An experienced medical assistant is employed by a practice. The candidate’s resume is satisfactory, the references are favourable, and the standard background check proves to be clear. However, two years later, a regular audit reveals something that a background check was not designed to detect: the assistant had been excluded from federal healthcare schemes three months prior to being hired.
What occurs next is severe and does not depend on anyone having acted dishonestly. The practice will have to pay back, for each Medicare and Medicaid claim that the assistant handled, from the date of employment. In addition to this there are civil monetary penalties for each item or service, which accumulate rapidly. And in the most serious cases an organisation which has employed an excluded person can itself be excluded, a situation which for most providers is a business-ending event.
What distinguishes healthcare screening from almost any other area is strict liability. It is not necessary to know that someone has been excluded in order to be held responsible, since failing to carry out the checks is regarded as amounting to reckless disregard and “we didn’t know” cannot be used as a defence. The consequences are both real and increasing: in 2025 about 35 healthcare organisations paid over $26 million to settle violations of the exclusion rules, which is roughly six times the total for the previous year.
Beneath that story lies an unpleasant truth, namely that a background check could never have picked it up since an exclusion does not count as a criminal record; it is an administrative measure which remains on a separate list and can at any time be imposed or removed. As a result, checking a candidate’s background in the healthcare sector is not something you simply tick off when hiring, but rather a strict, ongoing responsibility that has to be carried out for each claim, and ensuring that this is done properly begins with knowing precisely which lists to monitor and how frequently.
Why healthcare screening is different
It differs from a standard background check in three respects, and each of these points increases the seriousness of the situation.
The rules are strict since liability does not rely on intent; if you employ or enter into a contract with someone who is excluded and then bill a federal programme for anything they were involved in, you are liable, even if you were unaware of the situation. Regulators regard a failure to carry out screening as amounting to a reckless disregard, which is just a polite way of saying that it is up to you to carry out such screening.
It is continuous; it’s possible for an exclusion to be placed on someone the month after they have been hired, and the official list is updated on a monthly basis. A single check carried out during onboarding gives you no information about their situation three months later. The Office of Inspector General has made it clear that it expects regular checks, and monthly screening has become the standard practice, something that is also supported by credentialing organisations. In reality this means that the list you checked against when you cleared people in January is already obsolete by February.
It is assessed on a per-claim basis; it’s this that turns a simple paperwork error into a financial disaster. The penalty is not a fixed sum; rather, according to the civil monetary penalties statute, it is imposed for each item or service that the excluded person was involved in. The amount is revised each year to take account of inflation and has increased sharply since Congress raised the ceiling in 2018. If you multiply the per-item penalty by the number of claims an excluded clinician produces in a few months, add the amount needed to repay all of that, and then include assessments that can amount to three times the claimed amount, the total exposure can reach millions before any allegation of deliberate fraud has even been made.
Combined, the compliance obligation has to be strict, continuous, and have to be described on a per-claim basis with very little room for error.
The registries you have to monitor
The key to doing this correctly is identifying which lists to consult, since there is no one comprehensive database that includes all the information. At the very least, a healthcare screening programme must cover the following.
The list in question is the List of Excluded Individuals and Entities (LEIE), which is kept by the Office of Inspector General of the Department of Health and Human Services; this is the main source, containing over 70,000 excluded individuals and organisations, and it is to this list that the per-item fines are applied. You should check it before making any hiring or contracting decisions and then check it on a monthly basis thereafter.
The website SAM.gov provides a list of organisations that have been excluded from federal contracts and grants, covering a broader range of exclusions than the LEIE. There are some organisations that appear on this list but not on the LEIE, which is why both lists are important.
The state Medicaid exclusion lists are as follows: the difficult point is that each state maintains its own Medicaid exclusion list and there is no single national repository. A provider can be excluded by a state even if they do not appear on the federal LEIE, especially during the early stages of an investigation. If you are billing Medicaid in more than one state, you have to look at the exclusion list of each relevant state, and the state agencies are able to impose penalties independently of the OIG.
The licensing boards of the various states publish information regarding disciplinary actions, suspensions, and revocations by medical, nursing, and pharmacy boards. A licence action usually comes before an exclusion and is one of the first indications that there is a problem.
The National Practitioner Data Bank collects malpractice payments and adverse actions concerning practitioners and is a useful resource, although it has one drawback in that access is only allowed to eligible organisations such as hospitals and boards, which means it is not available for public lookup.
It will depend on what you are doing. The DEA’s record of registration actions is relevant when controlled substances are involved; the FDA has a debarment list linked to drug-approval fraud; and OFAC imposes sanctions and other adverse actions to give a complete picture of a provider or vendor. Two things are easy to overlook. The first is that all of this applies to organisations and vendors, not merely to the clinicians who are employed by you, so that the staffing agency, the billing contractor, and the lab should also be included. The second point is that you have to screen both organisations and individuals, since the LEIE includes both.
License actions and adverse media are the early warning
A change in approach distinguishes a well-developed programme from a reactive one: an exclusion marks the end of a story, not its start. Typically, there is a series of events preceding someone’s arrival at the LEIE, such as a licence suspension, an indictment, a fraud settlement, or a string of negative media reports. The official exclusion may not occur until months or even years later.
If you merely monitor the LEIE, you only discover the situation at the very last minute, usually after the individual has already processed thousands of claims. By also keeping an eye on licensing boards and adverse media, you are able to detect the warning signs early enough so that you can act cheaply—by suspending your federally billable activities, carrying out an investigation, and making a decision before the damage becomes worse. The registries show you who has already been excluded, while the adverse signals indicate who is about to be. That early advantage is often the deciding factor: a provider that you suspend today, based on a licence suspension, will be one who never files the claims which you would otherwise have had to repay next year.
How often, and on whom
The question of whether a programme really works comes down to two factors: how frequently you screen and who you screen.
Regarding frequency: carry out a screen before hiring or when entering into a contract, then once a month afterwards, at the time of re-credentialing, and immediately in the case of a name change, the acquisition of a new alias, or a change in someone’s role. Monthly is the minimum standard, not something that is aimed for, which is the reason why manual full sweeps carried out only once a year leave organisations exposed for eleven months continuously.
As for scope, it includes anyone whose work has an impact on a federally reimbursed item or service; this applies to employees, certainly, but also to contractors, vendors, temporary and agency staff, referring providers, and the organisations that employ them, all the way down to the owners where this is relevant. The medical assistant who was excluded at the beginning was an employee, but the same repayment principle fits just as well in the case of a billing vendor or a contract nurse.
You also have to prove you did it
It’s not just a matter of detecting problems; it’s also about being able to demonstrate at a later stage that you had in fact carried out the screening. If an auditor asks how you knew that a provider was clear in March, your reply should go beyond ‘we’re fairly sure we ran it’; you need a dated record showing specifically which lists you checked, when, and what your findings were.
It is in this area that many manual programmes fail. Screenshots stored on a network drive are not capable of dealing with the thousands of names checked each month and do not stand up to close examination. A defensible programme, on the other hand, creates an auditable trail as a result of the screening process, linking each result back to the original source so that the evidence is available whenever it is required.
Why manual screening breaks at scale
In theory, going through a few lists seems straightforward, but in reality it fails under the burden of its own complexity. There are a great many registries, with no single central repository containing the state’s Medicaid data, a routine monthly schedule, and often thousands of names to process. There’s also the problem of false positives: common names cause matches to appear that don’t actually refer to the right person, and each of these has to be investigated before you can either clear it or take action on it. Making the mistake of flagging the wrong John Smith as excluded is a costly error in itself.
It is because of this combination—its width, how often it occurs, the amount of it, and the fact that it has been verified—that serious programmes choose to automate. The aim is not to get rid of human judgment; rather, it is to use that judgment on the small number of genuine matches rather than having to deal with the thousands of ordinary checks and false alarms. It also ensures that the monthly deadline is actually kept month after month, rather than being missed the moment the person responsible for carrying out the checks goes on leave.
Building a defensible programme
When putting together a programme or improving one, it all boils down to a few key steps.
- Make a list of all the people within the scope: this includes employees, contractors, vendors, agency staff, referring providers, and the organisations and owners associated with them.
- Go through the full list of sets, including the OIG LEIE, SAM.gov, and all the state Medicaid lists for the states where you bill, as well as the appropriate licensing boards.
- Before hiring and each month carry out the check, and carry out additional checks when the employee is re-credentialed or when there is a change to their name or role.
- Add continuous monitoring of adverse media and licence actions so that you will detect the signals which come before an exclusion.
- Make sure to check each hit before taking any action by matching common names to the correct person.
- Make sure that you keep records detailing what you have checked and when it was checked, so that the entire programme can be audited.
- Before a match is confirmed, specify how you will respond by removing the individual from federally billable work, carrying out an investigation, and making a self-disclosure where this is required by the rules.
This isn’t anything unusual; it’s the difference between a programme which safeguards you and one that merely contains a collection of screenshots.
Check often, and keep the receipts
The organisations which suffer as a result of exclusions never carry out any malicious action; instead, they simply check too infrequently, fail to keep a record, or are unable to produce proof of what they had checked when it mattered. In each case the problem can be solved and all of them boil down to the need to watch continuously and to retain the evidence.
Beady fits into that ongoing layer by continuously monitoring providers and vendors through adverse media, sanctions, legal and regulatory actions, and licensing and disciplinary signals, each finding being traceable back to its original source so that your team can verify it and an auditor can see it too. The system is designed to detect the early warning signs that come before a provider is excluded and provides the dated, source-linked record that is essential to a healthcare compliance programme, together with the exclusion-list checks which are at the heart of your process.
If you’d like to see what would be revealed by having continuous, source-linked monitoring carried out on your providers and vendors, go for a demo and we’ll go through.
