Barred but billable: excluded providers still enrolled in Medicare

The OIG List of Excluded Individuals and Entities — the LEIE — is the federal registry of people and organizations barred from billing Medicare, Medicaid, and every other federal health program, directly or indirectly. CMS PECOS is the opposite list: the registry of providers whose Medicare enrollment is approved and active. A name should never sit on both. This study counts the names that do.

It joins the federal exclusion list against the active Medicare enrollment file on the National Provider Identifier — never on a name — and measures how many currently-excluded providers still carry a live enrollment record, broken out by state and by enrolled specialty.

The finding, in one number

19 currently-excluded providers still hold an active Medicare enrollment record. Of the 6,880 in-force, NPI-identified providers on the federal LEIE, 19 also appear in the CMS PECOS Ordering & Referring extract — the file of providers whose enrollment is approved and eligible to order and refer. The other 6,861 are correctly absent: the screening machinery, in aggregate, does what it is supposed to.

That makes 19 a residual, not a rate of failure — 0.28% of in-force NPI-identified exclusions. But it is the residual that carries the legal weight. Employing, contracting, or billing through an excluded provider exposes an organization to civil monetary penalties under a "knew or should have known" standard, and every one of these 19 is a live enrollment record that a payer's automated edit could wave through.

The 19 distinct providers carry 20 enrollment records — one provider holds two — and one of the 20 is an organizational enrollment rather than an individual. The remaining 19 records are individual practitioners.

How the two lists are supposed to interlock

An OIG exclusion and a CMS enrollment revocation are separate administrative acts, run by separate agencies on separate clocks. The OIG adds a party to the LEIE; CMS, on notice, is expected to revoke the matching Medicare enrollment so the provider can no longer order, refer, or bill. The design intent is that the LEIE leads and the PECOS revocation follows within one processing cycle.

The reason the follow-through is not instantaneous is structural. PECOS revocation is keyed to enrollment identity — the enrollment ID and NPI — while an OIG exclusion is published against a person. CMS must match the excluded person to the right enrollment record, effect the revocation, and let it propagate into the next public extract. Each step adds latency, and the two public files are snapshots pulled on different dates: the LEIE release here carries exclusions through 2026-05-20, while the PECOS extract was released 2026-05-28. A provider excluded in the final days before a release can still appear enrolled in a file pulled a week later, with the revocation simply not yet processed. We documented the analogous gap between a triggering event and CMS deactivation in the lag between a termination event and CMS deactivation.

An exclusion is a wall around the federal programs. Nineteen providers are standing on the wrong side of it with an active enrollment record still in hand.

What the 19 look like — by state and specialty

The 19 are spread across 13 states. No single state dominates: New York carries three, five states carry two, and seven carry one each. The thinness is itself the point — this is not a concentrated processing failure in one Medicare Administrative Contractor's territory; it is a handful of records scattered across the country.

By enrolled specialty the spread is just as flat. Family practice leads with four; clinical social work and internal medicine carry two each; the remaining eleven providers are spread one apiece across eleven distinct specialties.

Lag versus standing failure

The split that matters most is by exclusion age, because it separates the cases a refresh cycle explains from the ones it does not.

Seventeen of the nineteen were excluded inside the last 90 days. For those, the benign reading holds: the exclusion is newer than the enrollment extract's processing window, and the matching revocation is most likely already in train. The number to watch on those is whether it clears at the next refresh.

The two older records do not get that benefit of the doubt. One was excluded more than a year ago; the oldest has been on the LEIE since June 2015 and still carries an active enrollment record today. No snapshot-timing argument reaches an eleven-year-old exclusion. Those are the cases worth a primary-source look.

The severity mix sharpens the same point. Eight of the 19 sit on a mandatory §1128(a) exclusion basis — the conviction-driven category that includes program-related crime, felony health-care fraud, and felony controlled-substance offenses — rather than the more routine §1128(b)(4) license action. Ten of the 19 are §1128(b)(4) license-revocation or surrender cases, and one is a §1128(b)(1) ownership-or-control basis. A mandatory exclusion is the most serious bar the OIG issues; eight of them still attached to a live enrollment record is the part of this finding that does not soften with context.

The unmatchable majority

The 6,880 figure is itself a small slice of the full exclusion list, and that is its own screening problem. The LEIE holds 68,055 active records, but only 7,025 — about one in ten — carry an NPI at all. The other 61,030 records name an excluded party with no NPI, so they cannot be matched to a Medicare enrollment record by identifier.

These 61,030 records are excluded from the denominator above, because matching them to an enrollment record would require a name match — and a name match is not a defensible identity assertion. We do not guess. But the practical implication is blunt: NPI-based enrollment screening cannot see these parties at all. The LEIE's NPI sparsity, which we documented in the LEIE reference study, means an identifier-only screen reaches only the matchable tenth, and a complete exclusion check has to fall back to name-and-date-of-birth matching on the rest — exactly the workflow CMS and OIG guidance contemplate, and exactly the workflow an automated NPI edit skips.

What this means for screening compliance

The constructive read is that the federal plumbing mostly holds: 6,861 of 6,880 in-force NPI-identified exclusions carry no active enrollment, and most of the 19 exceptions look like they will clear at the next cycle. The cautionary read is that "mostly" is not the standard the penalty regime applies. An organization that bills a federal program through an excluded provider's enrollment is exposed under a "knew or should have known" test whether the exclusion is one week old or eleven years old.

Two operational lessons follow. First, an enrollment record is not a clearance — a provider can be actively enrolled and federally excluded at the same instant, so an exclusion screen has to run against the LEIE in addition to confirming PECOS enrollment, not instead of it. Second, identifier-only screening is a floor, not a ceiling: it reaches one in ten exclusion records, and the rest demand name-based matching against the primary source. Fonteum exposes both layers through a single NPI lookup — the federal OIG LEIE and the Medicare enrollment data — so a "barred anywhere on the lists we hold" answer does not depend on which single list a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds," never as a clearance.

Methodology

Every figure is a direct join between two public, row-level-signed Postgres tables: oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 active records, 7,025 with an NPI) and pecos_providers (the CMS PECOS Ordering & Referring extract, federal release 2026-05-28, 2,981,799 enrollment records across 2,556,656 distinct NPIs). Both ship RLS Pattern B — public read. The join key is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match.

A LEIE record is treated as in force when its reinstatement date is null or still in the future relative to the publish date — the same test the production exclusion lookup applies. Because the OIG drops reinstated parties from the published file, that in-force set equals "any LEIE row by NPI." A provider counts as actively enrolled when its NPI is present in the PECOS Ordering & Referring extract, which is by construction the file of approved enrollments eligible to order and refer. The matchable denominator is the set of distinct, in-force, NPI-identified exclusions; LEIE records with no NPI are excluded from it and reported separately. The excluded-and-enrolled count is the subset of those NPIs that also appear in PECOS. The exact SQL is in the reproducibility block below, and the provenance methodology documents the row-level signing contract. Methodology version: excluded-enrollment/v1.

Limitations

• A floor, not the ceiling. Only 7,025 of 68,055 LEIE records carry an NPI; the other 61,030 cannot be matched to an enrollment record by identifier and are reported separately, never guessed at by name. The 19 is the count among the matchable tenth.
• Snapshot, not real time. Both files are point-in-time. The LEIE carries exclusions through 2026-05-20; the PECOS extract was released 2026-05-28. A revocation in progress between those dates can leave a record looking enrolled when the matching action is already filed.
• Enrollment record, not billing activity. Presence in the PECOS Ordering & Referring file is an active enrollment eligible to order and refer; it is not evidence that the provider has billed since exclusion. This study counts enrollment status, not claims.
• Records exceed providers. A single NPI can hold multiple enrollment records across provider types or states, so the 19 distinct providers map to 20 enrollment records, one of them organizational.
• A compliance signal, aggregate-only. This is an enrollment-and-screening signal, never a measure of care quality. No individual excluded party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — the federal exclusion list, the bar side of the join.
• OIG — effect of an exclusion (screening duty, civil monetary penalties) — the obligation to screen and the "knew or should have known" penalty standard.
• CMS PECOS Ordering & Referring dataset — the active Medicare enrollment file, the billable side of the join.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the mandatory §1128(a) and permissive §1128(b) authorities.