Ask ten compliance officers how often they screen against the OIG exclusion list and you will get a range of answers: at hire, annually, quarterly, monthly. Only one of those aligns with what regulators expect, and the gap between them is where most exclusion liability is created.

The short answer is monthly. The longer answer explains why, and what “monthly” actually has to include to be defensible.

Where the monthly expectation comes from

There is no single statute that says “screen monthly.” The expectation emerged from the interaction of two facts.

First, OIG updates the LEIE on a monthly cycle, publishing both the full database and a supplement listing newly added names. A monthly screening cadence matches the rhythm at which the underlying data actually changes.

Second, CMS directed state Medicaid agencies to screen — and to require their providers to screen — on a monthly basis, in guidance issued to State Medicaid Directors. That guidance is the practical source of the monthly standard for most providers, because it flows down through state Medicaid program requirements and provider agreements.

Layered on top: managed care contracts, accreditation standards, corporate integrity agreements, and health plan delegation agreements now routinely specify monthly exclusion screening. At this point, monthly is simply the operating assumption of the industry. An organization screening annually is not making a defensible risk judgment — it is out of step with what auditors, payers, and OIG expect.

Why screening at hire fails

The logic of point-in-time screening assumes exclusion status is a fixed attribute of a person. It is not. It is a status that changes, continuously, without any notification to the employer.

Consider the sequence. A medical assistant clears screening in January and is hired. In April, a state licensing board suspends her certification following a complaint. In July, OIG adds her to the LEIE under its permissive authority. Nobody tells the employer — OIG does not send notices to employers about newly excluded staff.

If the organization screens annually, the next check comes the following January. That is six months of claims associated with an excluded employee, every one of which is a countable item for civil monetary penalty purposes. Under monthly screening, the exposure is at most a few weeks.

The math is unforgiving because penalties are assessed per item or service, not per employee or per year. Detection lag translates directly into liability. This is the single strongest argument for monthly screening, and it is why OIG settlements involving excluded employees so frequently trace back to organizations that screened once and stopped.

Who needs to be screened

Broader than the payroll file. The payment prohibition attaches to any item or service furnished by an excluded person that is paid for, directly or indirectly, by a federal health care program. That means your screening population should include:

• All employees — clinical and non-clinical, full-time and part-time, including administrative, billing, IT, food service, housekeeping, and transport staff
• Independent contractors and locum tenens providers
• Temporary and agency staff, including everyone placed by a staffing firm
• Vendors and suppliers whose goods or services are reimbursed directly or indirectly
• Owners, board members, officers, and managing employees
• Volunteers and students or interns on clinical rotation
• Downstream and delegated entities, for health plans and managed care organizations

Vendor screening is where most programs have gaps. Contracting language that requires the vendor to certify it screens its own people is useful, but it does not transfer liability. If a staffing agency places an excluded nurse in your facility, the overpayment and penalty exposure land on you.

Which databases to check

The LEIE alone is not sufficient. A complete monthly screen normally covers:

• The OIG LEIE — federal health care program exclusions
• SAM.gov — federal suspension and debarment, government-wide, covering parties barred from federal contracts and grants
• State Medicaid exclusion lists — for every state in which you operate or in which staff are licensed
• The CMS Preclusion List — where Medicare Advantage or Part D is involved

State lists matter more than many organizations realize. A provider can appear on a state Medicaid exclusion list and never appear on the LEIE. State exclusions are also independent of federal ones: reinstatement at the federal level does not remove a name from a state list. Multi-state organizations often need to screen against a dozen or more state databases every month.

Doing it properly: name variations and match resolution

Two execution details separate a real screening program from one that only looks like it works.

Name variations. Searching only the name on the current I-9 will miss people. You need to search maiden names, prior married names, hyphenated and unhyphenated versions, combined names, and known aliases. Exclusions are often recorded under the name in effect at the time of the underlying action, which may be years before the person joined your organization.

Match resolution. The LEIE returns potential matches, not confirmed ones. A search on a common name will produce hits that are not your employee. Confirming or ruling out a match is the employer’s responsibility, and it requires verification against identifiers — date of birth, Social Security number, NPI, or address history — not a judgment call.

The failure modes run in both directions. Clearing a genuine match because the middle initial differed creates liability. Suspending an employee over a false positive creates a very different kind of problem. Both are avoided by a documented resolution procedure rather than an ad hoc one.

Documentation is the deliverable

Here is the part that determines how an audit goes: an unrecorded screen is, for practical purposes, a screen that did not happen.

When OIG, a state Medicaid agency, or a payer asks for evidence, they are asking for records. Your documentation should capture, for every screening cycle:

• The date the search was run
• Every database searched
• Every name and name variation queried
• The result for each individual and entity
• For any potential match, the resolution steps taken, the identifiers compared, the conclusion, and who reached it
• Who performed the search

Retain these records. A screening history you can produce on demand is the difference between demonstrating a functioning compliance program and asserting that you have one.

Building it into the workflow

Monthly screening works best when it is not a standalone task somebody has to remember. Effective programs embed exclusion checks into existing processes:

• Pre-hire — before an offer is extended, not after the start date
• Onboarding — as a condition of completing the file
• Credentialing and re-credentialing — at every cycle
• Contract execution and renewal — for every vendor and contractor
• Monthly roster screening — the full active population, every month

At scale, manual screening stops being viable. Checking a few hundred names against the LEIE, SAM.gov, and a set of state databases — with name variations — is thousands of individual searches per month. Most organizations past a certain headcount move to automated screening, both for throughput and because automation produces the audit trail as a byproduct rather than as extra work.

The bottom line

Monthly is the standard, and the reasoning is simple: exclusions happen continuously, nobody tells you when one affects your staff, and penalties accrue per item or service for the entire time you do not know.

Screening frequency is really just a decision about how much detection lag your organization is willing to carry. Monthly keeps it to weeks. Annually keeps it to a year — and a year of unnoticed exclusion is how a routine compliance gap turns into a settlement announcement.