The $72 Million Screening Gap: Why Medicare Provider Checks Need More Than One Database

A provider’s Medicare enrollment status can change. An organization’s ownership can raise questions about its eligibility for payment. And a screening process that was accurate when a provider joined a network may not identify a problem that emerges months later.

A September 2026 report from the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) illustrates the consequences of gaps in these checks. OIG identified $72 million in Medicare Advantage and Part D payments associated with 249 National Provider Identifiers (NPIs) linked to providers whose Medicare enrollment had been revoked but who were not included on the Centers for Medicare & Medicaid Services’ (CMS) Preclusion List during the period examined.

The review covered 1,017 NPIs associated with revoked providers. The payments occurred from 2022 through 2024. OIG identified timing issues and errors in CMS’s list-management process, gaps involving certain organizations and their owners, and a regulatory limitation affecting pharmacies that fill Part D prescriptions but do not prescribe the drugs themselves.

The report does not establish that the entire $72 million is recoverable or that every provider associated with these payments committed fraud. It identifies weaknesses in the process intended to prevent certain providers from receiving Medicare Advantage and Part D payments.

For medical groups, credentialing departments and billing organizations, the practical question is how to make provider screening reliable when enrollment status, exclusion status and payment restrictions are not the same thing.

Three Different Checks That Serve Different Purposes

Provider screening can become unreliable when organizations treat Medicare enrollment, exclusion and preclusion as interchangeable concepts. They are not. Medicare enrollment status concerns a provider’s or supplier’s enrollment in the Medicare program. CMS may revoke enrollment for specified reasons. A revocation can affect whether a provider may bill Medicare under the applicable rules, but it does not automatically mean that the provider has been excluded from every federal healthcare program.

The OIG List of Excluded Individuals/Entities (LEIE) identifies individuals and entities currently excluded by OIG from participation in federal healthcare programs. Exclusion has specific consequences for payment by federal healthcare programs for items or services furnished, ordered or prescribed by an excluded person or entity. Healthcare organizations should routinely screen relevant employees, contractors and other individuals or entities as applicable.

The CMS Preclusion List serves a different purpose. It identifies individuals and entities who meet CMS criteria for being precluded from receiving payment for specified services under Medicare Advantage (Part C) and prescription drugs under Part D. Criteria can include certain Medicare revocations, exclusions and felony convictions, subject to the applicable regulatory requirements.

The lists therefore do not have identical coverage, criteria or consequences. A search of the LEIE is an important compliance control, but it does not replace verification of Medicare enrollment status or the payment restrictions relevant to a particular Medicare Advantage or Part D arrangement.

What the $72 Million Report Actually Found

OIG examined 1,017 NPIs associated with providers whose Medicare enrollment had been revoked but who were not included on the Preclusion List during the period studied. The review identified three vulnerabilities.

1. Timing issues and errors in the preclusion process.

OIG found that delays and errors in adding or removing providers from the Preclusion List contributed to payments associated with 249 of the 1,017 NPIs. This illustrates a limitation of relying exclusively on a status check performed at one point in time: the result may not reflect a later change, and information in different systems may not be updated simultaneously.

2. Gaps involving organizations and their owners.

OIG found that CMS had not included certain organizations on the Preclusion List even when their owners had been excluded or had qualifying felony convictions. The report identified payments associated with 33 NPIs in this category.

The finding points to a weakness in how the preclusion process handled certain ownership relationships. It does not mean that every organization automatically becomes precluded whenever an owner is excluded or convicted. The applicable criteria and circumstances determine whether an organization meets CMS’s requirements for inclusion.

For credentialing teams, the practical implication is to understand which ownership disclosures and associated-person checks apply to their organization and payer relationships, and to escalate potential concerns for review.

3. Current rules leave a limitation for certain pharmacies.

OIG identified approximately $42 million in Part D payments associated with 12 NPIs in a category involving pharmacies that filled prescriptions but did not prescribe the drugs themselves.

Under the regulations examined, pharmacies that only fill Part D prescriptions are not subject to preclusion on the same basis as the prescribers and other entities covered by the relevant rules. This represents a limitation in the regulatory framework, not simply a failure by an individual credentialing employee to run a database search.

The three findings require different responses. More frequent screening may help address changes in provider status, while ownership reviews and regulatory changes address different vulnerabilities.

What Credentialing and Compliance Teams Should Review

The report does not prescribe a universal screening schedule for every practice or billing company. Appropriate controls depend on the organization’s role, applicable law, payer contracts and the programs involved. Several operational steps can nevertheless make screening more dependable.

Establish a screening matrix. Document which checks apply to each provider type and business relationship. Distinguish Medicare enrollment verification, OIG exclusion screening and any additional checks required by a Medicare Advantage organization or Part D plan. Where direct access to the Preclusion List is not available, establish how the organization will verify relevant status through the applicable plan or authorized partner. Do not treat one database as a substitute for all others.

Define when screening occurs. Initial credentialing is only one point in the provider relationship. Establish procedures for rechecking status at intervals appropriate to the applicable requirements and whenever relevant information changes, such as a reported enrollment action, ownership change or compliance concern. Where contracts or regulations specify a frequency, follow that requirement.

Verify identity carefully. Match records using available identifiers and relevant identifying information rather than relying on a name alone. Common names, changes in business structure and differences between an individual provider and a group entity can create false matches or missed matches. Potential matches should be investigated before the organization makes a final determination.

Review ownership and organizational relationships where required. The OIG findings show why screening may need to consider more than the individual whose name appears on a claim. Credentialing teams should know which ownership disclosures and associated-person checks apply to their organization and payer relationships, and should refer unresolved ownership or exclusion concerns to qualified compliance or legal professionals.

Keep an auditable record. Retain the date of each check, the source consulted, the result, the identifiers used and the resolution of any potential match. A record showing what was checked and how a discrepancy was handled is more useful than an undocumented statement that a provider was cleared.

Assign responsibility for follow-up. Specify who reviews alerts, who confirms a potential match, who determines whether claims or services must be held, and who communicates with the relevant payer or plan. Without clear ownership, a screening alert can remain unresolved even when the organization has the right information.

These controls should be integrated into the organization’s existing compliance and credentialing processes rather than treated as a separate exercise conducted only when a provider first joins the network.

What Billing Companies Need to Know

Billing companies may conduct screening on behalf of clients, but their responsibilities depend on the services they provide, their contracts and applicable requirements. They should not assume that a client’s initial credentialing decision eliminates the need to follow agreed procedures when a new concern arises.

A billing team that learns of a possible revocation, exclusion or preclusion issue should follow a documented escalation process. That may include confirming the identity and status involved, notifying the designated compliance contact, reviewing the relevant payer requirements and determining whether affected claims require further review.

The response should be proportionate to the evidence. A possible database match is not, on its own, proof of misconduct. Equally, a claim should not continue through the ordinary workflow simply because the provider was previously approved.

Organizations should also avoid assuming that every provider who is not on the Preclusion List is eligible for every type of Medicare payment. The list addresses specific payment restrictions under Parts C and D; other enrollment, exclusion and payer-specific requirements may still apply.

A Screening Process Needs to Be More Than a Snapshot

The OIG report highlights a gap between a provider’s status in one system and the information used to determine whether payments should be made under another. That gap cannot be addressed by a single database search alone.

For credentialing teams, the lesson is to distinguish enrollment, exclusion and preclusion, document the checks applicable to each relationship, and establish a clear process for reviewing changes and potential matches. For billing organizations, the priority is knowing when a status concern affects claim handling and who must resolve it.

The report also identifies limitations that individual practices cannot solve through internal procedures alone. CMS’s list-management process and the regulatory treatment of certain pharmacies require action at the program level. Organizations should strengthen the controls within their reach without assuming that every vulnerability described in the report can be eliminated by more frequent screening.

Editorial Note: This article is for general educational purposes and does not constitute legal advice. Screening obligations and payment restrictions vary by provider type, program and contractual arrangement. Organizations should consult current CMS and OIG guidance and qualified compliance or legal counsel when evaluating specific cases.

Takeaway: Provider screening is not one check against one list. Reliable compliance depends on verifying the right status for the relevant program, reviewing changes over time, documenting the results and escalating potential matches before they become unresolved payment risks.

Sources