Overview
Healthcare sanctions screening checks whether a person or organization has been excluded from federal healthcare programs. It is the one screening component where the consequence of getting it wrong is measured per invoice rather than per hire.
It is also frequently confused with license verification. A license says whether someone may practice. An exclusion says whether the government will pay for what they do. Someone can hold a spotless active license and still be excluded, and an employer that checks only the license will never see it. Our license verification page covers the other half.
Throughout this page, “screening company” refers to the outside firm an employer hires to run the check. In the law it is called a consumer reporting agency, or CRA.
What an Exclusion Actually Is
An exclusion is an administrative action by the Office of Inspector General at the Department of Health and Human Services, barring a person or entity from participating in federal healthcare programs. It is not a criminal conviction and it is not a license action, though it frequently follows one.
Exclusions come in 2 forms:
| Mandatory | Required by law following certain convictions, including healthcare program fraud, patient abuse or neglect, and felony convictions relating to controlled substances or healthcare fraud. The minimum period is 5 years. |
| Permissive | Discretionary, arising from a wider range of conduct including license revocation or suspension, defaulting on health education loans, misdemeanor fraud convictions, and providing unnecessary or substandard care. |
Exclusion does not expire on its own. When the period ends, the individual must apply for reinstatement and receive written notice that it was granted. Someone who has served the term but never applied remains excluded, which surprises people and shows up on screens years later.
The Effect of Exclusion
No federal healthcare program payment may be made for any item or service furnished by an excluded person, or directed or prescribed by an excluded physician. That is the whole rule, and it is broader than it first sounds. It does not only bar the excluded person from billing. It bars payment for anything they touched, whoever submits the claim.
An organization that employs or contracts with an excluded person and bills a federal program for services that person contributed to faces civil monetary penalties for each item or service on the claim, plus an assessment of up to 3 times the amount claimed. The statutory penalty figure is adjusted for inflation annually, so the current number moves. What does not move is that liability is calculated per line item rather than per hire, which is how a single overlooked employee becomes a very large number.
There is a narrow carve-out. An organization may employ an excluded person if that person is paid entirely from non-federal funds and works solely with patients outside federal programs. In practice almost no healthcare employer can maintain that separation, and relying on it is a compliance strategy that fails under audit.
The Lists That Matter
The LEIE
The List of Excluded Individuals and Entities is the OIG’s own database and the authoritative federal source. It is public, free to search, and refreshed monthly.
One practical warning from the OIG itself: the LEIE holds only the name the OIG knew at the time of exclusion. If someone was excluded under a maiden name or a former name, that is the name on the list. Searching only the current name will miss them.
SAM
The System for Award Management holds government wide exclusions and debarments, reaching well beyond healthcare into federal contracting generally. Some parties appear in SAM and not in the LEIE, so the 2 are not interchangeable.
State Medicaid Exclusion Lists
States run their own Medicaid exclusion programs and can exclude a provider independently of any federal action. A person can be entirely clean on the LEIE and on SAM while being excluded by a particular state’s Medicaid agency.
Most states publish a list, but they are separate, formatted differently, and updated on their own schedules. This is the single largest gap in organizations that screen only federally.
What FACIS Is
FACIS stands for Fraud Abuse Control Information System. The first thing to understand is what it is not.
FACIS is not a government list. It is a commercial database owned and maintained by a private company, which aggregates content from federal and state sources into one searchable place. There is no federal requirement to use FACIS. The requirement is to know whether the people you employ are excluded, and FACIS is one way of answering that.
It exists because the underlying problem is fragmentation. There is no single government list. Answering the question properly means checking the LEIE, SAM, every relevant state Medicaid list, and ideally state licensing board actions across every jurisdiction a person has worked in. Doing that by hand for a workforce of any size is impractical, and doing it monthly is impossible.
The Levels
FACIS is sold in tiers, and the 2 commonly offered are the entry level and the top level.
| Level 1, sometimes 1M | Federal sources only, including the OIG exclusion list, SAM, the Drug Enforcement Administration, the Food and Drug Administration, TRICARE, and Medicare opt-out data. This is positioned as the minimum that satisfies federal screening expectations. |
| Level 3 | Everything above, plus thousands of state level sources, including state Medicaid exclusion lists, state contractor debarment lists, and the sanctioning boards of every U.S. jurisdiction across provider types. |
A middle tier is also marketed, but what it contains varies between resellers, so the label alone does not tell you what was searched. Vendors also quote very different source counts for the same product, ranging from around 2,000 to over 5,000. Ask which specific sources are covered rather than accepting a number.
Why Level 3 Is Usually the Right Answer
Federal screening alone leaves the state Medicaid gap described above, and it misses state licensing board discipline entirely. Level 3 exists to close both. Organizations operating in 1 state with a small workforce may reasonably decide the federal level plus their own state’s list is enough. Anyone hiring across state lines, or using contract and agency staff who have worked elsewhere, generally cannot.
Verify Any Hit at the Source
An aggregator returns a possible match. It is not itself the authority. Before acting on a FACIS result, confirm it against the underlying primary source, which for a federal exclusion means the OIG’s own list. Aggregated data ages between refreshes and matches on name.
Who Must Be Screened
The scope is wider than clinical staff, and this is where organizations under-screen.
The test is whether the person contributes in any way to items or services that get billed to a federal healthcare program. That reaches:
- Clinicians of every kind, employed or contracted
- Billing and coding staff
- Administrators and executives
- Pharmacy, laboratory, and imaging personnel
- Agency, locum, and temporary workers
- Vendors and contractors whose services flow into billed care
- Owners and anyone with a controlling interest
Staffing agency placements deserve particular attention. The agency may screen its own workforce, but liability for a claim sits with the organization that submitted it. Confirm what the agency screens, at what level, and how often, and get it in the contract.
How Often to Screen
Monthly is the working standard, and it comes from 2 directions.
Federal regulation requires state Medicaid agencies, Medicaid managed care organizations, and Medicare Advantage plans to check the LEIE and SAM no less frequently than monthly. Separately, the OIG has recommended in guidance that healthcare organizations screen their employees and contractors against the LEIE monthly.
The practical logic is simpler than the rules. The LEIE refreshes monthly, and liability accrues from the date of exclusion rather than the date the employer notices. An organization screening annually can be 11 months into an unrecorded exclusion before it finds out, with every claim in between exposed.
Some states go further and require monthly screening by regulation rather than recommendation, so the state where you operate needs checking as well.
Resolving a Potential Match
Exclusion lists match on name and, where available, date of birth and a provider identifier. False matches happen and the resolution process matters.
- Go to the primary source. Confirm the entry on the OIG list or the relevant state list rather than acting on an aggregator’s summary.
- Compare identifiers. The OIG list carries date of birth and frequently a provider identifier. Compare all of them, not just the name.
- Check the former name question in both directions. A match under a name your candidate has never used may be someone else, and a candidate excluded under a former name will not surface under their current one.
- Ask the person. A candidate previously excluded and reinstated will usually say so, and reinstatement is documented in writing.
- Document the conclusion. An audit will ask how you resolved it, and a file that shows the reasoning is the point of the exercise.
The Rules Employers Must Follow
Three rules apply. Each has its own page on this site, so this is the summary.
Screen Before Hire and Monthly After
A pre-hire check alone leaves the organization exposed for every month between screens. Match the cadence to the monthly refresh of the underlying list.
Get Written Permission When a Vendor Is Involved
Where a screening company supplies the search, the result is part of a consumer report. The employer must give a standalone written disclosure and obtain written authorization before requesting it. See our FCRA overview.
Follow the Steps Before Rejecting Someone
If the result is going to cost the candidate the job, the employer must send a preliminary notice with a copy of the report, allow time to respond or correct an error, and only then issue the final decision. See the adverse action process.
For Healthcare Professionals
- Check yourself on the OIG list. It is public and free. Search every name you have used, including a maiden name, because that may be the name on file.
- Reinstatement is not automatic. If you were excluded and the period has ended, you must apply and receive written notice. Until then you are still excluded, however long ago the term expired.
- Check your state too. A state Medicaid exclusion is separate from a federal one and will not appear on the OIG list.
- An exclusion is not a criminal record. It is an administrative bar on program participation, and it is not a conviction, though one may have caused it.
- Keep your reinstatement letter. Aggregated databases carry historical records, so an old exclusion can resurface on a screen long after it ended. The letter closes the conversation immediately.
- If the report is wrong, dispute it. Our guide to disputing a background check covers the process.
Best Practices
- Screen everyone whose work contributes to federally billed services, not only clinical staff
- Screen monthly rather than at hire, matching the refresh cycle of the underlying list
- Cover the state Medicaid lists, not only the federal ones, for every state your staff have worked in
- Search former names and maiden names, since exclusions are listed under the name known at the time
- Verify any potential match at the primary source before acting on it
- Put screening obligations for agency and contract staff into the contract, and ask what level and frequency they use
- Keep dated evidence of every screening run, because an audit will ask for it
- Never rely on the non-federal funds carve-out unless you can genuinely prove the separation