No single exclusion list tells a health plan who it can pay. The federal government keeps an exclusion list, and so do many state Medicaid programs. CMS keeps a separate list for Medicare Advantage and Part D, and a government-wide system records federal debarments. The lists were built by different agencies for different purposes. They also update on different schedules.
The overlap between them is smaller than many screening programs assume. State exclusions can take months to reach the federal list, and some may never reach it. The CMS Preclusion List includes some excluded clinicians but not all, and it adds others who were never excluded. A plan that checks 1 list and calls its network clean has checked part of its network.
The argument here is that sanctions monitoring should work like a feed, with every match resolved by a person and every check kept on the record.
Key takeaways
- The lists overlap only in part. Federal and state exclusion lists hold different records, and the CMS Preclusion List follows its own criteria.
- Federal rules set monthly checks. States must check the federal exclusion list and SAM at least monthly for Medicaid providers. Medicaid managed care plans may not contract with excluded providers.
- Preclusion follows a 90-day path. Plans must notify affected enrollees within 30 days of a new listing, and claims are denied from the 91st day of preclusion.
- NCQA widened monitoring in 2026. Accredited plans must monitor sanctions in every state where a clinician practices, under a policy change released March 30, 2026.
- Enforcement continues. OIG excluded 1,212 individuals and entities between October 2025 and March 2026. Providers keep paying penalties for employing excluded staff.
- Monitoring should work like a feed. Each list update should trigger a check. A person should resolve each match, and every check should leave a record.
The lists and what each one covers
The lists that matter most for a health plan network come from 4 sources. Each bars a different kind of payment or participation.
| List | Kept by | What it bars | How often it changes |
|---|---|---|---|
| List of Excluded Individuals and Entities | HHS Office of Inspector General | Federal health care program payment for the excluded party’s services and orders | Monthly |
| SAM.gov exclusions | General Services Administration | Federal contracts and assistance for debarred or suspended parties | As agencies enter actions |
| State Medicaid exclusion lists | Each state Medicaid agency | Participation in that state’s Medicaid program | Varies by state |
| Preclusion List | CMS | Medicare Advantage payment for items and services, and Part D payment for drugs the party prescribes | About every 30 days |
Compiled from the federal rules and agency guidance cited below.
The OIG exclusion list
The List of Excluded Individuals and Entities, or LEIE, is the list most programs check first. Federal health care programs cannot pay for items or services that an excluded party furnishes. The bar also covers what the party orders or prescribes, according to OIG’s 2013 bulletin on the effect of exclusion.
The reach is wider than clinical care. The bulletin says excluded persons are “prohibited from furnishing administrative and management services” paid for with federal program funds. That is why the list matters for a plan’s own staff, not only its network.
OIG updates the LEIE monthly and recommends that providers use it as the primary source for OIG exclusions. It also recommends monthly screening. In the bulletin’s words, “screening employees and contractors each month best minimizes potential overpayment and CMP liability,” referring to civil monetary penalties.
The list keeps growing. OIG excluded 1,212 individuals and entities in the first half of fiscal year 2026, according to its spring 2026 semiannual report. Individuals accounted for 1,183 of them. The other 29 were entities.
SAM.gov and federal debarment
SAM.gov is the government-wide system for federal exclusions, run by the General Services Administration. Its records cover parties that federal agencies have debarred or suspended from federal contracts and assistance, according to the federal acquisition rules.
SAM matters to health plans because Medicaid rules name it. State Medicaid agencies must check it alongside the LEIE, as described below. Its records identify a party by name and address, with a federal entity identifier where one exists. Matching an individual clinician against SAM therefore leans heavily on the name.
State Medicaid exclusion lists
Many state Medicaid agencies publish their own exclusion lists. A December 2024 review by OpenSanctions, which compiles sanctions data, found published lists it could collect in 37 states. The lists vary widely in size. California’s was the largest in that review, with more than 22,000 records.
State exclusions do not flow automatically into the federal list. ProviderTrust, a screening vendor, wrote in its review of the spring 2026 OIG report that state exclusions “can take months to be reflected on the federal LEIE.” A clinician excluded by a state’s Medicaid program can appear clean on a federal-only check in the meantime.
Federal rules link state programs in a narrower way. A state Medicaid agency must deny or end the enrollment of a provider that Medicare or another state has terminated, under 42 CFR § 455.416. That rule depends on terminations recorded in a federal termination database, not on every entry in every state’s exclusion list.
The CMS preclusion list
The Preclusion List is CMS’s tool for Medicare Advantage and Part D. Medicare Advantage plans must deny payment for items and services furnished by a precluded individual or entity. Part D sponsors must reject claims for drugs that a precluded prescriber prescribed, according to CMS.
CMS adds a party to the list in 3 situations, each tied to a finding that the conduct is detrimental to Medicare.
- Revocation. CMS has revoked the party’s Medicare enrollment, and a reenrollment bar is in effect.
- Conduct that would justify revocation. The party is not enrolled, but its conduct would have been grounds for revocation.
- A felony conviction. The party was convicted of a felony under federal or state law within the previous 10 years.
Exclusion and preclusion overlap but do not match. In CMS’s answers to plan questions, excluded providers appear on the Preclusion List only if they meet its criteria. Precluded providers who are not excluded do not appear on the exclusion file. Plans have to check both.
The Preclusion List also runs on its own clock. CMS makes updates available about every 30 days, and each monthly file is a full list. A plan must notify affected enrollees no later than 30 days after a new listing is posted. Enrollees get at least 60 days of notice, and claims are denied from the 91st day of preclusion. Under CMS’s guidance, only plans with a valid health plan identifier can download the list.
What the rules require plans to check
The checks a plan must run depend on the program it serves and on its accreditation.
| Requirement | Who it binds | What it requires | Source |
|---|---|---|---|
| Federal database checks | State Medicaid agencies | Check the LEIE and SAM at least monthly, and check the Death Master File and NPPES at enrollment | 42 CFR § 455.436 |
| Checks on managed care contractors | States, for each Medicaid managed care plan | Check the same databases when contracting and at least monthly after that | 42 CFR § 438.602(d) |
| No excluded providers in the network | Medicaid managed care plans | Do not employ or contract with providers excluded from federal health care programs | 42 CFR § 438.214(d) |
| Terminations carry across states | State Medicaid agencies | Deny or end enrollment of providers terminated by Medicare or another state | 42 CFR § 455.416(c) |
| Preclusion | Medicare Advantage plans and Part D sponsors | Deny payment for precluded parties after the notice period | 42 CFR § 422.222 |
| Deceased provider checks | State Medicaid agencies, from January 1, 2028 | Check the Death Master File for enrolled providers each quarter | 2025 budget law, section 71105 |
| Ongoing monitoring | NCQA-accredited plans | Monitor sanctions and exclusions between credentialing cycles, in every state of practice | NCQA CR 5 |
Compiled from the regulations cited and NCQA’s 2026 updates. The budget law entry draws on a law firm summary.
The Medicaid rules are the most specific. A state must confirm the identity and exclusion status of its Medicaid providers through routine checks of federal databases, under 42 CFR § 455.436. The LEIE and the Excluded Parties List System, now part of SAM, must be checked “no less frequently than monthly.” For managed care, the state runs the same checks on each plan and its subcontractors under 42 CFR § 438.602. Each plan must keep excluded providers out of its network under 42 CFR § 438.214.
The budget law signed in July 2025 adds a new check. From January 1, 2028, state Medicaid programs must check the Social Security Administration’s Death Master File each quarter for enrolled providers. The same check applies when a provider enrolls or reenrolls, according to a Foley Hoag summary of section 71105.
NCQA’s standards apply to accredited plans. Its ongoing monitoring standard is CR 5. It expects plans to monitor sanctions and exclusions between credentialing cycles at least every 30 days, as our review of NCQA’s 2026 requirements described. A policy change released March 30, 2026 extends that monitoring “for all states in which the practitioner practices,” as our piece on licensure compacts noted.
NCQA also lists the sources it accepts, in a change released on November 17, 2025. For exclusions, NCQA accepts the state Medicaid agency or the OIG exclusion list. It also accepts the National Practitioner Data Bank. For sanctions, its list adds SAM.gov and several physician databases, according to its 2026 policy updates. A plan can meet the standard with 1 source for each factor. Meeting the standard is not the same as seeing every list.
Where the gaps are
Set the lists side by side and the gaps fall into 4 kinds.
Coverage gaps. A federal-only check misses state exclusions that have not reached the LEIE. ProviderTrust’s review put it bluntly, saying that “relying on the LEIE alone leaves real gaps in coverage.” A check against state lists has its own blind spot, because it says nothing about preclusion.
Timing gaps. Each list updates on its own schedule, and each plan checks on its own schedule. A monthly check against a monthly list leaves weeks in which an exclusion is public but unseen. The Preclusion List adds a notice period of its own before claims stop.
| List | How often it changes | Required check | When payment stops |
|---|---|---|---|
| LEIE | Monthly | Monthly for Medicaid, and monthly screening recommended by OIG | From the effective date of the exclusion |
| SAM.gov | As agencies enter actions | Monthly for Medicaid | Under the terms of each agency action |
| State Medicaid lists | Varies by state | Varies by state | Under state rules |
| Preclusion List | About every 30 days | Monthly download by plans | From the 91st day of preclusion |
Compiled from the sources cited in this analysis.
Identity gaps. The lists identify people differently. Some records carry an NPI, and others rely on a name and an address. A common name produces false matches, and a changed name can produce a false miss.
Scope gaps. Exclusion reaches beyond clinicians. The OIG bulletin applies the payment bar to administrative and management services, so a plan’s own staff belong in the check along with its vendors. The same is true of the entities a plan delegates credentialing to.
A clean result against 1 list is a fact about that list. It is not a fact about the network.
What a missed match costs
For providers, the cost is a civil monetary penalty for each item or service an excluded person furnished. OIG’s enforcement pages show the pattern. Denver Springs of Englewood, Colorado, agreed in April 2026 to pay $625,671.66 after disclosing to OIG that it had employed an excluded individual, according to OIG. In July 2026, Advanced Health Care of Colorado Springs agreed to pay $500,019.53 in a case involving an excluded individual who worked as a medication and treatment nurse, according to OIG.
Both cases involved providers, not plans. Plans carry their own exposure. CMS can sanction a Medicare Advantage organization that employs or contracts with an excluded person to provide health care or utilization review, among other services, under 42 CFR § 422.752. In Medicaid managed care, a payment to an excluded provider is a payment the regulations say the plan should never have made.
The older evidence shows why monthly checks became the norm. In a 2012 evaluation, OIG matched about 46,000 exclusion records against about 277,000 network records at 12 Medicaid managed care plans in 10 states. It found 11 excluded providers in the networks of 4 plans, and 4 of those providers had been paid. The plans rechecked the LEIE at intervals ranging from monthly to every 3 years.
The amounts in that review were small. The lesson was about method. Every plan in the review had safeguards, and excluded providers still got through. Checks that run on long intervals leave room for exactly that.
Monitoring as a feed
Most sanctions monitoring still works like a calendar. Once a month, a team or a vendor runs the network against the lists and reviews the matches. Between those dates, the plan’s view of its network is frozen. Our piece on credentialing as a feed argued that a credential should update when its source changes. Sanctions monitoring is the clearest case for that design.
- Check when a list changes. Each list update should trigger a check of the whole network against the new records, rather than waiting for the next calendar date.
- Match on more than a name. A match should compare every identifier the list offers, such as the NPI and the date of birth.
- Treat a match as a lead. A person should confirm a match before any termination or payment hold. Our piece on anomaly scores made the same case for fraud analytics.
- Check every state of practice. NCQA’s 2026 change makes this a requirement for accredited plans. It makes sense for every plan, because a state exclusion can come from any state where a clinician practices.
- Keep a record of every check. Each record should name the version of the list it checked and what it found.
- Share confirmed results. A confirmed exclusion is a fact about a clinician, not about a plan. Our piece on verifying credentials once argued that plans should stop repeating the same verification, and confirmed matches are a natural place to start.
What a check record should carry
A record of each check turns monitoring from a claim into evidence. It needs a small set of fields.
- The list and its version. The source, with the date of the file the check used.
- The identifiers compared. Which fields matched and which did not.
- The result. Whether the check found no match or a possible one.
- The resolution. For a possible match, the person who reviewed it and the evidence they relied on.
- The action taken. Any change to network status or payment, with its effective date.
A record like this does 2 jobs. It shows an auditor that the plan checked. When a miss happens, it shows which list held the record and when the plan could first have seen it.
There are fair objections. Event-driven checks cost more than a monthly batch, and more frequent checks mean more possible matches to review. Possible matches often turn out to be different people with similar names. Those costs are real, but a monthly batch does not avoid them. It only gathers them on a single day each month, and it leaves the rest of the month unwatched.
Where Redlake stands
Redlake builds software that health plans use in utilization review, not a credentialing or screening system. Sanctions monitoring still touches our work directly. Medicare Advantage rules let CMS sanction a plan that uses an excluded person for utilization review, so the clinicians who review requests belong in the same checks as the network.
Our rules carry over. A machine can say yes, but only a person can say no. In monitoring, software can clear a clinician when no list holds a match. It can also open a review when one does. Ending a clinician’s participation or holding payment is a decision for a person.
Every recommendation shows its reasons, so the reviewer sees which identifiers matched and which did not. Every decision can be reconstructed, so a plan can show, for any date, which lists it checked and what they held. We think that record belongs in every credentialing file, next to the verifications themselves.
What to watch in the rest of 2026
- CMS guidance on deceased provider checks. Watch for guidance to states ahead of the January 2028 start of section 71105.
- The fall OIG semiannual report. Watch the exclusion count for the second half of fiscal year 2026.
- NCQA’s 2027 standards. Watch whether NCQA changes the sources it accepts for sanctions and exclusions.
- State exclusion lists. Watch for states that publish new lists or add identifiers to existing ones.
About this analysis
Method. The main exclusion and preclusion lists are compared with the federal rules and NCQA standards that tell plans when to check them, drawing on federal regulations and agency documents.
Data notes. The count of state lists comes from a data aggregator’s review in December 2024 and may have changed since. The settlement amounts come from OIG’s enforcement pages, which describe allegations resolved by settlement. The exclusion count covers October 2025 through March 2026. The feed model is this analysis’s proposal.
Sources. OIG bulletin on the effect of exclusion (May 2013). OIG spring 2026 semiannual report to Congress. OIG enforcement actions (April and July 2026). OIG evaluation OEI-07-09-00630 (February 2012). CMS Preclusion List page and plan guidance (December 2020). Federal regulations in Title 42 of the Code of Federal Regulations. Federal Acquisition Regulation § 9.404. OpenSanctions review of Medicaid exclusion lists (December 2024). ProviderTrust review of the spring 2026 OIG report (July 2026). Foley Hoag summary of the 2025 budget law. NCQA 2026 policy updates (March 2026).
Frequently asked questions
What is the difference between exclusion and preclusion?
Exclusion is an OIG action that bars payment from every federal health care program. Preclusion is a CMS designation that bars payment in Medicare Advantage and Part D. The 2 lists use different criteria, so a clinician can appear on 1 and not the other.
How often must health plans check exclusion lists?
State Medicaid agencies must check the LEIE and SAM at least monthly, and Medicaid managed care plans may not contract with excluded providers. Plans in Medicare Advantage and Part D download the Preclusion List each month. NCQA expects accredited plans to monitor sanctions at least every 30 days.
Does the federal exclusion list include state exclusions?
Not reliably. States keep their own Medicaid exclusion lists, and state actions can take months to appear on the LEIE. A federal-only check can miss a clinician excluded by a state.
What does NCQA require for sanctions monitoring?
NCQA’s ongoing monitoring standard is CR 5. It expects plans to monitor sanctions and exclusions between credentialing cycles. A March 2026 policy change extends that monitoring to every state where a practitioner practices.
What happens if a provider employs an excluded person?
Federal programs cannot pay for the excluded person’s services, and OIG can seek civil monetary penalties for each item or service. OIG resolves many of these cases through settlements, including 2 Colorado settlements in 2026.