How OIG LEIE, SAM.gov, and state Medicaid exclusion lists actually differ

If your organization bills Medicare or Medicaid, federal law requires you to screen every employee, contractor, and vendor for healthcare program exclusions before hire, and again every month after that, for as long as that person or vendor is on staff. Employing someone who’s excluded while billing a federal healthcare program carries real penalties — $10,000–$20,000 per item or service billed, on top of repayment obligations and potential False Claims Act exposure.

The problem is that “screen for exclusions” isn’t one check. It’s several, run against sources that are built, published, and updated completely independently of each other. Here’s what each one actually is.

OIG’s List of Excluded Individuals/Entities (LEIE)

The LEIE is maintained by the HHS Office of Inspector General and is the source most people mean when they say “the exclusion list.” It’s a real, public-domain government publication — a downloadable CSV, refreshed monthly, with no API and no key required. As of this writing it’s roughly 15.5MB, listing individuals and entities OIG has excluded from participation in federal healthcare programs, along with the exclusion type and date.

The LEIE only reflects OIG’s own exclusion actions. It does not automatically include every exclusion issued by a state Medicaid program or every party barred from federal contracting more broadly — those are separate systems maintained by separate agencies, which is exactly why OIG’s own compliance guidance has long recommended checking it alongside other sources, not as a stand-alone check.

SAM.gov Exclusions

The System for Award Management (SAM.gov), run by the General Services Administration, maintains a separate federal exclusions record covering parties barred from doing business with the federal government more broadly — a different legal basis and a different maintaining agency than OIG’s healthcare-specific list. SAM.gov’s exclusions API requires a free developer API key, and its own published non-federal rate limit is real and tight: 10 requests per day, total, across all of a given customer’s traffic — tight enough that any production use has to batch or cache rather than call it per-lookup in real time.

State Medicaid exclusion lists

Beyond the two federal sources, roughly 40+ individual states maintain their own Medicaid exclusion lists, and each one publishes it independently — different formats, different update cadences, different level of machine-readability. Two examples on the more accessible end: California’s Medi-Cal Suspended & Ineligible Provider List is published as a plain, dated CSV via the state’s open-data portal, refreshed monthly; New York’s OMIG exclusions list is a plain HTML table with no key required. Other states are harder — Texas HHSC’s exclusion list, for instance, is real and current, but it’s served through a stateful web application whose download control isn’t a plain fetchable URL, meaning there’s no clean, durable way to pull it programmatically without effectively automating a web form rather than calling a data source.

None of these state lists are required to sync with, or even reference, the federal LEIE or SAM.gov exclusions — a person or entity can be excluded at the state level without yet appearing federally, or vice versa, since each list moves on its own agency’s own timeline.

Why “checking one” leaves a real gap

Put together, this means a compliance program that checks only the LEIE — which is the most commonly used, and the one most vendors default to — is structurally blind to any exclusion that originates at the state level or through SAM.gov’s broader federal-contracting scope but hasn’t (yet, or ever will) show up in OIG’s own list. The three sources are not redundant copies of each other; they’re three separate systems, run by three separate bodies, with different scope and different update timing. A real compliance check has to account for all three, and be honest about which ones it actually reached on a given call versus which are still gaps.

That’s the actual design problem behind Aervik Labs’ Healthcare Exclusion & Sanction Screening API: one call checks OIG LEIE, SAM.gov Exclusions, and California and New York’s state Medicaid exclusion lists today, with an honest, per-source coverage manifest on every response so you can tell exactly what was checked live versus what still needs a separate look — rather than a single “cleared” result that quietly hides which sources it never touched.