OIG and SAM Monthly Screening Explained: What's Required and Why Daily Beats Annual

Federal compliance rules require healthcare organizations that bill Medicare, Medicaid, or any federal program to screen everyone on their roster — providers, billers, schedulers, contractors, anyone with access — against two government exclusion lists: the OIG List of Excluded Individuals/Entities (LEIE) and the System for Award Management (SAM.gov) debarment list. The OIG's published guidance recommends screening at least monthly; an excluded individual on payroll exposes the organization to civil monetary penalties of up to $23,607 per item or service furnished, treble damages, and exclusion of the practice itself.

The "monthly" floor is the floor, not the ceiling. The LEIE is updated monthly and SAM.gov is updated continuously, so a practice that screens annually can keep an excluded person on the roster for up to 365 days. A practice that screens monthly compresses that detection window to ≤30 days. A practice that screens daily compresses it to under 24 hours.

This guide explains what OIG and SAM screening actually checks, what counts as a match, who has to be on the screened roster, and what to do when the match list comes back non-empty.

Quick facts: OIG and SAM exclusion screening

Fact	Detail
OIG LEIE update cadence	Monthly (full file)
SAM.gov update cadence	Continuous (API-accessible)
OIG-recommended minimum screening	Monthly
Maximum detection window — annual screening	Up to 365 days
Maximum detection window — monthly screening	Up to ~30 days
Maximum detection window — daily automated screening	Under 24 hours
CMP per item/service furnished by an excluded person	Up to $23,607 (2024 inflation-adjusted), plus treble damages
Roster scope	All providers, employees, contractors, vendors with access to federal program funds

What each list covers

The OIG LEIE and SAM.gov are different instruments, and neither one substitutes for the other.

• OIG LEIE is the healthcare-specific exclusion list maintained by the HHS Office of Inspector General. It covers individuals and entities excluded from Medicare, Medicaid, and all federal healthcare programs. Exclusion under §1128 of the Social Security Act follows criminal convictions (program-related fraud, patient abuse, controlled-substance violations), license actions, or program integrity findings.
• SAM.gov is the broader federal procurement-and-debarment registry maintained by GSA. It includes the OIG entries plus exclusions from Treasury, DoD, GSA, and dozens of other agencies. For a healthcare org, SAM.gov catches exclusions that LEIE misses (e.g., debarments from non-HHS agencies that nonetheless restrict federal billing).

A compliant program checks both.

What counts as a match

A screening engine returns three signal levels:

Score	Meaning	Action
100	NPI exact match	Block immediately, route to compliance for verification
85	Name + state match (no NPI)	Compliance review, likely a name collision but verify identity
1–84	Fuzzy match (name similarity)	Reviewer decides; resolve as match or false-positive and persist the decision
0	No match	Clear

False positives — name collisions on common names — are the operational reality. A robust system persists the false-positive resolution: once a name collision is reviewed and cleared, it does not surface again next month unless the underlying record changes. That single design choice cuts review burden by ~80% over a 12-month window.

Who has to be on the screened roster

The roster is broader than most practices realize:

• All licensed providers (MD, DO, NP, PA, RN, PT, OT, etc.)
• All employees who have any role in patient care, billing, or coding
• All contractors and locum providers
• All vendors who bill the practice's federal-program revenue (e.g., outside coding companies, anesthesia groups, radiology overreads)
• All ownership and management interests

The OIG's Special Advisory Bulletin on Effect of Exclusion makes clear that anyone whose work is paid for, in whole or in part, by federal healthcare funds must be screened — not just rendering providers.

What to do when a match returns

The compliance workflow is short:

1. Verify identity. Compare the LEIE/SAM record (name, DOB, state, NPI, exclusion type, exclusion date) against the practice's HR record. Most matches at the 1–84 band are name collisions.
2. Document the decision. Whether confirmed match or false positive, the resolution and the supporting evidence go into a persisted record with a reviewer name and timestamp.
3. For a confirmed match: suspend the individual from any role that touches federal-program revenue, hold any pending claims associated with their work, self-disclose to the OIG under the Self-Disclosure Protocol if items or services were already furnished, and refund any payments received.
4. For a false positive: mark the resolution so the same name does not re-surface next cycle.

Why daily automated screening is the practical floor

Manual monthly screening on a 100-person roster is a 15–25-staff-hour exercise. That cost, plus the ~365-day detection window of annual screening and the ~30-day window of monthly screening, makes the case for automation straightforward. A daily automated job that pulls the LEIE file and queries the SAM.gov API, runs a fuzzy match, persists false-positive resolutions, and routes only the unresolved matches to compliance reduces detection latency to under 24 hours and reclaims most of the manual time.

For broader compliance context, see the OIG compliance guide and the audit survival guide.