. And OIG's exclusion authority is not limited to the person who was excluded in the first place — owners and managing employees of a sanctioned entity can themselves be excluded under 42 U.S.C. § 1320a-7(b).
And exclusion is the end of the career, not a fine. An excluded physician cannot bill Medicare or Medicaid. Cannot be employed by anyone who does. Cannot have services they order or prescribe reimbursed — which means no group, no hospital, and no clinic can afford to keep them, because the exposure transfers. In most of medicine, roughly half of revenue touches a federal program. Losing access to it is not a setback. It is the practice.
All of it traces back to a name that was never checked against a list that is free, public, and updated every month.
Medicare and Medicaid pay claims first and verify later. That design is deliberate — providers would not participate if every claim were pre-audited — but it leaves the programs exposed on the back end. Congress's answer was to move enforcement to the perimeter: bar the people who have already defrauded the programs, abused patients, or lost their licenses, and place the duty to check on the provider who bills.
Congress first mandated exclusion of practitioners convicted of program-related crimes in 1977, and enacted the Civil Monetary Penalties Law in 1981.
Federal Medicaid dollars flow through the states. When a state pays a claim tied to an excluded person, that payment is not eligible for federal matching funds — the state absorbs the loss. That is what pushed enforcement down to the state level: states now maintain their own exclusion lists and pursue their own recoveries, because federal money is at stake on their books.
California maintains its own Medi-Cal Suspended and Ineligible list, separate from the federal LEIE. A provider clear on the federal list can still be suspended in California. Screening one list is not screening.
Medi-Cal S&I List · CA DOJ Medi-Cal Fraud & Elder Abuse
Under Welfare & Institutions Code §§ 14043.6 and 14123, DHCS must suspend a Medi-Cal provider who is convicted of a felony, convicted of a misdemeanor involving fraud or program abuse, suspended from Medicare or Medicaid for any reason, or who loses or surrenders a license to provide health care.
Suspension is automatic when any of those events occurs — and suspended providers are not entitled to a hearing under the California Administrative Procedures Act. Services rendered, prescribed, or ordered by a suspended provider are not covered by Medi-Cal while the suspension is in effect. Reinstatement is not automatic either: the provider must petition and re-enroll before being reimbursed again.
And under § 14043.61(a), you can be suspended for submitting claims connected to someone else's suspended provider. DHCS names the situations directly:
DHCS's own guidance says to cross-reference both the S&I List and the federal OIG LEIE — and warns that the S&I List is not all-inclusive. Temporary suspensions, payment withholds, and deactivations do not appear on the website at all.
Most practice owners have never read the statute — and that is exactly the exposure. The obligation to screen does not come from a vendor trying to sell you something. It comes from the Social Security Act and the Code of Federal Regulations, and it has been enforced against practices of every size, including solo physicians and small clinics, for years.
The core rule is simple and unforgiving: no federal health care program will pay for anything furnished, ordered, or prescribed by an excluded person. The moment an excluded individual touches a claim — as a hygienist, a nurse, a biller, a contractor, even a back-office administrator whose work feeds a billable service — every one of those claims becomes a violation. Not a warning. A violation, priced per item.
"OIG's LEIE must be checked on a monthly basis… To avoid CMP liability, health care entities should routinely check the list to ensure that new hires and current employees are not on it."
— HHS Office of Inspector General, Exclusions Program · oig.hhs.gov/exclusionsThere is no version of this where you opt out of the liability. You are responsible the day an excluded person touches a claim — whether the hire was deliberate or an honest oversight. The OIG's enforcement standard is "knew or should have known," and because the LEIE is public and free, the law expects you to have checked — so a good-faith "we didn't realize" unfortunately doesn't lift the liability. That is precisely why a simple, documented monthly screen matters.
It is rarely an investigator at your front door. The exposure surfaces three quiet ways:
1. Automated claims-matching. The OIG and CMS contractors cross-reference submitted claims data against the LEIE by computer. An excluded name on your claims can surface without anyone visiting your office.
2. Routine audits. During a payer or program audit, you are asked to produce your screening records. No dated proof of monthly screening is itself the finding.
3. Whistleblowers. A former employee or competitor reports you — and under the False Claims Act, they share in the recovery, which is why these reports happen.
Sources: HHS-OIG Exclusions Program; OIG Updated Special Advisory Bulletin on the Effect of Exclusion; 42 CFR Parts 1001 & 1003. All linked above resolve to oig.hhs.gov and ecfr.gov.
Not a story about someone else. The numbers.
The reason these numbers get large is that they multiply. A penalty is not assessed once per person or once per year — it attaches to every single claim that excluded person touched. A hygienist seeing eight Medicaid patients a day for a year is roughly two thousand claims, and each one is its own violation. Then the assessment is added on top of that. And the role does not have to be clinical: administrative, clerical, environmental, volunteer, and vendor relationships all count, because the test is whether the work contributed to something you billed. “We didn't know” is not a defense — the standard is what you knew or should have known, and the duty to check is yours.
A mid-size practice with one excluded person in a claims-touching role for eighteen months is not looking at a fine. It is repayment of every affected claim, treble assessments on top, and a corporate integrity agreement governing how the practice operates for years.
42 U.S.C. § 1320a-7a · OIG CMP authorities
The LEIE is a public database. So is California's S&I list. So is the OIG enforcement archive. Anyone can search them — a patient, a referring physician, a credentialing office, a payer, a journalist. Enforcement actions are published by name and stay published.
That cuts both ways. It is why screening your vendors and referral partners matters as much as screening your staff: you inherit their exposure through the claims you submit.
A simple list of staff, contractors, and vendors — names, plus NPI if you have it. No SSNs, no patient data, ever.
Against the federal exclusion and sanction lists — OIG LEIE, GSA/SAM, and OFAC — and flag the few that need a closer look.
A clean PDF showing who is clear and who to verify — the dated, attributed record an auditor asks for. Every month, on file.
We tell you exactly which few names to confirm at the official source before any action — so you act on certainty, not a name collision.
The large compliance firms were built for hospitals and health systems: per-provider contracts, annual lock-ins, and a sales team that won't return a small practice's call. We were built for the practices they ignore.
Want to see the actual report first? Request a sample. When you're ready, choose your level.
Base covers the federal obligation every billing practice shares. Most owners start here — it's the check the OIG expects and the dated record an auditor asks for first. For many small practices, Base is all they need.
Plus is a tailored engagement for practices whose needs go beyond the federal baseline — additional state-level coverage, larger or multi-location rosters, deeper vendor screening, or audit-response support. Because every practice's situation is different, Plus is arranged by appointment, with a short onboarding step so we scope it correctly. An onboarding fee may apply depending on scope — nothing to worry about now; we confirm everything with you before anything begins.
A full identity-verification tier with SSN confirmation is planned as a later addition to Plus, offered only by appointment and with proper onboarding. It is not part of the current Base service, and we will never ask you to send sensitive identifiers until such a tier is formally in place and agreed with you in writing.
Your roster stays private. We only receive staff or vendor data after you're a client, under a short written agreement that spells out how it's handled — and we don't retain it if you leave. A sample report uses example data, so you can see exactly what you'll get without sending us anything confidential.
Not sure which fits today? Start on Base. You can request a Plus consultation the moment your needs change — and we'll confirm exactly what your state requires, and any onboarding fee, before you commit to anything. Or request a sample report to see the deliverable first.
"Full-service" means the provider investigates potential matches for you, rather than handing your team a list of maybes to resolve. Here is how C.F.A.I. compares to the established full-service providers. Competitor figures are drawn from an independent 2025 secret-shopper evaluation for an organization screening roughly 2,000 records; rates and terms may have changed since — always confirm current pricing with each provider.
| C.F.A.I. | Exclusion Screening |
Verify Comply |
Provider Trust |
Streamline Verify |
|
|---|---|---|---|---|---|
| Contract required | None — monthly | 1-year | 1-year | 1-year +5%/yr | 1-year |
| Setup fee | $0 | $200 | $2,640 | $1,500 | None |
| Monthly price | $310 flat | $460 | $602 | ~$1,300 | $3,500 |
| SSN handling | Stays in your practice | Not specified | SSN matching | SSN matching | Not specified |
| How matches get resolved | Automated + human-reviewed | Portal + team | Portal | Portal | Portal |
| Who it fits | Solo, group, multi-site | All sizes | All sizes | Hospitals | Enterprise |
| Full-service investigation | Yes | Yes | Yes | Yes | Yes |
| Federal lists (LEIE/SAM/OFAC) | Yes | Yes | Yes | Yes | Yes |
| State Medicaid lists | 17 states + growing | Multi-state | Multi-state | Multi-state | Multi-state |
| How you get your report | Emailed PDF — no login | Portal login | Portal login | Portal login | Portal login |
On SSNs: OIG guidance states that a name match alone is not sufficient and that definitive verification requires an SSN or EIN entered on OIG's own site. C.F.A.I. does not collect, transmit, or store Social Security numbers — that step is performed by your staff, on your systems, directly with OIG. Competitor entries reflect each provider's published descriptions of their verification method, not their data-retention practices. On the portal: a self-serve portal hands your office manager a list of possible matches to resolve. That is the work — and it is the part that gets skipped when the office is busy. C.F.A.I. resolves matches before the report reaches you. Competitor pricing and features reflect a September 2025 independent secret-shopper evaluation and each provider's published materials; figures may have changed — confirm directly. C.F.A.I. is the most affordable transparent, no-contract, no-setup full-service option shown. State coverage expands over time; we confirm exactly which lists apply to your practice before you rely on us for them. C.F.A.I. never stores Social Security numbers under its Base service.
Tell us a little about your practice and we'll send you a sample report — the real format, the real flags, the exact documentation you'd receive each month. No roster required to see it. When it fits, you subscribe, and the screening begins.
Request a Sample Report