Most organizations that screen against exclusion lists do the screening. Fewer can show it. When a state Medicaid program, a payer or an auditor asks for proof, "we check every month" is a claim. A dated record of what was checked, against which list, and what was decided is evidence.
This guide covers what that record should hold.
Why the record matters
CMS asked states, in State Medicaid Director Letter #09-001, to require Medicaid providers to screen their employees and contractors and to search the OIG list monthly, to capture new entries and reinstatements since the last search. Many state provider agreements now carry that obligation, and some add the state's own Medicaid list. Our state requirement guides set out what each state asks for, with its sources.
An obligation that recurs monthly is checked the same way: someone asks to see the months. If a month has no record, there is nothing to show that it happened.
What one screening run should record
For each run, keep:
- The date of the run. The day the check happened, not the day someone filed it.
- Who and what was screened. The list of people and businesses checked that month, as it stood on that date. A roster that changes later should not change what the record says was checked.
- Which lists were searched. For example the OIG LEIE, SAM.gov exclusions and your state's Medicaid list. Name each one.
- Which version of each list. The LEIE changes every month. Record the file or update you searched, or at least the date it was published or retrieved, so the result can be tied to the list as it was. A check today against last quarter's file is not a check against today's list.
- The result for every record. Not only the possible matches: a record of "no match" for everyone else is what shows the whole list was covered.
- Who ran it. A name or role, so questions have somewhere to go.
How to record a potential match
A name that resembles a list entry is a potential match — verification required. It is not a finding, and the record should not read as one. For each one, keep:
- The list entry it resembled, with the list and its version.
- How identity was checked. For the LEIE, the OIG's online search confirms a result against a Social Security number or Employer Identification Number; keep the confirmation page or a note of the outcome. For SAM.gov, note which details you compared.
- The decision: confirmed as a different person, or confirmed as the same person.
- Who decided, and when.
- What happened next, if it was the same person. That step is a question for your counsel, and the record should show it was raised.
Our guide on what to do when you find a potential match covers the review itself step by step.
The gaps reviewers find most often
- Missing months. Screening happened, but a month has no record, often around staff changes or holidays.
- No list version. A result with no date for the list behind it cannot show which list it was checked against.
- Matches with no outcome. A potential match that was looked at but never closed reads as an open issue.
- Contractors and vendors left out. The roster covers staff but not the companies and individuals you contract with. Our guide to screening contractors and vendors covers who to include.
- Screenshots without context. An image of a search result with no date, list or name attached proves little.
How long to keep it
There is no single retention rule for screening records across every program. Follow your state provider agreement, your payer contracts and your organization's record retention policy, and ask counsel where they differ. The OIG's General Compliance Program Guidance treats documentation as part of an effective compliance program.
Doing it without a spreadsheet
A spreadsheet and a folder of screenshots can work for a small list. As the list grows, the hard part is keeping every month complete and every match closed. Exclia records each monthly run with the list versions it used, every potential match with its evidence, and every review decision with who made it, and produces a monthly PDF report. To try the check on one name first, use the free checker.