The exclusion gap: federal screening misses most state Medicaid bars

The OIG List of Excluded Individuals and Entities — the LEIE — is the federal registry that screening programs treat as the master list of providers barred from Medicare, Medicaid, and other federal health programs. But it is not the only list. Every state Medicaid agency runs its own exclusion program, on its own authority and its own clock. When the two lists disagree, the disagreement is the story: a provider barred by a state but absent from the federal file is invisible to anyone who screens federally and stops there.

This study quantifies that gap. It joins the state Medicaid exclusion records Fonteum holds — ten states — against the federal OIG LEIE on the National Provider Identifier, and measures how many state-excluded providers have no federal record at all.

The gap, in one number

64.3% of NPI-identified state-excluded providers are missing from the federal list: 3,117 of 4,851 across the ten live states carry no matching record on the OIG LEIE. Put the other way, federal-only screening catches only 1,734 of the 4,851 — it clears the rest as having no exclusion on file.

The breakdown by state shows the pattern is not a single-state artifact. The three largest-sample states sit between 54% and 60%; the newer, smaller-sample states run higher still, and only Georgia and Montana — on very small matchable samples — come in lower.

The denominator throughout is NPI-identified, in-force state exclusions. A state exclusion counts as in force when it carries no reinstatement date, or a reinstatement date still in the future — the same test the federal side uses. The join is on NPI only, never on name.

Why federal-only screening misses these providers

The gap is structural, not a data error. State Medicaid agencies exclude providers under state authority for Medicaid-specific reasons, and a federal exclusion does not automatically follow. The OIG may adopt a state action under its permissive §1128(b) authority — most commonly §1128(b)(4) for a state license revocation, surrender, or suspension — but that adoption is discretionary and lagged. Many state bars never cross over at all, and those that do can take months to a year to appear on the federal file.

A second mechanism is timing. An exclusion is a trailing record on both sides, but the two trailing records do not move together. A provider can be terminated from a state Medicaid program well before — or entirely without — a parallel federal action. The federal CCN- and enrollment-side machinery moves on its own cadence, a pattern we documented in the lag between a termination event and CMS deactivation.

An exclusion is only as good as the list you check. Screen the federal LEIE alone and nearly two in three NPI-identified state-barred providers come back clean.

The companion fact from the federal side reinforces the point. As we found in who actually gets barred from Medicare and why, the single largest basis on the federal LEIE is itself a downstream record of state licensing discipline — §1128(b)(4) license actions are 41% of the list. The federal file is, in large part, a lagging echo of state decisions. The state lists are where many of those decisions land first.

How the gap differs by state

New York sets the ceiling among the large-sample states: 1,347 of its 2,254 NPI-identified state-excluded providers — 59.8% — have no federal record. Pennsylvania (58.4%) and Ohio (53.9%) follow closely. These three states carry the bulk of the matchable population and agree within six points, which is what gives the pooled 64.3% figure its weight: it is not the artifact of one outlier.

The newer states ingested into the ring push the pooled figure higher. Iowa, Maryland, Washington, North Carolina, and Mississippi all sit between 77% and 86% invisible — every one a clear majority — though each rests on a smaller matchable sample than the three anchor states. The direction is consistent across every state with a meaningful denominator: a majority of NPI-identified state bars have no federal counterpart.

The ring now spans ten states, from New York's 2,254 NPI-identified providers down to Georgia's 35. As it expands, each new state widens the matchable base and re-tests the gap — and so far every addition has reinforced rather than softened the headline.

The providers with no NPI at all

15,293 in-force state exclusion records carry no NPI — and they are a screening problem of their own. Across the ten states, only a minority of exclusion records include an NPI at all: 4,851 distinct NPIs sit inside 20,696 in-force records. The remainder name an excluded party with no identifier that maps to the federal list.

These records are excluded from the matchable denominator above, because matching them to the federal list would require a name match — and a name match is not a defensible identity assertion. We do not guess. But the practical implication is blunt: NPI-based federal screening cannot reach these parties at all, so they compound the gap rather than shrink it. The same limitation applies in reverse, and it is the reason the federal LEIE itself carries an NPI on only about one record in ten, as documented in the LEIE reference study.

What this means for screening compliance

A federal-LEIE-only screen is not a complete exclusion check, and the magnitude here puts a number on the shortfall: 64.3% of NPI-identified state-barred providers fall outside it. The OIG's own guidance is that an employer or contractor must screen against all applicable exclusion lists — federal and the relevant state Medicaid lists — before hiring or contracting, and on an ongoing basis. Employing or contracting an excluded party in a federally billable role carries civil monetary penalty exposure under a "knew or should have known" standard.

The constructive read is that the two layers of lists do something neither does alone. The federal LEIE is national but lagging and NPI-sparse; the state lists are current and program-specific but jurisdictionally fragmented. Checked together, across frozen point-in-time snapshots, they close gaps in each other. Fonteum exposes both layers through a single NPI lookup — the state exclusion data and the federal OIG LEIE — so a "barred anywhere on the lists we hold" answer does not depend on which single list a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds", never as a guarantee that none exists.

Methodology

Every figure is a direct join between two public, read-only Postgres tables: state_exclusions (the State Exclusion Ring — ten state Medicaid programs) and oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 active records). The join key is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match.

A record is treated as in force when its reinstatement date is null or still in the future relative to the publish date — the same test the production exclusion lookup applies, and applied identically to both tables. The matchable denominator is the set of distinct, in-force, NPI-identified providers per state; records with no NPI are excluded from it and reported separately. The federally-invisible count is the subset of those NPIs with no row in oig_leie_exclusions. The exact SQL is in the reproducibility block below and the provenance methodology documents the source-provenance contract. Methodology version: exclusion-gap/v1.

Limitations

• Ten states, not fifty. Coverage is New York, Ohio, Georgia, Pennsylvania, North Carolina, Maryland, Washington, Iowa, Mississippi, and Montana. The 64.3% figure describes the ten live states, not the nation.
• NPI is the floor, not the ceiling. 15,293 in-force state records carry no NPI and cannot be matched to the federal list by identifier; they are reported separately, never guessed at by name.
• Snapshot, not cumulative. Both lists are point-in-time. State files and the federal release shift over time; these figures reflect the current ingested snapshots.
• Some states are small samples. Georgia and Montana carry only 35 and 41 NPI-identified records, so their per-state shares are illustrative, not stable; the newer mid-size states rest on smaller denominators than the three anchor states.
• A compliance signal, aggregate-only. Exclusion counts are an enforcement and screening signal, never a measure of care quality. No individual excluded party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — the federal exclusion list and the comparison anchor.
• OIG — effect of an exclusion (screening duty, civil monetary penalties) — the obligation to screen all applicable lists.
• New York OMIG — Medicaid exclusions — the New York state source.
• Ohio Department of Medicaid — provider exclusion and suspension list — the Ohio state source.
• Georgia DCH — Office of Inspector General — the Georgia state source.
• Pennsylvania DHS — sanctioned providers — the Pennsylvania state source.
• Fonteum — state Medicaid exclusion data, all ingested states — the consolidated state exclusion layer across all ten states.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the permissive §1128(b)(4) license-action authority.