OIG Exclusion Check: The 2026 Excluded-Provider Landscape

A provider barred from Medicare in one system is not necessarily barred everywhere a screener looks. The United States has no single master registry of excluded health-care providers. Instead it has a patchwork: the federal OIG List of Excluded Individuals and Entities (the LEIE), the government-wide SAM.gov debarment list run by the General Services Administration, and a Medicaid exclusion program in each state, every one of them maintained on its own authority and its own clock. This study assembles the exclusion sources observed in production on July 14, 2026 into one picture and asks the question a compliance officer actually has to answer: how many providers were barred somewhere — and how much did any single list miss?

The excluded-anywhere population, in one number

At the July 14 audit cutoff, 10,824 distinct providers with a National Provider Identifier were barred from a public health program across the three exclusion layers analyzed. That is the de-duplicated union of the federal OIG LEIE, the federal SAM.gov debarment list, and the 13 state Medicaid exclusion programs loaded in production, counting each provider once however many lists name them, and restricted to records that were in force and carried an NPI.

The number that matters next to it is what the single most complete list covers. The OIG LEIE — the list compliance programs treat as the federal master — names 6,880 of those 10,824, or 63.6%. Screen the LEIE alone and 3,944 barred providers, 36.4% of the excluded-anywhere population, return as having no exclusion on file. No single source names even two-thirds of the population on its own.

Count by source

Each list is large in records but smaller in NPI-identified providers, because most exclusion records carry no NPI at all. The table below reports each source at two grains: distinct in-force providers that carry an NPI (the matchable population), and the in-force records that carry no NPI (reported separately, never matched by name).

The "excluded anywhere" row de-duplicates on NPI: 6,880 + 4,694 + 4,949 sums to 16,523, but the distinct union is 10,824, because thousands of providers appear on more than one list. The no-NPI column is a record count, not an entity count — those rows cannot be de-duplicated across lists because there is no identifier to join them on.

Overlap: how much each list misses

The three exclusion layers are complementary, not redundant. 6,031 of the 10,824 barred providers — 55.7% — appear on only one of the three, and just 906 appear on all three. A screener who checks two of the three lists still cannot reach the more than six thousand providers who sit on a single list.

Broken out by which list carries the single-source-only providers, the state lists and the LEIE each hold a large block that no other source names:

The pairwise overlaps show where the lists reinforce each other. The federal pair — LEIE and SAM.gov — agree most often, which is expected because SAM.gov ingests OIG exclusion actions as part of the government-wide debarment feed. The state lists overlap the federal lists far less.

There is no master list. The most complete single source names 63.6% of barred providers; check it alone and you clear over a third of them as having nothing on file.

The state Medicaid layer

At the July 14 audit cutoff, 4,949 distinct NPI-identified providers were barred by one of the 13 analyzed state Medicaid programs, and that layer was the one federal-only screening missed most — it overlapped the federal lists less than the federal lists overlapped each other. As we documented in the federal–state exclusion gap study, most state-barred providers carried no matching federal LEIE record at all.

State Medicaid agencies act under their own authority and timeline. A state can bar a provider for a Medicaid-specific reason — a state license action, a fraud referral, an administrative termination — without a federal exclusion ever following. The OIG may adopt many of these under its permissive §1128(b) authority, but adoption is discretionary and lagged, which is why a large standing block of state bars never reaches the LEIE.

Compromised but operating: agreements and penalties

A separate layer marks providers under federal monitoring or penalty who are not excluded — still enrolled, still billing, but flagged. At the July 14 audit cutoff, the OIG Corporate Integrity Agreements and CMS civil money penalty sources contained 127 active agreements and 16,277 penalty records across 6,884 facilities. Neither source can be matched to the exclusion universe by NPI because neither carries one.

An OIG Corporate Integrity Agreement is a negotiated settlement under which an entity accepts years of compliance obligations in exchange for staying in the federal programs. There are 127 agreements in force out of 333 distinct entities in the file. The list is keyed to an entity name and a slug; it publishes no NPI.

A CMS civil money penalty is a fine or payment denial levied on a facility — most often a nursing home — short of termination. Production contained 16,277 such penalty records across 6,884 distinct facilities over its reporting window at the audit cutoff. The penalty file is keyed to a CMS certification number (CCN), the facility identifier; it, too, publishes no NPI.

Because both sources are identifier-disjoint from the NPI-keyed exclusion lists, they are reported here as their own layer and are never joined to the 10,824-provider population. A facility under a civil money penalty or an entity under an integrity agreement is a different — and weaker — signal than an exclusion: it says the provider was penalized or is monitored, not that it is barred from billing.

The providers with no NPI at all

363,004 in-force exclusion records carry no NPI, and they are a screening problem of their own. The matchable population of 10,824 sits inside a far larger body of records: 286,487 no-NPI records on SAM.gov, 61,030 on the OIG LEIE, and 15,487 on the state Medicaid lists. The LEIE in particular carries an NPI on only about one record in ten, a limitation we examine in the OIG exclusion-list reference study.

These records name a barred party — by business name, by individual name, by a UEI on SAM.gov — with no identifier that maps to the other lists. Matching them across sources would require a name match, and a name match is not a defensible identity assertion, so Fonteum does not attempt one. They are held out of the matchable universe and counted only as records. The practical implication is blunt: NPI-based cross-list screening cannot reach these parties, so they compound the gap rather than shrink it.

What this means for screening compliance

No single list is a complete exclusion check, and the spread here puts a number on it: the most complete source, the OIG LEIE, names 63.6% of the NPI-identified barred population, and more than half of that population sits on only one of the three layers. The OIG's own guidance is that a billing organization or contractor must screen against all applicable exclusion lists — federal and the relevant state Medicaid lists — before submitting claims or contracting, and on an ongoing basis. Billing for or contracting an excluded party in a federally billable role carries civil monetary penalty exposure under a "knew or should have known" standard.

The constructive read is that the layers do something together that none does alone. At the July 14 cutoff, the LEIE was national but NPI-sparse and lagging; SAM.gov was government-wide but mostly entity-keyed; and the 13 loaded state lists were program-specific but jurisdictionally fragmented. Checked together, they closed gaps in each other. The production state table contained 22,917 source records across those 13 states. Fonteum exposes the federal OIG LEIE and state exclusion data through its supported lookup surfaces. It is a screening aid: re-confirm any match against the primary source before acting. An absence becomes a no-match only when serving coverage reconciles to the latest comparable artifact; otherwise it is indeterminate and is not a clearance.

Methodology

Every figure is a direct query against public, read-only production tables at a literal DATE '2026-07-14' cutoff: oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 records), sam_exclusions (323,930 active, in-force records at the cutoff), and state_exclusions (22,917 records across 13 state Medicaid programs). The prior 167,582 SAM figure counted rows missing exclusion_date; it was not the source universe. The compromised-but-operating layer reads oig_cia_agreements and cms_civil_money_penalties, both also public and read-only.

The join key throughout is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match. A LEIE or state record is treated as in force when its reinstatement date is null or later than the literal audit cutoff. A SAM record must also have status = 'Active', with a null or later termination date; an "Indefinite" term stores as null and stays in force. The matchable universe is the distinct set of in-force, NPI-identified providers across the three exclusion layers; per-source coverage is each source's distinct in-force NPI divided by that universe of 10,824; overlap is the count of the three layers a provider's NPI appears on. The compromised layer is read separately and never NPI-joined, because neither oig_cia_agreements (entity-name keyed) nor cms_civil_money_penalties (CCN keyed) carries an NPI. The exact SQL is in the reproducibility block below, and the provenance methodology documents the source-provenance contract. Methodology version: exclusion-landscape/v1.

Limitations

• NPI is the floor, not the ceiling. 363,004 in-force exclusion records carry no NPI and are excluded from the 10,824-provider universe; they are reported as record counts and never matched by name. The true barred population is larger than 10,824.
• The compromised layer is unmatchable by identifier. At the July 14 audit cutoff, OIG integrity agreements and CMS penalty records carried no NPI, so its 127 agreements and 16,277 penalty records could not be tied to the exclusion universe or to one another by NPI. They are a distinct, weaker signal reported on their own terms.
• Thirteen states in this study, not fifty. The state Medicaid layer covers 13 programs. The 4,949 figure describes that 13-state production slice, not the nation.
• Snapshot, not cumulative. Every list is point-in-time. The LEIE release, the SAM.gov extract, and each state file shift over time; these figures reflect the July 14, 2026 audit cutoff.
• A compliance signal, aggregate-only. Exclusion and penalty counts are an enforcement and screening signal, never a measure of care quality. No individual barred party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — HHS Office of Inspector General, monthly. The federal exclusion list.
• SAM.gov — exclusions — U.S. General Services Administration, daily. The government-wide debarment list.
• OIG — Corporate Integrity Agreements — HHS Office of Inspector General. The monitored-compliance settlements.
• CMS — Civil Money Penalties dataset — Centers for Medicare & Medicaid Services. Fines and payment denials by facility.
• Fonteum — state Medicaid exclusion data — the production table observed July 14 contains 22,917 records across 13 states.
• New York OMIG — Medicaid exclusions — the New York state source.
• Pennsylvania DHS — sanctioned providers (Medicheck) — the Pennsylvania state source.
• Ohio Department of Medicaid — provider exclusion and suspension list — the Ohio state source.
• North Carolina DHHS — Medicaid provider sanctions — the North Carolina state source.
• Georgia DCH — Office of Inspector General — the Georgia state source.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the permissive §1128(b) authority.