The Audit-Ready Compliance Package
Give us a National Provider Identifier and we return a signed, dated attestation of an exclusion and integrity screen — the federal sources and supported state Medicaid lists currently loaded, the per-source result with its category and snapshot date, the full provenance behind each source, and an Ed25519 signature chained to Fonteum’s append-only attestation chain. The same document is available as machine-readable JSON and as a human-readable PDF.
What the document records
- The subject NPI and the resolved graph entity it maps to.
- Every source actually consulted — OIG LEIE, SAM.gov, the supported state Medicaid exclusion lists currently loaded, OIG Corporate Integrity Agreements, CMS Civil Money Penalties, and any other source named in that screen. The artifact does not claim coverage of the other states.
- The per-source result — excluded, compromised-flag, no-match, or indeterminate — with its category, the snapshot date of the list version screened, and the methodology version.
- The full 14-field provenance record for each source.
- The check timestamp, the document SHA-256, and the Ed25519 signature.
How it is signed and chained
The attestation body is canonicalized and hashed with SHA-256. That hash is bound to the current head of Fonteum’s append-only attestation chain and signed with Ed25519. Anyone can recompute the hash from the document, re-derive the chain-bound identifier from the published chain head, and check the signature against the public key published at /.well-known/chain-public-key. A no-match result is issued only when the serving tables reconcile to the latest comparable attested source artifacts. Stale or unreconciled coverage is signed as indeterminate and is not a clearance.
Where it fits
CMS audit response
Attach a dated, signed record of the exclusion + integrity screen you ran on a billing provider, with the snapshot date of each list at the moment of the check.
OIG inquiries
Show which lists were consulted — OIG LEIE, SAM.gov, the supported state Medicaid exclusion lists currently loaded, OIG Corporate Integrity Agreements, and CMS Civil Money Penalties — and the per-source result. Other states are not covered.
NCQA / CAQH / URAC credentialing
Keep a reproducible screening-evidence artifact in the practitioner file: the document hash and the published signing key let a reviewer confirm the record was not altered after signing.
False Claims Act evidentiary use
A timestamped, signed screen documents diligence at a point in time. The attestation states what it asserts and what it does not — it is screening evidence, not a legal certification.
How to consume it
Signed JSON attestation for a single NPI:
GET https://fonteum.com/api/v1/exclusions/{npi}/attestationHuman-readable PDF package (same signed body):
GET https://fonteum.com/api/v1/exclusions/{npi}/attestation/pdfAnonymous access is rate-limited; an API key raises the limit. Every response carries an X-Fonteum-SHA256 header matching the document hash. A signed-vs-JSON consumer checks the signature against the published chain public key; an auditor files the PDF.
This package is screening evidence, not a credentialing decision or a legal certification. Re-confirm any flagged or excluded result against the primary source list before taking adverse action.
Reviewed by Dr. Jennifer Montecillo, MD, medical reviewer. Non-practicing medical reviewer. Questions: hello@fonteum.com.