The exclusion gap: federal screening misses most state Medicaid bars

The OIG List of Excluded Individuals and Entities — the LEIE — is the federal registry that screening programs treat as the master list of providers barred from Medicare, Medicaid, and other federal health programs. But it is not the only list. Every state Medicaid agency runs its own exclusion program, on its own authority and its own clock. When the two lists disagree, the disagreement is the story: a provider barred by a state but absent from the federal file is invisible to anyone who screens federally and stops there.

This study quantifies that gap. It joins the state Medicaid exclusion records Fonteum holds — New York, Ohio, Georgia, and Pennsylvania — against the federal OIG LEIE on the National Provider Identifier, and measures how many state-excluded providers have no federal record at all.

The gap, in one number

59.1% of NPI-identified state-excluded providers are missing from the federal list: 2,242 of 3,794 across the four live states carry no matching record on the OIG LEIE. Put the other way, federal-only screening catches only 1,552 of the 3,794 — it clears the rest as having no exclusion on file.

The breakdown by state shows the pattern is not a single-state artifact. Three of the four states sit between 54% and 60%; only Georgia, on a very small matchable sample, comes in lower.

The denominator throughout is NPI-identified, in-force state exclusions. A state exclusion counts as in force when it carries no reinstatement date, or a reinstatement date still in the future — the same test the federal side uses. The join is on NPI only, never on name.

Why federal-only screening misses these providers

The gap is structural, not a data error. State Medicaid agencies exclude providers under state authority for Medicaid-specific reasons, and a federal exclusion does not automatically follow. The OIG may adopt a state action under its permissive §1128(b) authority — most commonly §1128(b)(4) for a state license revocation, surrender, or suspension — but that adoption is discretionary and lagged. Many state bars never cross over at all, and those that do can take months to a year to appear on the federal file.

A second mechanism is timing. An exclusion is a trailing record on both sides, but the two trailing records do not move together. A provider can be terminated from a state Medicaid program well before — or entirely without — a parallel federal action. The federal CCN- and enrollment-side machinery moves on its own cadence, a pattern we documented in the lag between a termination event and CMS deactivation.

An exclusion is only as good as the list you check. Screen the federal LEIE alone and nearly three in five NPI-identified state-barred providers come back clean.

The companion fact from the federal side reinforces the point. As we found in who actually gets barred from Medicare and why, the single largest basis on the federal LEIE is itself a downstream record of state licensing discipline — §1128(b)(4) license actions are 41% of the list. The federal file is, in large part, a lagging echo of state decisions. The state lists are where many of those decisions land first.

How the gap differs by state

New York sets the ceiling: 1,347 of its 2,254 NPI-identified state-excluded providers — 59.8% — have no federal record. Pennsylvania (58.4%) and Ohio (53.9%) follow closely. The three large states agree within six points, which is what gives the 59.1% pooled figure its weight: it is not carried by one outlier.

North Carolina is the honest empty state here. It is registered as part of the state exclusion ring, but no North Carolina records have been ingested yet, so it contributes nothing to these counts. We report it as absent rather than imply coverage we do not have. As the ring expands, each new state will widen the matchable base and re-test the gap.

The providers with no NPI at all

12,926 in-force state exclusion records carry no NPI — and they are a screening problem of their own. Across the four states, only a minority of exclusion records include an NPI at all: 3,794 distinct NPIs sit inside 17,166 in-force records. The remainder name an excluded party with no identifier that maps to the federal list.

These records are excluded from the matchable denominator above, because matching them to the federal list would require a name match — and a name match is not a defensible identity assertion. We do not guess. But the practical implication is blunt: NPI-based federal screening cannot reach these parties at all, so they compound the gap rather than shrink it. The same limitation applies in reverse, and it is the reason the federal LEIE itself carries an NPI on only about one record in ten, as documented in the LEIE reference study.

What this means for screening compliance

A federal-LEIE-only screen is not a complete exclusion check, and the magnitude here puts a number on the shortfall: 59.1% of NPI-identified state-barred providers fall outside it. The OIG's own guidance is that an employer or contractor must screen against all applicable exclusion lists — federal and the relevant state Medicaid lists — before hiring or contracting, and on an ongoing basis. Employing or contracting an excluded party in a federally billable role carries civil monetary penalty exposure under a "knew or should have known" standard.

The constructive read is that the two layers of lists do something neither does alone. The federal LEIE is national but lagging and NPI-sparse; the state lists are current and program-specific but jurisdictionally fragmented. Checked together, across frozen snapshots signed at the row level, they close gaps in each other. Fonteum exposes both layers through a single NPI lookup — the state exclusion data and the federal OIG LEIE — so a "barred anywhere on the lists we hold" answer does not depend on which single list a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds", never as a guarantee that none exists.

Methodology

Every figure is a direct join between two public, row-level-signed Postgres tables: state_exclusions (the State Exclusion Ring — NY OMIG, OH ODM, GA DCH-OIG, PA DHS; both RLS Pattern B, public read) and oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 active records). The join key is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match.

A record is treated as in force when its reinstatement date is null or still in the future relative to the publish date — the same test the production exclusion lookup applies, and applied identically to both tables. The matchable denominator is the set of distinct, in-force, NPI-identified providers per state; records with no NPI are excluded from it and reported separately. The federally-invisible count is the subset of those NPIs with no row in oig_leie_exclusions. The exact SQL is in the reproducibility block below and the provenance methodology documents the row-level signing contract. Methodology version: exclusion-gap/v1.

Limitations

• Four states, not fifty. Coverage is New York, Ohio, Georgia, and Pennsylvania. North Carolina is registered but not yet ingested. The 59.1% figure describes the four live states, not the nation.
• NPI is the floor, not the ceiling. 12,926 in-force state records carry no NPI and cannot be matched to the federal list by identifier; they are reported separately, never guessed at by name.
• Snapshot, not cumulative. Both lists are point-in-time. State files and the federal release shift over time; these figures reflect the current ingested snapshots.
• Georgia is a small sample. Only 35 Georgia records carry an NPI, so its 22.9% share is illustrative, not stable.
• A compliance signal, aggregate-only. Exclusion counts are an enforcement and screening signal, never a measure of care quality. No individual excluded party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — the federal exclusion list and the comparison anchor.
• OIG — effect of an exclusion (screening duty, civil monetary penalties) — the obligation to screen all applicable lists.
• New York OMIG — Medicaid exclusions — the New York state source.
• Ohio Department of Medicaid — provider exclusion and suspension list — the Ohio state source.
• Georgia DCH — Office of Inspector General — the Georgia state source.
• Pennsylvania DHS — sanctioned providers — the Pennsylvania state source.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the permissive §1128(b)(4) license-action authority.