Who Is to Blame for Gaps in OIG and State Exclusion Lists? What Is the Impact on Providers?

 

The failure to report excludable offenses by state Medicaid offices and licensing boards is a longstanding issue for the OIG. Recent OIG audits and reports have confirmed these state failures to report. For example, an OIG study released in August found that over 12% of terminated providers were able to continue participating in other state Medicaid programs because states were not sharing terminated provider information. In addition, two recent Medicaid Fraud Control Unit (MFCU) audits discovered that they routinely failed to timely report conviction information to the OIG and sometimes did not report them at all.[1] Reporting failures lead to gaps in the OIG Exclusion List (LEIE) because the OIG cannot exclude an individual if the OIG is never informed of the state’s conviction, termination, or suspension of providers. Such failures to report are important because the information that would have been reported can lead to exclusion violations, which are listed on the LEIE. But, state compliance failures are not the only cause of gaps in OIG and State exclusion lists – as we discuss, no matter who is at fault, the provider may pay for anyone’s mistake.

The OIG Exclusion List Has Limited Search Capabilities

One important reason providers should not rely on screening only the LEIE is that its search function is extremely narrow.  If an excluded individual uses a different name, such as a middle or maiden name, an LEIE search using the person’s first and last names my not produce any results.[2]  For example, J. A.[3] was excluded from participation on Georgia’s state exclusion list in August 2015. However, a search for “J.A.” on the LEIE currently produces zero results. 

J.A. LEIE_Redacted

Conversely, when we searched J.A. on SAFERTM, our proprietary exclusion database, we not only found a match on the Georgia list (“J.A.”), but we also found a match on the LEIE and SAM databases for “R.J.A.”. Interestingly, “J.A.” has the same middle and last name as “R.J.A.,” they are both Georgia residents, and they were both excluded from participation in April 2015. Like many states, the identifying information on Georgia’s list is sparse. Nevertheless, it is extremely likely that R.J.A. and J.A. are the same person, which a provider would have missed if he only searched the LEIE for J.A.

J.A.SAFER_Redacted

Reported Cases May Not Be Picked Up by OIG

Florida’s Agency for Health Care Administration publishes monthly press releases which identify persons terminated from participation in Florida Medicaid.  It expressly states that the exclusion information was “reported to the federal government for placement on the federal exclusion list,” and named providers appear on Florida’s Excluded Provider List.  When we conducted a SAFERTM search for G.B., who was listed on the April 2015 memo as “terminated from participation,” the only two “hits” were from Florida’s state exclusion list.  

G.B. SAFER_Redacted

However, an LEIE search for G.B. produced zero results.  

G.B. LEIE_Redacted

One possible explanation for why G.B. fails to show up on the LEIE could be the administrative process of OIG actually reviewing the reason for the termination and then formally excluding G.B. Nevertheless, a provider who only screens the LEIE and employs or is considering employing G.B. would miss this exclusion.  

OIG Just Misses Some Cases

K.B., a Registered Nurse (RN) with multistate licensure privileges, was placed on probation for substance abuse in February 2005. After testing positive for morphine, Iowa revoked her license and several other states revoked her multistate privileges. While the revocations were reported, the licensure revocation only resulted in K.B.’s exclusion from participation by California and the GSA-SAM in 2010. K.B. is not listed on the LEIE. This means that K.B. is unable to participate in any other state Medicaid program because under the ACA 6501, if you are terminated for cause from participation in one state, then you are terminated in all states, and K.B. is barred from contracting with the federal government. However, if a provider only screened the LEIE he would be completely unaware and could potentially face very hefty fines.

What This Means

Clearly some information is getting lost or mixed up in the reporting pipeline between state Medicaid offices, MFCUs, and the OIG, and the lesson for providers is that merely screening the LEIE is not enough. The examples above demonstrate that human error, narrow search functions, and simply missed information all play a role in the gaps that exist between publication on state exclusion lists and the LEIE.

State Medicaid offices are responsible for compiling and reporting information about excluded providers. However, as demonstrated by the “J.A.” case, the probable human error of transposing names combined with the LEIE’s limited search capabilities could result in a provider employing an excluded person, even though he was properly screened against the LEIE. To avoid this, providers should screen against the LEIE, the GSA-SAM, and all available state lists monthly. Practices should also ensure they use wide search parameters (alternate spellings, full names, maiden names, etc.) when conducting searches or they should select a vendor, like Exclusion Screening, LLC, with a system designed to anticipate these issues.

Notwithstanding name discrepancies, some information just does not make it to the LEIE. As the “G.B.” example reveals, a practice may face considerable monetary fines because it failed to screen the Florida exclusion list and relied solely on the LEIE for exclusion information, and the OIG failed to add G.B.’s name to the LEIE. Similarly, a provider who considered employing “K.B.” would be totally unaware that she was excluded from participation unless the provider screened the GSA-SAM and/or the California exclusion list. Remember that ACA section 6501 states that when an individual or contractor is excluded in one state, he or she is excluded in all states. When a provider misses such state exclusion information, he or she could be liable for CMPs of $10,000 for each claim provided directly or indirectly by the excluded individual, an assessment of up to three times the total amount paid by the government, and potential false claims liability.  Relying on the LEIE’s exclusion information without checking all other available state exclusion lists is a substantial monetary risk for a practice to take. If screening and verifying 40 state and federal exclusion lists each month is overly burdensome for your practice, contact Exclusion Screening, LLC today for a free assessment: 1 (800) 294-0952.

[1] MFCUs are supposed to send a referral letter to the OIG within 30 days of sentencing for the purpose of alerting the OIG about providers excluded from state programs, but the OIG found that in some cases this exclusion information was not referred to the OIG for over 100 days.

[2] We have even found that hyphenated names frustrate LEIE searches even where the actual names are used!

[3] Full names have been redacted for privacy.

OIG’s Updated Special Advisory Bulletin on the Effect of Exclusions

OIG Sanction Checks
The Office of the Inspector General (OIG) Broadly Interprets Exclusion Regulations
OIG’s Demonstrated Interest in Exclusion Screening and Forewarning of Increased Enforcement Efforts
By Paul Weidenfeld

The OIG’s Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs[1] explains the types of conduct that could violate the payment prohibition, which regards items or services provided by excluded persons, and the potential administrative sanction checks for employing excluded persons or contractors. The advisory was issued less than a month after OIG specifically amended its Self-Disclosure[2] protocol to include exclusion violations.

Although the advisory bulletin provides some guidance on the screening of employees and contractors, it is not very helpful. Thus, the timing of the advisory and its emphasis on enforcement strongly suggested that OIG would expand its efforts. Subsequent events have shown this to be true.

I.  The Regulations on Payment and Penalties

The regulation prohibiting payment for services furnished or provided by excluded persons, 42 CFR § 1001.1901(b), states that payments should not be made for items or services furnished “by an excluded individual or entity, or at the medical direction or on the prescription of a physician or other authorized individual who is excluded when the person furnishing such item or service knew or had reason to know of the exclusion.” The regulation’s language makes no reference to services or items provided by employees or contractors, so one could reasonably understand the payment prohibition to be relatively narrow.

Reasonable or not, the OIG takes the opposite view and interprets the prohibition expansively. In its view, the regulation applies to “all methods of . . . payment,”[3] and includes virtually any item or service performed by an excluded person or entity that contributes in any way to any form of reimbursement. The bulletin advises, for instance, that the preparation of a surgical tray by an excluded person could run afoul of the prohibition, as could inputting information into a computer by an excluded person. Administrative and management services, IT support, and even strategic planning would also be prohibited “unless wholly unrelated to Federal health care programs.” Even a volunteer’s assistance might trigger the prohibition if he or she was excluded.

OIG takes a similar approach when interpreting 42 CFR §1003.102(a)(2), which gives OIG authority to issue Civil Money Penalties (CMPs) for violations of the payment prohibition in addition to sanction checks for the submission of false or fraudulent claims.[4] In its view, the imposition of penalties are appropriate if an “excluded person participates in any way in the furnishing of items or services that are payable by a Federal health care program” and if the provider “knew or should have known” of the exclusion. Furthermore, the prohibition extends to “all categories of items or services”—whether they involve direct or indirect care, are administrative or management services, or even, as noted previously, if an excluded volunteer provided part of a service that was ultimately reimbursed. As long as the provider’s claim includes “any items or services furnished by an excluded person,” and the provider “knew or should have known” of the exclusion, OIG has the authority to issue CMPs.

II.  OIG Sanction Checks Guidance on Screening: Follow at your own Peril!

According to the advisory, providers can “avoid potential CMP liability” by checking the LEIE (OIG’s List of Excluded Individuals and Entities) “to determine the exclusion status of current employees and contractors.” OIG describes the LEIE as a “tool” that is “searchable” and “downloadable” to enable providers to identify excluded employees and contractors, and recommends that providers check it monthly to “minimize potential overpayment and CMP liability.”[5]

The section on screening suggests that the process is a relatively easy one. It states that providers have to simply “review each job category or contractual relationship to determine whether the item or service being provided is directly or indirectly, in whole or in part, payable by a Federal health care program. If the answer is yes, then . . .  [providers must] screen all persons that perform under that contract or that are in that job category.”[6] Simple as that? Unfortunately, no. There are a number of problems the guidance fails to recognize or understand.

III. Failures of OIG’s Guidance in Advisory Bulletin

To begin, though the LEIE can be searched, it can only search five employees at a time. Each name has to be entered manually, and potential matches must be verified individually. This might work if a provider only has to screen a handful of employees or contractors, but imagine how long searching 100 employees, five at a time, would take. Or 1,000? Or 10,000? Nor does downloading the database help many providers. Most do not have the IT capability to compare their employee database to the LEIE in any reliable or economically viable way.

The OIG’s guidance that providers simply need to use “the same analysis” for contractors and subcontractors “that they would for their own employees” is also problematic.[7] It is difficult enough to identify every employee who contributes in any way to items or services that contribute to any amount of reimbursement in any form, but it is extremely unrealistic to expect a provider to meet that standard for his contractors, subcontractors, and their employees. Wouldn’t almost every person that walked into hospital or nursing home that wasn’t a patient or relative be a candidate? And what about their co-employees working out of their offices?

Still another concern, perhaps the most significant one, is that the guidance can be read to give the impression that providers can satisfy their screening obligations by conducting searches of the LEIE on a regular basis. The OIG might be satisfied with screening the LEIE on a regular basis, but such a screening protocol is unlikely to satisfy the various state Medicaid requirements or state regulations. For instance, approximately 38 states have their own sanction checks lists, and providers are required to check these state lists. Some states also require providers to certify that none of their employees or contractors have been “suspended, or excluded from Medicare, Medicaid or other Health Care Program in any state![8] Even the OIG’s advice that exclusion checks be completed on a “regular” basis would be inadequate in most states, as CMS has directed State Medicaid directors to require monthly screening and most, perhaps all, have followed that directive.

IV.  Final Thoughts

Exclusion screening has clearly become a “front burner” issue for OIG. Providers should take note of OIG’s broad interpretation of their obligations and of its inclusion in the Self-Disclosure Protocol. Providers also need to be aware of the regulations in their States which are typically more onerous that federal ones. Finally, while there are a number of difficult questions that don’t have easy answers (such as, Who do I need to screen? Which databases do I screen? How can I accomplish screening? and How do I deal with contractors?), they are easier to deal with sooner rather than later, and they are dangerous to put off.

OIG Sanction Checks

Paul Weidenfeld, Co-Founder and CEO of Exclusion Screening, LLC, is the author of this article. He is a longtime health care lawyer whose practice has focused on False Claims Act cases and health care fraud matters generally. Contact Paul should you have any  questions at: pweidenfeld@exclusionscreening.com or 1-800-294-0952.


[1] The 2013 Bulletin “replaces and supersedes the 1999 Bulletin.” Dep’t of Health and Human Servs. Office of the Inspector Gen., Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs, 4 (May 8, 2013).

[2] Update to Self-Disclosure Protocol issued April 17, 2013, Dep’t of Health and Human Servs. Office of the Inspector Gen.

[3] “This payment prohibition applies to all methods of Federal health care program payment, whether from itemized claims, cost reports, fee schedules, capitated payments, a prospective payment system or other bundled payment, or other payment system and applies even if the payment is made to a State agency or a person that is not excluded.” Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs at 6.

[4] The regulation authorizes CMPs under circumstances where a person making a claim:

“knew, or should have known, that the claim was false or fraudulent, including a claim for any item or service furnished by an excluded individual employed by or otherwise under contract with that person.”

While the regulation’s reference to excluded persons seems clearly intended to clarify the circumstances under which CMPs would be applicable to false claims, the OIG’s interpretation that it also authorizes sanctions for violations of the payment prohibition is accepted and rarely, if ever, questioned.

[5] Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs at 15. The OIG recognizes that there is no federal requirement to check the LEIE monthly, recommends it. It also recommends that providers rely on the LEIE over other databases such as GSA-SAM and NPDB.

[6] Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs at 15. Providers were also advised that they could rely on contractor screening, but that they would remain responsible for overpayment liability and CMPs if it failed to ensure that “appropriate exclusion screening had been performed.” Id.

[7] Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs at 16.

[8] See, for example, Rule § 352.5 of the Texas Administrative Code which states:

Prior to submitting an enrollment application, the applicant or re-enrolling provider must conduct an internal review to confirm that neither the applicant or the re-enrolling provider, nor any of its employees, owners, managing partners, or contractors (as applicable), have been excluded from participation in a program under Title XVIII, XIX, or XXI of the Social Security Act.

An even more exacting obligation is found in Louisiana where provider agreements require applicants to certify that no employee is:

not now or … ever been: suspended or excluded from Medicare, Medicaid or other Health Care Program in any state” or “employed by a corporation, business, or professional association that is now or has ever been suspended or excluded from Medicare, Medicaid or other Health Care Programs in any state” (emphasis added).

Exclusion Databases: How Difficult Is Screening and Verifying?

exclusion database
I.  Which Exclusion Databases Do I Need to Screen?

The Office of Inspector General (OIG) recommends that you screen your employees, contractors, and vendors every month against the List of Excluded Individuals and Entities (LEIE) and the System for Award Management (SAM). Your State Medicaid director mandates monthly screening of your State exclusion database, in addition to the LEIE and, perhaps, the SAM.  In a number of states, when you enroll or re-enroll you have to certify that none of your employees or contractors are excluded from any Federal or State Healthcare Program. 

If your State happens to be Texas, you will have to certify that you have conducted an “internal review” to determine if any of your employees or contractors have been excluded from Medicareany State Healthcare program, or from the CHIP program.[1] Unfortunately, each of the 37 databases to be searched (the LEIE, SAM and 37 States) are “stand alone” databases that are unique in their composition, content and the way they can be screened.  This article discusses those differences and the problems associated with them.

II.  Screening the LEIE

The LEIE contains approximately 60,000 persons and is updated monthly. It contains identifying information such as the excluded individual’s name, date of birth, provider type, and other information. It is also searchable or downloadable. The LEIE allows a provider to perform a basic name search. It then provides a list of names that match your search. To determine if the potential match is your employee, the database verifies quickly by Social Security Number (SSN). The OIG describes the process in its May, 2013 Advisory Bulletin as a relatively simple one in which providers only have to “review each job category or contractual relationship to determine whether the item or service being provided is directly or indirectly, in whole or in part, payable by a Federal health care program.” If only it was as easy as the OIG makes it sound.

Although the LEIE is “searchable,” it only allows five names to be searched at a time. In addition, potential matches can only be verified individually by entering the social security number. While this is not a problem for a 10-person practice, the difficulty of checking and verifying increases exponentially with a practice of 100, 1000, or even a provider with 5000 employees, such as a hospital.

The alternative of downloading the LEIE database is equally problematic. Most providers simply do not have the capability to download the LEIE (which contains almost 60,000 names), and compare it with their own employee database in any reliable or economically viable way.

We also note that the LEIE’s matching criteria is not exact and often overlooks potential exclusions. For example, there is no mechanism built into the LEIE that will allow a search for “William Smith” to return matches for common alternatives such as “Bill,” “Will,” “Willie” or “Billy” Smith. Finally, one last significant issue is that the guidance by OIG ignores State screening requirements and regulations. 

III.  GSA-SAM

The System for Award Management (SAM) consolidated the Central Contractor Registry (CCR), Federal Agency Registration (FedReg), Online Representations and Certifications Application (ORCA), and Excluded Parties List System (EPLS) into a single database for federal contractors who were debarred, sanctioned, or excluded for contract or other fraud. The consolidation eliminated certain codes, reclassified others, and uses four exclusion classifications: Firm, Individual, Vessel, and Special Entity Designation (a catch-all phrase for an organization that is not considered a firm, individual, or vessel, but nonetheless needs to be excluded). 

The SAM consists of almost 126,000 excluded entities and providers. It verifies by EIN, CAGE Code, DUNS, NAICS, or PSC. Excluded individuals are verified by SSN. Similar to the LEIE, the SAM is either searchable or downloadable, but it also presents similar problems. For instance, the name search is limited and must be an exact match, so any slight variation will not return a match.

When verifying an excluded provider on SAM by SSN, you are directed to type your employee’s name and his or her SSN into the boxes provided. The database will then report whether the SSN and the provider’s name are a match in SAM. Unlike the LEIE, SAM matches the exact provider name[2] and SSN to the SAM database names and their associated SSNs. This is a big contrast to the LEIE, since SAM does not pull up a list of every person who matched your query for you to verify individually. As with the LEIE, downloading the entire list of 126,000 names and matching it with a large employee list is beyond the capabilities of most providers.

IV.  The States

Even though the States have much smaller exclusion registries, they are even more challenging than both the LEIE and the SAM when it comes to screening and verifying.[3]  Each listing is unique and comes in different document formats, with different fields, and contains different information. As a result of these differences, cross-checking names between State and Federal databases is a significant obstacle to overcome.

When it comes to verification, unlike digital verification as with the LEIE or SAM, most states verify excluded providers by email with the provider’s last four digits of his or her SSN.[4]  Usually, the email for the State’s contact is listed on the State’s exclusion database website or on the list itself. However, it is not unusual for there to be difficulty in tracking down the responsible person, different persons depending on the nature of the exclusion, or nobody listed at all. In those instances, phone skills and perseverance are required to find the right person to talk to. It can also take from around twenty minutes to several weeks to receive a response as to whether the names and SSNs listed are a match.

V.  Screening and Verifying All State Databases

We address why all State and Federal databases should be screened in other blog postings, but it is imperative to note that providers should screen and verify every State database. Section 6501 of the Affordable Care Act (ACA) mandates that if a provider or entity is excluded under any State Medicaid database, then that provider or entity should be excluded from participating in all States.[5] Accordingly, providers should know how to perform exclusion checks of all State databases. 

VI. Conclusion

While Exclusion Screening, LLCSM has compiled all thirty-seven State and Federal databases into our own searchable database for checks and verifications, this step is beyond the IT ability of most providers due to the variety of list formats (PDF, Word, Excel); the differences in information provided within each database (i.e., some States provide first and last names, while other states provide first, last, and middle names; additionally, some States parse the names into different excel fields, while others leave the entire name in one field); and the constant (usually monthly) updates to each State exclusion list. 

You can see why the checking and verification process is not as simple as OIG and the States may have suggested. Even though the process is time consuming, it is critical that providers check employees, vendors and contractors against all 37 lists. Failure to properly screen employees and vendors could result in CMP liability of up to $10,000 for each item or service furnished directly or indirectly by an excluded individual. Instead of overburdening your current employees, contact Exclusion Screening, LLCSM today and we will do the heavy lifting for you.

Erin Archer

Erin Archer is the author of this article. Feel free to contact us at 1-800-294-0952 or online for a free consultation.


[1] See, e.g., Texas Admin. Code, Rule § 352.5.  An even more exacting obligation is found in Louisiana where provider agreements require applicants to certify that no employees or contractors are currently, nor have ever been, excluded from Medicare, Medicaid or other Health Care Program in any state!

[2] Unlike the LEIE and some State databases, SAM has only one designated field for the provider’s “name,” instead of parsed “first,” “last,” and “middle” name field options.

[3] As of this posting, there are thirty-seven separate state listings.

[4] California and Florida do not verify by SSN.

[5] 42 U.S.C. 1396(a) (2012). Whether an exclusion by one state actually “excludes” an individual from all states or makes him “excludable” from all states is an open question at present, but why take the chance of hiring a person who has been excluded in another State if you don’t have to?