OIG Exclusion Guidance: What to Do After You Find a Match

a stethoscope and gavel

Your exclusion monitoring has revealed a matched OIG exclusion within your organization’s employed or contracted population. This can be a stressful and intimidating experience for a compliance, HR, or operations leader. Here’s what you should do next.

This post provides an overview of what to do next, what you can expect, the questions and analysis to conduct, and what is involved in self-disclosure to the HHS OIG.

What to Do After You Identify an Exclusion

With more than 200,000 active healthcare exclusions, it’s not unlikely that one of them may find its way into your organization.

If your exclusion list monitoring process is manual, you may need to launch an investigation to ensure your exclusion match is accurate before proceeding. Then, be ready to provide accurate, detailed reporting to the OIG. Afterward, there will be a waiting period before learning how your organization will be disciplined. Even if the infraction is deemed to be minor—for instance, the excluded person at one time defaulted on a student loan and didn’t follow through to ensure they did what was needed to be reinstated—your organization can expect monetary fines at a minimum. At maximum, it could mean a devasting blow, as the OIG has the authority to exclude an organization from ever receiving federal Medicare or Medicaid funds again.

Whether an organization (or their vendor) finds the exclusion themselves or the OIG does, the onus will always be on the employer to comply and act swiftly.

First, you’ll need to ensure the exclusion match is real. If you don’t already have full verification and documentation from your vendor, you need to contact the agency or body that published the exclusion source and collect documentation. The next step will be to submit the appropriate documentation to the OIG.

Conduct an Internal Investigation

After you have confirmed the matched exclusion is legitimate, you should follow this roadmap as you conduct an internal investigation:

  1. Notify internal stakeholders including your legal team.
  2. Upon confirmation of the excluded person, suspend the individual immediately, pending further investigation.
  3. Research their hire date, salary and wages information, hours worked, etc. during the time the individual was excluded.
  4. Gather information surrounding the applicable Medicare and Medicaid billing percentages for the location where the employee worked.
  5. Work with in-house counsel to determine if outside counsel is required to assist with any possible self-disclosure.
  6. Review Self-Disclosure Protocols for the OIG and possibly the State Medicaid agency.
  7. Before disclosing on the OIG Self-Disclosure Portal, you should screen all current employees and contractors against the LEIE, to ensure no one else was missed.
  8. Analyze how to improve the current exclusion monitoring process to ensure you don’t miss another exclusion.

Working with the OIG After an Exclusion Match

The OIG Self-Disclosure Protocol

Start by understanding what the OIG will want to know. The OIG Self Disclosure Portal has specific guidelines for the information to be reported in disclosures involving the employment of an excluded individual, which includes:

  • Excluded individual’s identity
  • Job duties
  • Dates of employment
  • Description of background checks performed
  • Description of entity’s screening process
  • How the excluded individual was discovered
  • What corrective action was taken

How to Handle an OIG Investigation

When the OIG initiates an investigation, they will issue a Pre-Demand Letter. You should treat it like a subpoena and immediately issue a document hold to preserve relevant information. Simultaneously, you’ll need to take swift action with the employee and place the individual on administrative leave. This helps ensure that you are not compounding your risk.

Next, contact the OIG representative to discuss timing, then begin your internal inquiry, gathering the data requested by the OIG. Check the LEIE to confirm liability and identify the statute of limitations.

OIG Settlement Formula

Damages may be based on the Federal payer mix percentage of salary and benefits if services are not separately billed.

Single Damages = Salary x Payer Mix

Settlement = Singles Damages x Multiplier


  • OIG Initiated Investigation = 2x – 3x
  • Self-Disclosed Conduct = 1.5x

“If the OIG finds it, it’s basically triple the damages,” explains Theil. “If you find it, and if you self-disclose, the OIG will give you credit for self-disclosing and will only multiply the damages you have identified by 1.5 percent.”

Reinstatement is Not Automatic

During an investigation, an excluded person or entity may point out, correctly, that the exclusion period has long since passed. However, reinstatement does not happen automatically after the exclusion period is complete. Every excluded person or entity gets a letter 90 days before the end of their exclusion period that explains what actions the individual must take to get reinstated by the OIG.

“Just because someone is able to get a license or is able to become Medicare approved or Medicaid approved, that doesn’t mean that the OIG has reinstated them,” says Thiel. “The individual or entity must apply for reinstatement and receive written notice from OIG that reinstatement has been granted.”

When it Comes to Identifying Exclusions: The Sooner, The Better

In June 2016, a licensed professional was accused of theft. The provider investigated, then reported to the Licensing Board of Nursing. The Board took an entire year to complete their investigation, and then issued an administrative action against that person. The person had a month to defend themselves but chose not to so the board revoked their license.

Since the OIG didn’t have all the information they needed to immediately make a decision, six months passed before they ultimately made a decision to exclude that person. The System for Award Management (SAM) will almost always instantly exclude them as well.

Fast forward five months: the excluded person moved to a different state. They got a new license while their license was still in good standing and they also changed their name.

Later, the organization engaged with ProviderTrust. ProviderTrust connected the data using smarter monitoring to identify the excluded individual.

Automate your exclusion list monitoring

Stay Up-to-Date

Subscribe and get the latest news and advice from industry experts delivered straight to your inbox.

Related Resources

Never miss an update

Get the latest healthcare news, advice from industry experts, and all things related to monitoring solutions delivered straight to your inbox.