The HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

What is an HHS OIG Exclusion Check?

An HHS OIG exclusion check is a check to see if an individual or organization appears on the Department of Health and Human Services (HHS) Office of Inspector General (OIG) List of Excluded Individuals and Entities. If an individual or organization appears on the List, they are prohibited from supplying goods or services to providers that participate in federal healthcare programs.

The HHS OIG Exclusion List contains the names, addresses, NPI numbers, and business details of individuals and organizations that have been excluded from participating in federal healthcare programs due to healthcare-related fraud, theft, or financial misconduct, patient abuse or neglect, any other prohibited activity, or obstructing an investigation into a prohibited activity.

Individuals and organizations are most often added to the list as the result of an enforcement action taken by HHS OIG or the Department of Justice. However, Medicare Fraud Control Units (MFCUs) also have the authority to add individuals and organizations to the Exclusion List unless the individual/organization agrees to comply with the terms of a Corporate Integrity Agreement.

Why Conduct an HHS OIG Exclusion Check?

Healthcare providers are prohibited by §1128a of the Social Security Act from purchasing goods from, or contracting the services of, any individual or organization that appears on the HHS OIG Exclusion List. The potential penalties for violating this section of the Act include:

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

  • A fine of up to $20,000 for each good or service claimed from a federal healthcare program.
  • Damages of up to three times the amount claimed from a federal healthcare program.
  • Addition to the HHS OIG Exclusion List and exclusion from federal healthcare programs.

Because of the potential losses of purchasing goods from, or engaging the services of an excluded individual or organization, healthcare providers are advised to conduct an HHS OIG exclusion check before entering into any contract with a new supplier or engaging a new member of the workforce. HHS OIG also recommends checking all suppliers and workforce members against the List at least monthly.

How to Check the HHS OIG Exclusion List

The HHS OIG Exclusion List can be checked by visiting https://exclusions.oig.hhs.gov/ and entering either the individual’s name (“Search for an Individual”) or the organization’s name (“Search for a Single Entity”). It is possible to search for up to five individuals or organizations simultaneously by clicking on the “Search for Multiple Individuals/Entities” tabs.

Alternatively, healthcare providers can download the full HHS OIG Exclusion List in CSV format by visiting https://oig.hhs.gov/exclusions/exclusions_list.asp. The database can be searched by name, address, or NPI number using the Ctrl+F function and includes the date on which the individual or entity was excluded and the motive for their exclusion (by section of the Social Security Act).

If an HHS OIG exclusion check returns a match, and a prospective supplier or employee matches an entry on the database, healthcare providers are advised to review the OIG’s Special Advisory Bulletin to see if an exemption applies. If a supplier or employee has already been contracted/engaged and no exemption applies, healthcare providers are advised to follow the Self-Disclosure Protocol.

Other Exclusion Databases to Check

In addition to the HHS OIG Exclusion List, it is also advisable to check other federal exclusion databases and state HHS exclusion databases. This is because, although a healthcare provider will not be penalized for contracting supplies or services from individuals and organizations that appear on these lists, the healthcare provider might not get paid by the federal healthcare program.

There are three federal exclusion databases to check – the Medicare Exclusion Database (MED), the System for Award Management (SAM) database, and the National Practitioner Data Bank (NPDB). All three databases are relatively easy to search, but it will be necessary for healthcare providers to create user credentials before being able to search the MED and NPDB databases.

With regards to state HHS exclusion databases, individuals and organizations could appear on one of these databases if they have violated a state regulation, but not a federal regulation. Forty-two states maintain searchable databases, while two others (Delaware and Vermont) require healthcare providers to email details of the individuals or organizations they want to cross-check.

Advice from Federal and State Agencies

All agencies hosting exclusion databases have extensive Help pages on their respective websites to help providers meet their compliance obligation. You can also contact HHS OIG directly if you have questions about conducting an HHS OIG exclusions check. Alternatively, if you require advice about which databases to check other than the HHS OIG Exclusions List, you should seek independent advice from a compliance professional.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist