Call Us Today! 877-659-2467

OIG Exclusion List vs. CMS Preclusion List: What Medical Practices Need to Know

Medical practices must understand the differences between the OIG Exclusion List and the CMS Preclusion List. Both programs help protect federal healthcare programs from fraud, abuse, and improper payments. However, each program serves a different purpose and carries different consequences.

Understanding the OIG Exclusion List

The Department of Health and Human Services (HHS) Office of Inspector General (OIG) maintains the List of Excluded Individuals/Entities (LEIE).

The OIG uses this list to identify individuals and organizations excluded from participating in federal healthcare programs. These programs include Medicare, Medicaid, and other federally funded healthcare programs.

The list may include physicians, nurses, administrative employees, contractors, vendors, and healthcare organizations.

The OIG may exclude individuals or organizations for several reasons, including:

  • Healthcare fraud and certain criminal convictions.
  • Patient abuse or neglect.
  • Certain professional licensing violations.
  • Other violations that qualify for exclusion under federal law.

Federal healthcare programs generally cannot pay for services or items furnished by excluded individuals or entities.

Medical practices can search the OIG database to verify exclusion status. Practices should screen employees, providers, and relevant contractors before engagement and monthly thereafter.

Monthly screening helps practices identify exclusions and reduce financial and regulatory risks.

Understanding the CMS Preclusion List

The Centers for Medicare & Medicaid Services (CMS) maintains the CMS Preclusion List.

CMS uses this list to identify providers and prescribers who meet specific Medicare preclusion criteria.

The list primarily affects Medicare Advantage (Part C) and Medicare Part D prescription drug coverage.

CMS may place providers or prescribers on the list for several reasons, including:

  • Revocation of Medicare enrollment under qualifying circumstances.
  • Certain felony convictions.
  • Conduct that meets CMS preclusion criteria.

Medicare Advantage plans generally cannot pay for healthcare items or services furnished by providers on the Preclusion List. Medicare Part D plans must also reject covered prescriptions from precluded prescribers, subject to applicable requirements.

Unlike the OIG database, CMS does not provide a publicly searchable Preclusion List.

Instead, CMS distributes the list to applicable Medicare Advantage and Part D organizations. These organizations must review the list and apply the required payment restrictions.

Why Medical Practices Must Understand Both Lists

The OIG Exclusion List affects participation and payments across multiple federal healthcare programs. The CMS Preclusion List focuses primarily on Medicare Advantage payments and Medicare Part D prescriptions.

An individual may appear on one list without appearing on the other.

Medical practices should establish screening procedures that address applicable federal and state requirements.

Regular screening helps practices identify potential compliance concerns before they create costly problems.

Protecting your practice requires more than checking employee credentials.

It also requires verifying eligibility to participate in federal healthcare programs.

By understanding both lists, medical practices can strengthen compliance efforts, reduce financial risks, and protect their organizations.

Does your organization have a process in place to manage your documentation?

Aris Medical Solutions can help you identify compliance gaps and prepare for upcoming changes.

Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.

Your Trusted Partner for HIPAA Compliance since 2009

Office for Civil Rights (OCR) Self Reporting – Should you do it?

 

By Aris Medical Solutions

 

If you have a minor breach (under 500 records) you are required to self report this breach within 60 days after the end of the calendar year in which the disclosure occurred. If you report it, you run the risk of being investigated. So many times I hear organizations say… why would I “report” myself, that would be insane! If you do not report it and it is discovered at a later date, the fines will be increased and they will investigate heavily to determine if you have concealed any other breaches. So, the answer is YES; you should self report.

Understand that the different agencies like the Office for Civil RIghts (OCR) who enforces HIPAA, Federal Trade Commission (FTC), Department of Justice (DOJ), and Centers for Medicare and Medicaid (CMS) more than likely communicate with each other. If you are audited or investigated by one agency, they are looking at your organization as a whole and may report their findings to other agencies. In one scenario that we recently were made aware of the organization was expecting an investigation from the Office for Civil Rights and the Department of Justice showed up! These agencies can decide how and what to investigate based on the information they have received.

The best way to protect your organization is to make sure you have a complete and thorough risk analysis. This will uncover potential vulnerabilities and give you the opportunity to mitigate them BEFORE something happens. Next, make sure you have a risk management plan that dates/documents what you have implemented/corrected based on your risk analysis. Policies, procedures, and documentation are the foundation of all organizations. Your employees need clear and concise procedures so they understand what they need to do. This always insulates you from misunderstanding. Above all, it demonstrates your compliance efforts!

For more information on how Aris Medical Solutions can help your organization with HIPAA Compliance and Protecting your Data call 877.659.2467 or click here to contact us.

“Protecting Organizations through Partnership, Education, and Support”

©2026 Aris Medical Solutions – HIPAA Risk Management | HIPAA Compliance Consultants | All Rights Reserved | Terms and Conditions | Privacy Policy
The content and images on this website is owned by Aris Medical Solutions and their owners. Do not copy any content or images without our consent.
Powered by Bandwise LLC