How Often Do You Have to Check the OIG Exclusion List (LEIE)? What Is Required and What Is Only Recommended

Four terms before anything else. The LEIE is OIG's List of Excluded Individuals and Entities, the federal exclusion database, and it is what most administrators mean when they say the OIG exclusion list. A CMP is a civil money penalty, the fine OIG can impose on you. SAM is the System for Award Management at sam.gov, a separate governmentwide record. A federal health care program is any plan or program providing health benefits funded directly or indirectly by the United States, plus any state health care program. That takes in Medicare, Medicaid and CHIP, Medicare Advantage and Part D plans, TRICARE and VA care. The one carve-out is the Federal Employees Health Benefits Program, which is not a federal health care program for this purpose (HHS-OIG, General Compliance Program Guidance (2023)).

Now the answer, by situation:

These stack. Most Florida home health agencies and hospices sit in more than one row: Medicare-certified, Medicaid fee-for-service, and one or more managed care contracts. Where rows conflict, the strictest term governs, and in Florida that is monthly across three sources.

For most small providers the practical answer is still monthly. Choose it because it is the cadence OIG recommends and often the cadence your contract requires, not because a federal rule commands it.

Now the sentence almost no competing page will print. In its Updated Special Advisory Bulletin on the Effect of Exclusion, dated May 8, 2013, at page 15, OIG writes:

> Providers are not required by statute or regulation to check the LEIE.

A sentence later, after describing the LEIE as a tool OIG makes available so providers can identify excluded employees or contractors:

> Because there is no statutory or regulatory requirement to check the LEIE, providers may decide how frequently to check the LEIE.

And the reason for the monthly recommendation:

> OIG updates the LEIE monthly, so screening employees and contractors each month best minimizes potential overpayment and CMP liability.

Monthly screening *best minimizes* liability. OIG recommends it. It is not required.

So what is required? Three different things, and keeping them apart is the whole job:

1. The payment prohibition is law. No federal health care program will pay for an item or service furnished by an excluded person on or after the effective date in the exclusion notice (42 C.F.R. 1001.1901(b)(1)). Money already paid is an overpayment.
2. CMP exposure is law. The regulation permits OIG to impose a penalty on a person who arranges or contracts, by employment or otherwise, with an individual or entity it knows or should know is excluded, for the provision of items or services for which payment may be made under a federal health care program (42 C.F.R. 1003.200(b)(4)). Note that closing limit: the penalty attaches to arrangements for federally payable work.
3. A screening frequency binds you only when a state program or a contract imposes it. The underlying prohibition on employing an excluded person does not wait for a frequency. If you are Medicare-enrolled you have certified under 42 C.F.R. 424.516(a)(3) that you are not doing it, and that certification runs continuously.

Medicare certification does not set a frequency either. Home health agencies should note that the administrator standard at 42 C.F.R. 484.105(b)(1)(iv) requires the administrator to 'Ensure that the HHA employs qualified personnel, including assuring the development of personnel qualifications and policies.' That paragraph does not mention exclusion, the LEIE, SAM or any database check. The one place section 484.105 does touch exclusion is the services-under-arrangement standard at (e)(2), covered below, and it states a status condition rather than a search.

Because OIG leaves the interval to you, your policy has to say what you chose and why. Four questions set the floor:

1. Does a provider agreement, state rule or plan contract set a frequency? If yes, that is your floor and the analysis is over. Write the citation into the policy.
2. What share of your revenue is federal? The higher the share, the more of your workforce sits inside the payment bar, and the more a missed month costs.
3. How many contractors, agency nurses, locum clinicians and vendors are in scope? Populations that turn over between screenings are the ones that produce surprises.
4. What is your hiring and rehire rate? A pre-hire check plus a slow recurring cycle leaves a gap exactly where new risk enters.

Two model sentences you can adapt. Before you paste either one into a policy, confirm you actually hold the document it cites. If you are relying on paragraph 5(r), pull your executed Florida Medicaid provider agreement and read the paragraph in it. A policy whose only citation is to a term your agreement does not contain is the same defect this guide exists to correct, pointed at Florida instead of at the LEIE.

*If a contract binds you:* "This agency screens all employees and contractors monthly against the LEIE, SAM and AHCA's final order database. The frequency and the sources are set by paragraph 5(r) of our executed Florida Medicaid Provider Agreement, [form name and revision date]. Failure to comply with the provider agreement is sanctionable under Fla. Stat. s. 409.913(15)(e)."

*If you are choosing voluntarily:* "No federal statute or regulation requires this agency to check the LEIE, and OIG states that providers may decide how frequently to check (Updated Special Advisory Bulletin, May 8, 2013, p. 15). We screen monthly because OIG recommends monthly on the ground that it republishes the LEIE monthly, because monthly screening narrows the window in which we could be found to have known or had reason to know of an exclusion under 42 C.F.R. 1003.200(b)(4), and because our Medicare enrollment is conditioned under 42 C.F.R. 424.516(a)(3) on a continuing certification that we do not employ or contract with excluded or debarred persons."

An administrator who can explain why a frequency was chosen is in a stronger position than one repeating a rule that does not exist.

What an exclusion is, in three sentences. An OIG exclusion is a bar on federal health care program payment for what a person furnishes; it is not a license action and not a criminal record entry. Most of the seventeen permissive exclusion categories at 42 U.S.C. 1320a-7(b) involve no criminal conduct at all, which is why a clean criminal record proves nothing about exclusion status. And the point cuts the other way in Florida: the statute counts a person as convicted 'when the individual or entity has entered into participation in a first offender, deferred adjudication, or other arrangement or program where judgment of conviction has been withheld' (42 U.S.C. 1320a-7(i)(4)), so a withheld adjudication is a conviction for exclusion purposes even though Florida law says no conviction was entered.

An OIG exclusion is program-wide. Under 42 C.F.R. 1001.1901(a), exclusions 'will be from Medicare, Medicaid and any of the other Federal health care programs ...'. The argument that a Medicare exclusion does not matter because you only bill Medicaid does not work.

The bar is not limited to line-item claims. OIG, at page 6 of the 2013 bulletin:

> This payment prohibition applies to all methods of Federal health care program payment, whether from itemized claims, cost reports, fee schedules, capitated payments, a prospective payment system or other bundled payment, or other payment system and applies even if the payment is made to a State agency or a person that is not excluded

That sentence disposes of 'we did not bill a line for that person' under a home health episodic rate or a bundled behavioral health rate. The tail of it disposes of the other version too: it does not matter that the federal dollars reached you through a managed care plan or a state agency rather than from Medicare directly.

It reaches work that is never separately billed. The bulletin at page 7 says the prohibition applies to services performed by excluded individuals working for or under arrangement with a hospital, nursing home, home health agency or managed care entity, for example preparing surgical trays or reviewing treatment plans, 'regardless of whether such services are separately billable or are included in a bundled payment.'

It reaches the back office. Also at page 7:

> Excluded persons are prohibited from furnishing administrative and management services that are payable by the Federal health care programs. This prohibition applies even if the administrative and management services are not separately billable.

OIG then names roles an excluded person may not fill at a provider furnishing items or services payable by federal programs: chief executive officer, chief financial officer, general counsel, director of health information management, director of human resources, physician practice office manager. It names services an excluded person may not provide unless wholly unrelated to federal health care programs: health information technology services and support, strategic planning, billing and accounting, staff training, and human resources.

It reaches people you do not pay. At page 11, OIG says liability can result 'even if the excluded person does not receive payments from the provider for his or her services,' giving the examples of a non-employed excluded physician on a hospital medical staff and an excluded health care professional working as a volunteer.

And it follows the person, not the credential. Page 6: 'The exclusion and the payment prohibition continue to apply to an individual even if he or she changes from one health care profession to another while excluded.' OIG also warns that some excluded practitioners hold valid licenses, so license verification is not exclusion screening.

The two narrow exceptions. An excluded person may lawfully be employed where federal programs do not pay, directly or indirectly, for what they provide, or where they furnish items or services solely to non-federal-program beneficiaries. OIG adds that a separate account is not required, as long as no claims are submitted to and no payment received from federal programs for that person's work. Then the qualifier, at page 13: 'Thus, a provider that receives Federal health care program payments may employ or contract with an excluded person only in limited situations.' For a 10 to 200 staff agency on one payroll, the word 'indirectly' usually closes both doors. If you ever intend to rely on either exception, get the analysis reviewed by counsel and keep it in writing.

OIG does not give a list of positions. It gives a test, at pages 15 and 16 of the bulletin. OIG recommends that to determine which persons should be screened, 'the provider review each job category or contractual relationship to determine whether the item or service being provided is directly or indirectly, in whole or in part, payable by a Federal health care program.'

Then: 'If the answer is yes, then the best mechanism for limiting CMP liability is to screen all persons that perform under that contract or that are in that job category.'

Run that test honestly at a home health agency or a licensed substance abuse provider and very little falls outside it. Intake coordinators, schedulers, billers and coders, quality staff, the clinical supervisor, the administrator, the HR manager, the IT vendor with access to your clinical system, the accountant who prepares your cost report. Include the arrangements that are easy to forget: locum clinicians, PRN and per-diem staff, individually contracted 1099 clinicians, and agency nurses.

Ordering, certifying and referring physicians. This is the hardest population for a home health agency or hospice, because you take orders from physicians you do not employ. What the law conditions is payment, not screening: under 42 C.F.R. 1001.1901(b)(1)(ii), items or services are unpayable when furnished 'At the medical direction or on the prescription of a physician or an authorized individual who is excluded when the person furnishing such item or service knew, or had reason to know, of the exclusion.' The knowledge qualifier is what makes a routine worth having. OIG's own advice, at page 8, is that 'To avoid liability, providers should ensure, at the point of service, that the ordering or prescribing physician is not excluded.' A workable routine, and this part is our recommendation rather than OIG's instruction: search each new referring or certifying physician before you accept the first order, then carry them on the same recurring roster as staff. Record the NPI in your own log so you can prove which physician you searched, but search and resolve by name and then by SSN or EIN. The LEIE's NPI field is empty for most records and cannot be used as a matching key. A note of caution on referrals alone, from footnote 8 at page 6: covered items furnished by a non-excluded provider are payable even when an excluded provider referred the patient, but only if the excluded provider does not furnish, order or prescribe anything for that patient. If the referring physician also signs the plan of care, that footnote does not help you.

Owners and governance. An excluded individual who knows or should know of the action constituting the basis for the exclusion and retains a direct or indirect ownership or control interest of 5 percent or more in a participating entity, or who is an officer or managing employee of one, has personal penalty and exclusion exposure (42 C.F.R. 1003.200(b)(3)). Two separate statutory lanes run in opposite directions and are easy to confuse. Under 42 U.S.C. 1320a-7(b)(8), an entity may be excluded where a person with a 5 percent or greater ownership or control interest, or an officer, director, agent or managing employee, is a sanctioned person. Under 42 U.S.C. 1320a-7(b)(15), an individual may be excluded who has a direct or indirect ownership or control interest in a sanctioned entity and knows or should know of the basis for its conviction or exclusion, or who is an officer or managing employee of such an entity. Screening the ownership and officer roster is a prudent response to that exposure. It is not a federal screening mandate.

Document the analysis. A one-page memo listing every job category and contract type, with a yes or no on federal payability and the resulting screening decision, is the artifact that shows you applied OIG's own method.

OIG's position at page 16: 'Providers should determine whether or not to screen contractors, subcontractors, and the employees of contractors using the same analysis that they would for their own employees.' It names three examples: nurses provided by staffing agencies, physician groups contracting for emergency room coverage, and billing or coding contractors.

You may delegate the search. You cannot delegate the exposure. Page 14: 'the providers will retain the potential CMP liability if they employ or contract with an excluded person.' And at page 16, in full:

> Regardless of whether and by whom screening is performed and the status of the person (e.g., employee, subcontractor, employee of contractor, or volunteer), the provider is subject to overpayment liability for any items or services furnished by any excluded person for which the provider received Federal health care program reimbursement and may be subject to CMP liability if the provider does not ensure that an appropriate exclusion screening was performed.

Read that closing clause carefully. OIG does not require you to check the LEIE, but it does say CMP liability may attach where the provider did not ensure that an appropriate exclusion screening was performed. That is the strongest screening-facing sentence OIG has written, and it is the reason a documented frequency, rather than the absence of a rule, is what protects you.

What delegation can do is reduce the penalty. Footnote 21 at page 12: 'The hospital may reduce or eliminate its CMP liability if the hospital is able to demonstrate that it reasonably relied on the staffing agency to perform a check of the LEIE.' The test OIG states is reasonable reliance. The footnote then gives the example it has in mind, introduced by 'e.g.', and it is the one to build to: the agency agreed by contract to perform the LEIE screening, and the provider exercised due diligence in ensuring the agency was meeting that obligation. OIG frames those as an illustration rather than a checklist, so treat them as the floor, not the whole of it. A clause alone is not enough. OIG's advice, at page 16, is to 'validate that the contractor is conducting such screening on behalf of the provider (e.g., by requesting and maintaining screening documentation from the contractor).'

Note the double role your billing company plays. It is a party whose screening you may rely on, and it is itself a contractor whose work is indirectly payable by a federal program, so it belongs on your own screening roster.

Two more contract-facing points. If you are a Medicare-certified home health agency, 42 C.F.R. 484.105(e)(2) requires a written agreement with any entity furnishing services under arrangement to your patients. Services under arrangement means services your patients receive that another agency, organization or individual furnishes, with your agency keeping overall responsibility and billing for them: contracted therapy or a subcontracted branch, for example. The regulation provides that the entity 'may not have been: (i) Denied Medicare or Medicaid enrollment; (ii) Been excluded or terminated from any federal health care program or Medicaid.' Clauses (iii) and (iv) add revoked billing privileges and debarment. The regulation requires the written agreement and the clean status. It prescribes no verification act, method or interval, but a surveyor asking how you know the condition is met is asking for screening evidence, and keeping it is our recommendation.

And if you contract with a Medicaid managed care plan, read that contract. A federal regulation, 42 C.F.R. 438.808(a), conditions federal matching funds on the state excluding certain entities from its managed care contracts. It commands the state, not you. The reason your plan contract has an exclusion clause at all is (b)(3): the state must exclude from its managed care contracts an entity that employs or contracts, directly or indirectly, for the furnishing of health care, utilization review, medical social work or administrative services with an excluded person. That pressure is what the plan passes to you, which is why any managed care screening frequency lives in the plan contract and not in the regulation.

Two things are worth knowing if you are in Florida. AHCA's Statewide Medicaid Managed Care model contract, Attachment II, requires the plan itself to check its staff, subcontractors and providers monthly against the LEIE, SAM and AHCA's list, as a mandatory element of the plan's own compliance plan. So you will be checked monthly regardless. What Attachment II does not contain, in any of the April 2023, October 2024 or October 2025 editions we searched, is a clause flowing that monthly duty down to network providers. Individual plan participation agreements are not published, and many of them do impose it. Read your own plan agreement. Do not assume either way from the model contract.

The LEIE is OIG's list. At page 17 of the bulletin: 'The LEIE lists only exclusion actions taken by OIG.' OIG recommends it as the primary source, because OIG maintains it, updates it monthly, and carries more detail than SAM, including the statutory basis for the exclusion, the person's occupation at the time of exclusion, date of birth and address information.

OIG's exclusions FAQ, read on September 9, 2026, states: 'Both versions of the LEIE are generally updated by the middle of each month.' OIG's LEIE Quick Tips page, read the same day, says all exclusion information is updated by the 10th of every month. The two pages give different dates, so plan to the later one and run your cycle on a fixed day after the 15th. That scheduling choice is ours, not an OIG instruction.

SAM.gov carries governmentwide suspension and debarment records. The bulletin, page 17: 'SAM includes OIG's exclusions but also includes debarment actions taken by Federal agencies.' The distinction has teeth. Also page 17: 'Moreover, OIG has no authority to impose CMPs on the basis of employment of (or contracting with) a debarred person.' A SAM debarment hit is a procurement and business risk matter, not OIG civil money penalty exposure.

SAM still matters if you are Medicare-enrolled. Enrollment is conditioned on not employing or contracting with individuals or entities that are either 'Excluded from participation in any Federal health care programs, for the provision of items and services covered under the programs, in violation of section 1128A(a)(6) of the Act' (42 C.F.R. 424.516(a)(3)(i)) or 'Debarred by the General Services Administration (GSA) from any other Executive Branch procurement or nonprocurement programs or activities' (42 C.F.R. 424.516(a)(3)(ii)). Note what that provision does and does not say. The regulation states a condition of enrollment and continued active enrollment, resting on your own certification, and it runs continuously. It does not state a duty to search a named database on a schedule.

One practical limit on SAM. The SAM Exclusions Public V2 Extract Layout, version 2.1 (December 20, 2019), read on September 9, 2026, has no Social Security number, EIN, TIN or date of birth column across its 31 fields. It does carry a Cross-Reference alias field. So a SAM name hit has to be resolved from the underlying record rather than by an identifier match.

EPLS, which the 2011 Medicaid regulation still names at 42 C.F.R. 455.436(b), is the Excluded Parties List System. GSA's governmentwide exclusions record is now published at SAM.gov, so searching SAM covers what EPLS covered. It is not a fourth list to search.

State Medicaid exclusion lists. OIG's 2023 General Compliance Program Guidance recommends that entities check people 'against such State Medicaid program exclusion lists' for the state programs in which they participate. A state exclusion can also run longer than the federal one: 'A State health care program may provide for a period of exclusion which is longer than the period of exclusion under subchapter XVIII' (42 U.S.C. 1320a-7(d)(3)(B)(ii)).

What if the hit is on a state list and not on the LEIE? Federal CMP exposure under 42 C.F.R. 1003.200(b)(4) runs to persons excluded from federal health care programs, so a state-only exclusion may not create it. Florida's consequence is separate and direct. Under Fla. Stat. s. 409.913(25)(b) the agency 'shall deny payment, or require repayment, if the goods or services were furnished, supervised, or caused to be furnished by a person who has been suspended or terminated from the Medicaid program or Medicare program by the Federal Government or any state.' Note the three verbs and the words any state. A person barred by another state's Medicaid, and absent from the LEIE, can still make your Florida claims unpayable. Treat a confirmed state-list hit the way you would treat an LEIE hit for payment purposes, and get the specific state action in writing before you act on it.

Budget by search, not by headcount. A 100-name LEIE pass is roughly an hour of focused work once the roster is built, and a Florida Medicaid cycle repeats that same roster against SAM and the AHCA final order database, so plan on two and a half to three hours a month. That estimate is ours, not an OIG figure. Run the cycle in this order.

1. Build the roster. Payroll export, plus the contractor and vendor list, plus agency and locum staff currently assigned, plus the ordering and certifying physicians on active plans of care, plus owners, officers and board members. Note prior and alternate names.

2. Run the names. Use the online searchable database at exclusions.oig.hhs.gov for anything you intend to rely on. OIG's LEIE Quick Tips page, read September 9, 2026, gives the mechanics:

• Search former and alternate names. 'Check any former names used by the individual (e.g., maiden name, previous married name, etc.) in addition to the individual's current name, the database includes only the name known to OIG at the time an individual was excluded.'
• Search hyphenated surnames under each last name separately, as well as the hyphenated form.
• 'If the name contains punctuation, you must include the punctuation in your search text.' Only apostrophes, hyphens, ampersands and commas are accepted.
• Enter only the first few letters of the first and last name when you are unsure of spelling.

The downloadable file is a filter, not an adjudicator. The bulletin at page 14 notes the downloadable data file does not contain Social Security numbers or employer identification numbers, so verification of specific individuals or entities through the SSN or EIN must be done in the online searchable database. Using the file to pre-filter a large roster and then resolving hits online is legitimate and fast.

3. Resolve every hit before anyone touches an employment decision. See the next section.

4. Save each result. OIG's LEIE Quick Tips page, read September 9, 2026, directs you to 'use the Print Search Results button' to save the result.

5. Run the other sources your contract names. If your Florida Medicaid provider agreement carries paragraph 5(r), it names three. For SAM, search the exclusions record at sam.gov by name and save the result; remember there is no SSN or EIN verification step in the public extract, so a name hit is resolved from the underlying record.

For AHCA's final order database at apps.ahca.myflorida.com/dm_web, read on September 9, 2026: the page is headed 'Agency for Health Care Administration Public Record Search.' Choose Final Orders, set the category selector to 'Medicaid Sanctioned Providers' (or 'All' if you want licensure orders too), and search by Party Name. The remaining fields are Order Type, a Date Rendered range, AHCA Case Number and Formal/Informal Case Number. Two limits matter. There is no SSN, EIN or NPI field, so a name hit here has to be resolved by reading the underlying order rather than by an identifier check. And the page warns that 'prior to July 1, 2009, Agency sanctions did not always result in the issuance of a final order,' so a clean result does not rule out an older sanction; AHCA directs pre-2009 inquiries to its Public Records Office at (850) 412-3688. Save the dated result and record the category filter and the exact name you searched.

6. File the cycle. A dated log naming the month covered, roster source and headcount, sources searched, who ran it, who reviewed it, per-person outcome and any exceptions, with the printed results attached.

On evidence, OIG is specific. Page 14:

> providers should maintain documentation of the initial name search performed (such as a printed screen-shot showing the results of the name search) and any additional searches conducted, in order to verify results of potential name matches

The bulletin states no retention period for screening documentation. Anyone who tells you six years is a federal rule is guessing. Our recommendation is six years, matching the CMPL limitations period that OIG's Self-Disclosure Protocol refers to as 'the CMPL's 6-year statute of limitations as described in section 1128A(c)(1) of the Act.' Florida Medicaid separately requires Medicaid-related records for five years from the date of service (Fla. Stat. s. 409.913(9)), which is a floor rather than a ceiling, and 42 C.F.R. 424.516(f)(1)(i)(A) requires certain Medicare providers to maintain ordering and certification documentation for seven years. None of those names exclusion screening records. Pick a period, state the basis, apply it consistently.

A name match is a lead, not a finding. OIG says so directly: 'It is not sufficient to simply find a matching first and last name on the LEIE.'

The resolution step is the Verify link on the candidate record. OIG's Exclusions Database Help page, read September 9, 2026, describes it: 'In the text box underneath the data table, enter the Social Security Number (SSN) or the Employer Identification Number (EIN).' The same page describes the lockout behavior: if the SSN or EIN is entered incorrectly three times you will be asked to complete a CAPTCHA before a fourth attempt, and an incorrect fourth attempt returns you to the search page to start over.

Take no adverse action against a named person until the identifier confirms the match. Adverse action here means employment action: do not suspend, discipline or terminate on a name match alone. Billing is a separate decision, and the asymmetry runs the other way. Because overpayment liability has no knowledge element, claims for work an unresolved person performs during the verification window are at risk if the match confirms. The low-cost course is to hold the person's claims rather than the person: keep them working, stop or pend billing for their items and services until the identifier clears the match, and release the held claims once it does. Resolve matches in days, not weeks, for exactly this reason.

Then keep the verification outcome page, not just the name search, and note which identifier was used.

When you do not hold an SSN or EIN. For an employee you have one. For a board member, a volunteer or a small vendor you often do not. Work down this ladder and record where you stopped:

1. Request the identifier, stating the business reason: you are verifying a potential federal exclusion match and cannot clear it otherwise.
2. Compare the distinguishing fields on the LEIE record the search returned: occupation at the time of exclusion, date of birth, and address information. A pharmacist excluded in another state twenty years ago with a different date of birth is not your board member, and saying so in writing with the fields you compared is a real record.
3. Contact OIG. The bulletin notes OIG staff can verify information about persons on the LEIE.
4. If the match is cleared on field comparison rather than an identifier, record which fields were compared, who reviewed it, and who approved the conclusion. An undocumented shrug is the worst outcome.

One more trap. OIG's LEIE Database and Supplement Downloads page, read September 9, 2026, states that 'Individuals and entities who have been reinstated are removed from this file.' So a clean search today establishes current status only. If the question is whether someone was excluded during a past billing period, a present-day search cannot answer it. OIG's monthly exclusion and reinstatement supplement files can, if you kept them. Either way, a dated monthly series beats a single annual screenshot.

Every line in your screening policy should be traceable to one of the rows below, and the row should say what kind of duty it is.

Exclusion screening is federal. Florida adds separate obligations that are easy to confuse with it.

The monthly duty is a contract term, not a Florida statute. Paragraph 5(r) of the December 2023 Florida Medicaid Provider Agreement forms, MPA Non-Institutional and MPA Institutional, obligates the provider to:

> Search the List of Excluded Individuals/Entities (LEIE) and System for Award Management (SAM), and the Agency's final order database, located at http://apps.ahca.myflorida.com/dm_web, monthly to determine whether any employee or contractor has been excluded.

The text is identical in both forms. The same paragraph requires the provider to notify the agency immediately of any exclusion information discovered. This is where 'monthly' becomes binding in Florida, on signature. It names three sources, not one, and it reaches contractors as well as employees. Under Fla. Stat. s. 409.913(15)(e), failing to comply with the provider agreement is itself a sanctionable ground.

Note the vintage. The clause is new to the December 2023 forms. The Revised April 2010 Non-Institutional agreement ended paragraph 5 at (l) and imposed no exclusion screening at all. Non-institutional providers renew every five years and institutional, DME, Medicare crossover-only, ORP and out-of-state providers every three, under section 6.1 of the Florida Medicaid Provider Enrollment Policy, February 2026. So pull your executed agreement and read its footer before you write paragraph 5(r) into a policy.

Two limits on which agreement is yours. Florida uses six provider agreement forms: Institutional, Institutional with the presumptive eligibility election, Institutional ICF, Non-Institutional, DME, and Medicare Crossover-Only, per section 2.12 of the same enrollment policy. We verified paragraph 5(r) in the Non-Institutional and Institutional forms. We did not verify the other four, so read yours. And the same policy provides that provider agreements 'are not required in paper format for limited enrollment or ORP, unless requested by the Agency,' so a limited-enrollment provider, including out-of-state providers and Statewide Medicaid Managed Care waiver service providers, may have no signed paper agreement to point to. If that is you, ask AHCA which terms govern your enrollment rather than assuming 5(r) does.

The Florida payment consequence. Fla. Stat. s. 409.913(25)(b): 'The agency shall deny payment, or require repayment, if the goods or services were furnished, supervised, or caused to be furnished by a person who has been suspended or terminated' from Medicaid or Medicare by the federal government or any state. Three verbs, and two of them describe people who never appear on a claim.

Reciprocity is immediate. Fla. Stat. s. 409.913(14): if the provider has been suspended or terminated from Medicaid or Medicare by the federal government or any state, 'the agency must immediately suspend or terminate, as appropriate' Florida participation, for a period no less than that imposed elsewhere.

Florida fines are Florida figures. Fla. Stat. s. 409.913(16)(c) allows 'Imposition of a fine of up to $5,000 for each violation,' with each day of an ongoing violation counted separately. Rule 59G-9.070, F.A.C. caps cumulative fines at $20,000 for a first offense and $50,000 for a second, with no cap on a third, where the audit report applies a sanction only and contains no overpayment determination. These are entirely separate from the inflation-adjusted federal penalties under 42 C.F.R. part 1003.

Where Florida's duties are not. The Florida Medicaid Provider General Handbook (July 2012), incorporated by reference in Rule 59G-5.020, F.A.C., contains no exclusion screening duty and states no frequency; a full-text search on September 9, 2026 returned no occurrence of LEIE, List of Excluded, Inspector General or debarred. Rule 59G-9.070 is a sanction schedule and imposes no screening duty. Fla. Stat. s. 409.9131 is physician program integrity procedure and says nothing about exclusion screening. And the word 'monthly' in Fla. Stat. s. 409.913(37) sets AHCA's publishing cadence for its terminated-and-sanctioned list, not your search cadence.

Level 2 background screening is a different regime. Fla. Stat. s. 435.04(1)(a) level 2 screening is fingerprinting, an FDLE state criminal history check, an FBI national check, local law enforcement checks and a sexual predator and offender registry search. It names no exclusion database, not the LEIE, not SAM, not any state exclusion list, and a clean level 2 result is not evidence of exclusion status. It runs on a five-year rescreening clock under Fla. Stat. s. 408.809(2), which applies to providers licensed by AHCA under ch. 408, part II. Check whether your license type is covered.

If you are DCF-licensed under ch. 397. We checked Fla. Admin. Code R. 65D-30.004 and found no exclusion-list requirement in it. We did not review DCF's standard contract or the managing entity template subcontracts, and a duty of this kind would live there rather than in the licensure rule. If you are funded through a managing entity, read your subcontract for an exclusion screening clause. Either way, the federal payment prohibition and CMP exposure reach you if you bill Medicaid or any other federal health care program, and any Florida Medicaid provider agreement you signed applies too.

Contemporaneous records. Fla. Stat. s. 409.913(22) bars a provider from presenting records to contest an overpayment or sanction unless those records are contemporaneous. A screening log assembled after the audit notice arrives is close to worthless in a Florida proceeding. Log each search the day you run it.

For the Florida personnel file itself, see our companion guides on Florida home health personnel file requirements, DCF 65D-30 personnel requirements and Level 2 background screening and rescreening. For a New Jersey substance use disorder facility, the state personnel record is covered in New Jersey SUD personnel file requirements under N.J.A.C. 8:111 and 8:43K. For a North Carolina licensed home care agency, the state personnel record, registry checks and criminal history checks are covered in North Carolina home care personnel file requirements under 10A NCAC 13J. Exclusion screening is the federal layer sitting on top of those. Neither substitutes for the other. Florida statutes here were read in the 2025 edition at year-pinned links on September 9, 2026.

Two separate exposures, and they behave differently.

Overpayment liability has no knowledge element. If an excluded person furnished the item or service, the payment was not payable and the money is owed back. Screening quality does not change that.

The civil money penalty requires knowledge. Under 42 C.F.R. 1003.200(b)(4), OIG may impose a penalty on a person who 'Arranges or contracts (by employment or otherwise) with an individual or entity that the person knows, or should know, is excluded from participation in Federal health care programs for the provision of items or services for which payment may be made under such a program.' Note the closing clause: the penalty attaches to arrangements for federally payable items or services, which is why the two narrow exceptions described earlier exist at all. Note also the opening words of the provision: OIG 'may impose' a penalty, not shall.

'Should know' is defined. Under 42 C.F.R. 1003.110, it means a person 'either acts in deliberate ignorance of the truth or falsity of the information or acts in reckless disregard of the truth or falsity of the information. For purposes of this definition, no proof of specific intent to defraud is required.' That definition, and not any screening mandate, is the real reason to run and document searches. OIG has published the LEIE as a free tool since 1999. Never having looked sits closer to reckless disregard than to innocence.

How the penalty is measured. Per item or service, not per person and not per year. 42 C.F.R. 1003.210(a)(4) provides for a penalty of 'not more than $20,000 for conduct that occurred after February 9, 2018, for each separately billable or non-separately-billable item or service provided, furnished, ordered, or prescribed by an excluded individual or entity.' That $20,000 is the regulatory ceiling before inflation adjustment. The operative figure is the inflation-adjusted amount. HHS's annual adjustment rule published January 28, 2026 (FR Doc. 2026-01688), read on September 9, 2026, sets the maximum for 42 C.F.R. 1003.210(a)(4) at $25,595 under a column captioned '2025 Maximum adjusted penalty.' Confirm the current figure in the table at 45 C.F.R. 102.3 before you put any number in a policy; it is adjusted annually. And do not reuse the $10,000 printed in the 2013 bulletin, which predates the increase.

Assessments come on top, and they are how administrative roles get priced. Under 42 C.F.R. 1003.210(b)(2), for violations of 1003.200(b)(4) OIG may impose an assessment of up to three times the amount claimed for separately billable items, or up to three times 'The total costs (including salary, benefits, taxes, and other money or items of value) related to the excluded individual or entity incurred by the person that employs, contracts with, or otherwise arranges' for non-separately-billable work. For an excluded HR director or office manager who never generates a claim line, the assessment base is what you paid to employ them.

An excluded person who retains a 5 percent or greater ownership or control interest, or serves as an officer or managing employee, faces a further penalty measured per day that the relationship exists (42 C.F.R. 1003.210(a)(3)).

Finally, the excluded person carries their own exposure, including criminal and False Claims Act liability and denial of reinstatement. This is not solely the employer's problem, though the refund certainly is.

Work in this order. Note that the disclosure decision comes before the refund, and that is deliberate.

1. Stop the payable work immediately. OIG does not instruct you to fire anyone. It defines what an excluded person may not do. Removing the person from any work payable, directly or indirectly, by a federal health care program is the operative step.

2. Fix the exclusion effective date. The payment bar attaches to items and services furnished 'on or after the effective date specified in the notice.' 42 C.F.R. 1001.1901(c) contains several narrow exceptions, including one for emergency items or services supported by a sworn statement. The one that matters most here is the 30-day continuity allowance: payment may be made for up to 30 days after the effective date for 'Home health services and hospice care furnished to an individual under a plan of care established before the effective date of the exclusion' (42 C.F.R. 1001.1901(c)(3)(ii)), unless the Secretary determines beneficiary health and safety warrants earlier effect. That is a continuity-of-care payment grace period, not permission to keep an excluded person working.

3. Quantify what was claimed. Count items and services from the effective date forward, separately billable and not.

4. Decide on self-disclosure, and decide before day 60. The 2013 bulletin calls it the Provider Self-Disclosure Protocol; the current version, amended November 8, 2021, is titled the Health Care Fraud Self-Disclosure Protocol (SDP). At page 13 the bulletin says providers that identify potential CMP liability from employing, contracting with or arranging with an excluded person 'may use OIG's Provider Self-Disclosure Protocol (SDP) to disclose and resolve the potential CMP liability.' OIG's 2023 guidance says it recommends entities in this situation consider whether to submit a self-disclosure. Consider, and may. The protocol is voluntary.

One interaction matters before you wire anything back. OIG's protocol states at section I.B that under CMS's 2016 final rule, CMS 'agreed to suspend the obligation to report overpayments under section 1128J(d) of the Act when OIG acknowledges receipt of a submission to the SDP so long as the submission is timely made,' and 'agreed to suspend the obligation to return overpayments until a settlement agreement is entered into, or the person withdraws or is removed from the SDP.' A later section of the same protocol describes the repayment tolling more softly, as something CMS 'has proposed.' So do not treat the suspension as certain, but do make the disclosure decision before the 60 days run rather than after, and get the sequencing reviewed by counsel.

If you do disclose, two conditions matter operationally. Before disclosing, 'a disclosing party must screen all current employees and contractors against the LEIE. Once this has been done, the disclosing party should disclose all excluded persons in one submission.' And the submission must describe your screening process 'including any policy or procedure that was in place, and any flaw or breakdown in that process that led to the hiring or contracting with the excluded person.' These are conditions of using a voluntary protocol, not standing legal duties.

On damages, the protocol says that for non-separately-billable work 'we use the disclosing party's total costs of employment or contracting during the exclusion to estimate the value of the items and services provided by that excluded person,' multiplied by your revenue-based federal payor mix. That is settlement methodology inside the SDP, not the general legal measure of exposure.

5. Report and return the overpayment. This is the one hard deadline in the whole response, and it is a statutory one. Section 1128J(d) of the Act, 42 U.S.C. 1320a-7k(d)(2), provides that an overpayment must be reported and returned 'by the later of' (A) 'the date which is 60 days after the date on which the overpayment was identified' or (B) 'the date any corresponding cost report is due, if applicable.' If you file no cost report, limb (B) drops out and the 60-day clock is the deadline. And 1320a-7k(d)(3): 'Any overpayment retained by a person after the deadline for reporting and returning the overpayment under paragraph (2) is an obligation (as defined in section 3729(b)(3) of title 31) for purposes of section 3729 of such title,' which is the False Claims Act. Separately, knowing of an overpayment and failing to report and return it in accordance with section 1128J(d) is itself a stated basis for a civil money penalty (42 C.F.R. 1003.200(b)(8)).

6. Fix the process and write it down. Under 42 C.F.R. 1003.140(a)(2), 'It should be a mitigating circumstance if the person took appropriate and timely corrective action in response to the violation.' The same regulation conditions that credit: corrective action must include disclosing the violation to OIG through the Self-Disclosure Protocol and fully cooperating with OIG's review.

7. Do not assume the exclusion later expires on its own. The regulation requires a written request for reinstatement submitted only after the date specified in the notice of exclusion, and 'Obtaining a program provider number or equivalent does not reinstate eligibility' (42 C.F.R. 1001.3001(a)(1)). 'Reinstatement will not be effective until the OIG grants the request and provides notice under 1001.3003(a) of this part' (42 C.F.R. 1001.3002(d)). OIG's Applying for Reinstatement page, read September 9, 2026, tells excluded individuals they 'may begin the process of reinstatement 90 days before the end of the period specified in the exclusion notice letter.' That is administrative practice, not a right to be reinstated early: a candidate can start the paperwork ahead of time, but nothing takes effect until OIG grants it and gives notice. Before rehiring anyone into payable work, ask for OIG's written reinstatement notice and file it.

Build the file so it proves four things: that screening happened, when, against which sources, and how every potential match was resolved.

Policy artifacts. A signed and dated exclusion screening policy with a named owner. OIG's 2023 guidance says a policy 'should clearly identify which individual(s) in the organization are responsible for conducting the screening, the process for performing the screening and verifying any potential matches.' Add the frequency you chose and the reason, including any contract that requires it, quoting the contract you actually hold. Keep the job-category analysis with it.

Per-cycle artifacts. The dated log described earlier, with the printed search results attached.

Per-person artifacts. A pre-hire search dated before the start date, then each recurring search. For anyone with a name change, the search under each name variant. For any potential match, the verification outcome page showing the SSN or EIN check and the resolution, or the documented field comparison where no identifier was available.

Contractor artifacts. The contract clause assigning screening, plus the contractor's screening documentation on file, which is what OIG says validates reliance.

Incident artifacts, if you ever need them. Date and method of discovery, the person's dates and duties, the exclusion effective date, the claims analysis, the action taken, the overpayment calculation and return, the disclosure decision with its reasoning, and the corrective action plan with the revised policy attached.

A useful proxy for what an examiner wants is what OIG itself asks a self-disclosing party to submit: the excluded person's identity and provider identification number, their job duties, dates of employment or contract, background checks completed before and during the engagement, how the conduct was discovered, the screening process and the flaw that let it through, and the corrective action including a copy of any revised policy. A state surveyor is a different actor with a different checklist, but a file that answers OIG's questions will answer most of theirs.