OIG LEIE Screening for Private Equity Healthcare Due Diligence

Executive Summary

The question behind an "OIG exclusion list search" in a private-equity screen is narrow: does the Office of Inspector General (OIG) of the U.S. Department of Health and Human Services currently list the matched legal entity, or a relevant person tied to it, in the List of Excluded Individuals/Entities (LEIE)? OIG describes the LEIE as its list of individuals and entities currently excluded from Medicare, Medicaid and all other Federal health care programs ^[1]. It is a current list, not a history, because reinstated parties are removed ^[2]. A hit is a research finding that decides whether a screen pauses and goes to counsel or compliance. It is not an investment conclusion or a legal clearance.

The central operating rule comes from OIG: it is not sufficient to find a matching first and last name on the LEIE ^[3]. The downloadable file omits Social Security numbers (SSNs) because the Privacy Act prohibits their distribution ^[3], so a name hit in a spreadsheet is only a candidate until identity is verified in OIG's online tool. The database holds only the name known to OIG when the exclusion was entered ^[3], so former names, hyphenated surnames and entity prefixes all need to be searched before a result is classified.

A clean LEIE result supports only a narrow negative statement. The list contains only exclusion actions taken by OIG ^[2]. Some states keep their own exclusion lists ^[4], and the federal System for Award Management (SAM) holds debarment actions from various agencies alongside OIG exclusion actions ^[2]. This report supplies a decision matrix for name hits versus verified identity (Table 1), a source-scope table (Table 2), and a name-to-entity verification and escalation worksheet (Table 3) built on fictional examples only.

Dates matter. The OIG download page fetched on 2026-10-20 showed a last update of 10-09-2026 ^[5], and OIG says its files include all actions taken during the prior month ^[5]. OIG's pages describe update timing slightly differently ("by the 10th" versus "by the middle of each month") ^{[3] [2]}, so a worksheet should record the snapshot date and file label instead of assuming freshness. No source fetched for this report publishes a false-positive rate for LEIE name matches, and this report does not estimate one.

Introduction and Background

Healthcare private-equity origination teams screen long lists of candidate companies before any outreach, often with only a brand name and a state registration in hand. A hit on a federal exclusion list can change how a screen is handled, but only if the hit belongs to the right party. Practice names, surnames and holding-company names can repeat across states, so a name hit alone is weak evidence. This report is written for origination analysts and research reviewers who must decide whether a possible LEIE hit should pause the screen and go to counsel or compliance.

The scope is deliberately limited. This is not a compliance program guide, not legal advice, and not a statement that any search clears a company. It covers what the LEIE contains, how OIG says to search and verify, how to classify results, where other lists differ, and what to retain for a handoff. Every example entity and person is fictional, and nothing here involves contacting a target.

The publisher, Docket, builds sourced acquisition-target research workflows for private-equity firms. Docket is an adjacent advisor to exclusion screening, not a provider of any exclusion list, and this report makes no product performance claims.

Why an exclusion hit matters to a deal screen

OIG's Special Advisory Bulletin (May 2013) says a provider owned in part (5 percent or more) by an excluded person is potentially subject to exclusion, and that an excluded person may own a provider, but may not provide any items or services that are payable by Federal health care programs ^[6]. The bulletin also states that providers are not required by statute or regulation to check the LEIE, while recommending that screening employees and contractors each month best minimizes potential overpayment and civil monetary penalty (CMP) liability ^[6]. For a buyer, screening is therefore a risk-management practice with an OIG-recommended cadence. Counsel decides what a specific transaction requires.

What the LEIE Is, and What It Covers

Definition and scope

The Medicaid and CHIP Payment and Access Commission (MACPAC) describes the LEIE in its June 2026 report as a database of individuals and entities excluded from participating in federal health care programs ^[1]. Two scope boundaries matter for a screen. First, as noted above, the list contains only exclusion actions taken by OIG. Second, OIG's FAQ states that Federal health care program exclusions do not reach other Federal programs, although HHS or another Federal agency could separately initiate a suspension or debarment of an excluded person from other Federal procurement or non-procurement programs ^[2].

A 2022 KFF Health News report on the exclusion system adds a practical caution: because exclusion applies to federal programs, a person could work in health care by accepting only patients who pay cash ^[7]. This report uses that article only as a description of system limits, not as evidence about any company or person. An exclusion record and a person's activity in the market are different things.

Mandatory and permissive grounds

OIG's authorities page separates mandatory exclusions, which OIG is required by law to impose, from permissive exclusions, where OIG has discretion on a number of grounds, and its table includes authority over entities controlled by an excluded individual. For an analyst, the useful point is the shape of the data: one record can concern an individual and another an entity, and a record's relationship to a target may run through ownership or control rather than the target's own name.

Current exclusions, reinstatement and waivers

Reinstated individuals and entities are removed from the LEIE ^[2]. Reinstatement is not automatic, and an excluded party may begin the process 90 days before the end of the period specified ^[2]. A past exclusion that has ended and been followed by reinstatement will not appear in the current list, so an absence today says nothing about whether a record existed last year, and a screen that needs history cannot get it from the LEIE alone. Timing runs the other way too: KFF reports that exclusion letters can go out months after convictions or settlements ^[7], so a very recent event may not yet be listed. A worksheet records waiver or reinstatement status as reported and leaves interpretation to counsel.

Who is expected to check, and how often

On the state side, the federal Medicaid regulation requires the agency to consult databases to confirm identity upon enrollment and reenrollment ^[8], to confirm identity and determine the exclusion status of providers and certain associated persons ^[8], and to check the LEIE and the Excluded Parties List System (EPLS, now part of SAM) no less frequently than monthly ^[8]. A 2008 CMS letter likewise tells states to search the OIG website monthly to capture exclusions and reinstatements ^[9], and CMS's current Medicaid Provider Enrollment Compendium restates the check as "the LEIE and SAM" ^[10]. KFF describes the structure in plain terms: federal overseers largely count on employers to check their hires and identify those excluded ^[7], and quotes OIG as saying its exclusions rest largely on referrals from federal and state agencies and state licensing boards ^[7].

Resolve the Legal Entity Before You Search

A lookup is only as good as the identity feeding it. The sources below are public and official, and none is a LEIE source; they determine which names, numbers and jurisdictions go into the worksheet before any query is run.

Legal name, former names and registry status

State business registries are the usual anchor for a legal name. Delaware's Division of Corporations says its free search provides limited information and that additional information can be obtained for a fee ^[11], and that a listing is not an indication of the current status of an entity ^[11]. California's business search says the status of a foreign business entity in California is applicable only to its California registration ^[12], so the home-state record must be checked separately. California also publishes a status for an entity that merged out of existence in California into another business entity ^[12]. For public companies, the Securities and Exchange Commission (SEC) notes that a given Central Index Key (CIK) may be associated with multiple names in the case of company name changes ^[13].

This matters because of how the LEIE handles names. As noted, the database keeps only the name known to OIG at the time of exclusion. KFF's summary of OIG's website says the same limit another way: the list does not include altered names and encourages those checking it to vet other forms of identification ^[7]. For an entity, the equivalent is that a target's current legal name, former legal names, assumed names (doing business as, or DBA) and prior owners' names each belong in the search plan.

EIN, NPI, UEI and LEI: what each identifies

An EIN is a federal tax ID number for businesses, tax-exempt organizations and other entities ^[14]. The Internal Revenue Service (IRS) says a business entity should have only one EIN ^[14] and that an applicant should enter the business name as it appears on its registration or formation documents ^[14]. Structure changes can change the number: an entity needs a new EIN, in general, when its ownership or structure changes ^[14], and a merger that creates a new corporation requires one ^[15]. An employer that took over another employer's business uses its own EIN ^[14], while the surviving corporation after a merger keeps its own ^[15]. One practical point follows: the EIN OIG holds for an excluded entity may be a predecessor's, so a mismatch is evidence to log, not proof of a different entity.

The National Provider Identifier (NPI) is a different identifier. CMS describes it as a 10-position, intelligence-free numeric identifier ^[16] that does not carry other information about healthcare providers ^[16]. Type 1 NPIs are for individual health care providers ^[17] and Type 2 for health care organizations ^[17]. A CMS fact sheet states that a subpart that conducts HIPAA standard transactions separately from its parent must have its own NPI ^[18], so one organization can appear under several NPIs.

Two more identifiers help with cross-referencing but are not LEIE fields. The Unique Entity ID (UEI) replaced the DUNS number in SAM.gov: GSA announced that SAM.gov and other GSA systems would no longer use the DUNS number for identifying entities ^[19]. The Legal Entity Identifier (LEI) is a unique 20-character alphanumeric code ^[20], and a child entity's record can publish the LEI of its parent ^[21].

Related people: owners, officers and managing employees

The Medicare enrollment application (CMS-855A) asks institutional providers to report organizations with 5 percent or more direct or indirect ownership ^[22] and states that all managing employees of the provider must be reported ^[22]. It also explains that in a consolidation the taxpayer and Medicare identification numbers of the consolidating entities are dissolved and new ones assigned ^[22]. CMS's database-check toolkit says the identifying data states collect on individuals include name, address, date of birth and SSN ^[23]. Medicare's regulation requires a change of ownership or control to be reported within 30 days ^[24]. CMS guidance to state Medicaid agencies adds that states must actively solicit information regarding individuals with ownership or control interests ^[9]. A private-equity screen usually has no enrollment file, so the lesson is to keep a list of relevant people with their own name variants, because the LEIE records individuals and entities separately.

Run the Search: Online Tool Versus CSV Download

OIG offers two search methods, and they are not interchangeable. The online tool searches up to five individuals or entities at a time ^[3] and lets a user verify an identity by entering a SSN or EIN. The downloadable database is a CSV of active OIG exclusions. A CSV is fast for many names but cannot confirm identity on its own, because OIG does not distribute SSNs in the download ^[3]; the online tool is slower but is where identity gets confirmed.

Individuals versus entities

OIG tells users to enter only the first few letters of the first and last names, or the first part of the entity name. For entities the tool matches the start of the name: searching for "dental" might return an entity named "DENTAL CARE UNLIMITED" but would not return one named "UNITED DENTAL CARE" ^[3]. A target whose name begins with a common word therefore needs several search variants, and a worksheet logs each.

Punctuation is part of the match. If a name contains punctuation, the search text must include it ^[3], and only apostrophes, hyphens, ampersands and commas are allowed in the search fields. Hyphenated individual names should be checked under each of the last names in the hyphenated name.

The CSV file, supplements and snapshot labels

The full CSV file is replaced every month with the most current version of the complete database ^[5]. Users pick either the latest full file or the monthly supplements, which cover a single month only, and OIG recommends the full file for accuracy. The file date lags the action date, as noted above, so a worksheet entry made in late October 2026 would record the 09-2026 file label and the date the file was downloaded. OIG has no public application programming interface (API) for the LEIE, so an automated screen works from the CSV and the online tool.

Identity verification in the online tool

After a name hit, the Verify step is where an SSN or EIN is entered. A CMS letter to state Medicaid directors describes the same two-step design: the searcher can verify the accuracy of a match using an SSN or EIN in the online search ^[9]. Incorrect entries are limited: after three failed attempts the user is asked to prove they are not a robot by completing a captcha ^[3]. Identifier guessing is not a workable method, and a worksheet treats the identifier as something a screener must already hold from an authorized source. An analyst who does not hold the EIN records "EIN not verified" and escalates the verification step; the worksheet never stores the number. Pennsylvania's Medicaid exclusion list uses an analogous step, verifying a potential match with the last four digits of an individual's SSN or a 9-digit FEIN ^[25].

When a record lacks an identifier, OIG's instruction is blunt: if a search result does not contain a DOB, UPIN, NPI, EIN or SSN, it is not available from OIG ^[3], and users are directed to its Exclusions Branch. A hit with no identifier fields cannot be verified by number and falls in the "plausible, unverified" class below.

Documenting the search

OIG instructs users to maintain documentation of the initial name search and any additional searches conducted to verify potential matches ^[3]. A research file holds the saved or printed result, the search strings, the date and the file label.

Classify the Result: Name Hit Versus Verified Identity

A LEIE result is not a yes or no. Five classes keep a screen honest, and they follow from OIG's rule that a name match is not sufficient ^[3]:

• Verified match: a name hit confirmed by an identifier in OIG's online tool.
• Plausible unverified match: a name hit with agreeing context but no verified identifier.
• No current LEIE record: no hit across the logged variants in a dated snapshot.
• Stale or historical: a past exclusion reported elsewhere, with no current record.
• Unresolved: the entity map is too incomplete to interpret any result.

Table 1 below is the decision matrix. The "safe wording" column is what a reviewer can write in a screen note without overstating the evidence, and the "next action" column is a suggested internal routing, not a legal requirement.

The two rows that pause a screen depend on identity evidence, while the "no current record" row depends on search completeness. A thorough search over incomplete identity inputs produces a confident-looking negative that is worth less than it appears, which is why former names and related people come first in the worksheet.

Fictional walk-throughs (Hypothetical Example)

(Hypothetical Example, fictional entities only.) An analyst is screening "Alder Example Therapy Services, LLC", a fictional outpatient therapy practice. A prefix search on "alder" in the online entity tool returns one record with a similar business name in a different state and no EIN or NPI fields. The state registry shows a formation name one word different from the brand, and a former name from before a merger; a second search under the former name returns nothing. Under the matrix, the first record is a plausible unverified match: the name is similar, but the state differs and the record has no identifier fields, so verification by number is impossible. The analyst logs the conflict, does not guess identifiers, and routes the item to the decision owner. Nothing in the example implies that any real entity is listed.

Scope: LEIE Versus State Medicaid Lists Versus SAM

A clean LEIE search answers one question about one keeper's list. The state and federal lists around it have different keepers, coverage and identifiers.

What the other lists cover

Some states maintain their own exclusion lists, pursuant to 42 CFR section 1002.210 or state authority ^[4], and the federal regulation says the period of such exclusion is at the discretion of the State agency ^[26]. CMS says no State may waive an OIG exclusion in whole or in part ^[9]. The Social Security Act requires state plans to exclude any specified individual or entity that the Secretary requires to be excluded ^[27], and MACPAC notes that Medicaid exclusions can include exclusions from other states ^[1].

SAM is a different system. MACPAC describes the SAM list as a list of individuals and entities excluded from receiving federal contracts ^[1], and the SAM exclusions are available to the general public ^[28], though federal participants may, but are not required to, use them ^[28]. The Federal Acquisition Regulation (FAR) says agencies must enter a new SAM exclusion within 3 working days after the action becomes effective ^[29], and that inquiries about a listed party go to the agency that took the action ^[29].

Table 2 summarizes the sources a screen should keep distinct. The last column states the most a reviewer can say after a no-hit result in that source.

Identifiers differ by keeper, so a number that verifies a LEIE hit may not exist in a state record. Refresh statements are not comparable either: one site says daily, one recommends 30-day checks, and two say nothing in the pages fetched. Treat undocumented cadence as unknown and record the snapshot date for each source.

Discrepancies worth preserving

The two texts address different mechanisms for how federal lists interact. OIG states that Federal health care program exclusions do not reach other Federal programs (although HHS or another Federal agency could separately initiate a suspension or debarment of an excluded person from other Federal procurement or non-procurement programs), while the HHS supplement to the federal nonprocurement rules states that an individual or entity excluded by the HHS OIG is prohibited from participating in all Federal Government procurement and nonprocurement programs ^[36]. This report does not reconcile the two statements; the difference is a question for counsel, and a worksheet records both as written. Update timing also differs between OIG's quick-tips page and its FAQ, as noted above.

CMS's compendium says state Medicaid agencies shall deny the enrollment of newly enrolling providers if a provider or an associated person appears on the relevant lists ^[10], and it recommends, without requiring, that providers check their own employees ^[10]. A CMS toolkit says virtually all states have procedures for checking the LEIE or the Medicare Exclusion Database ^[23] and that the EPLS was merged with SAM in June 2012 ^[23]. For an acquirer, Medicaid enrollment practice is a reason to look at the state list, not a substitute for the federal one.

Data Analysis and Evidence

The quantitative material on this topic is mostly procedural: counts of names, days, attempts and digits that bound what a screen can say. The figures come from the keepers' own pages. No source fetched for this report publishes a rate of false-positive name matches against the LEIE, and none is estimated here.

• 5 names per online search. A 40-entity screen needs at least eight online batches, or the CSV (the five-name limit is cited above), and three failed identifier attempts trigger a captcha.
• 5 percent ownership. The CMS-855A uses a 5 percent threshold for organizational owner reporting ^[22], the same level at which OIG's bulletin notes potential exclusion exposure.
• 30 days. Medicare providers report a change of ownership or control within 30 days ^[24].
• Inflation-adjusted CMPs. The 2013 bulletin states that OIG may impose CMPs of up to $10,000 for each item or service ^[6]. That is the 2013 figure and is no longer a current maximum: HHS states that its civil monetary penalty amounts are adjusted annually, so counsel should confirm the current amount in 45 CFR 102.3 ^[37].
• More than 14,000. KFF relayed OIG's own report that it excluded more than 14,000 individuals and entities since January 2017 ^[7]. This was current as of the December 2022 report; no later count was fetched.

The smallest numbers are the most decision-relevant. Five names per search and three attempts per identifier shape workflow design, pushing a team toward the CSV for discovery and the online tool for confirmation. The 14,000 figure counts actions over a period and says nothing about the probability that a given target is listed, so readers should not convert it into a prior.

Several central documents (the 2013 OIG bulletin, the 2008 and 2009 CMS letters, the 2014 CMS toolkit) predate the live data, so treat them as context and re-read the live pages before relying on a detail.

Handoff, Documentation and Refresh

The name-to-entity verification and escalation worksheet

The sequence below shows where the worksheet sits in a screen, and Table 3 is the reference worksheet itself.

1. Resolve the entity: legal name, former names, DBAs, entity type and jurisdiction.
2. List related people: owners, officers and managing employees, with name variants.
3. Plan variants: prefixes, punctuation, hyphenated and former names.
4. Search a dated snapshot: online tool or monthly CSV, with the file label recorded.
5. Classify each result using the decision matrix.
6. Attempt identifier verification only through an authorized person and OIG's online tool.
7. Check other lists: state Medicaid lists and SAM, each with its own date.
8. Record the decision and unresolved conflicts, then route to counsel or compliance when triggered.

Here is the worksheet. Each row is a field, with a purpose and a fictional example for "Alder Example Therapy Services, LLC" (fictional). Identity fields come first because a name match alone is not sufficient. The worksheet never stores an EIN or SSN; it stores a verification status and who verified it.

The worksheet's identity fields line up with the identity step of a screen, and its source fields with a second person checking that each statement matches a retained source. The worksheet works with any tooling, including a spreadsheet.

When to escalate

A reasonable rule has three triggers:

• A verified match.
• A plausible unverified match that cannot be resolved with the identifiers on hand.
• An unresolved identity conflict touching a person with ownership or control.

An unverified name hit is a question and not an answer, and a missing owner is also a question, because states must actively solicit ownership and control information from providers ^[9]. Escalation goes to counsel or compliance with the printed results, search strings, snapshot label and entity map. This report gives no legal advice, and what counsel does next is outside its scope.

What to retain

• Source URL and page title for each list searched, including the OIG online tool and the file page.
• Saved or printed result of each search.
• Search strings exactly as typed, including punctuation.
• Snapshot date and file label, because files lag the action date by a month.
• Reviewer name and decision, with the class from the matrix.
• Unresolved conflicts, kept even if later resolved, so the reasoning is auditable.

Refresh policy

Because the LEIE is replaced monthly, a screen from last quarter is three files old. OIG's monthly-screening recommendation, cited above, concerns employees and contractors, and the Medicaid regulation requires the state agency to check the LEIE no less frequently than monthly ^[8]. Those cadences serve different parties, but they suggest a benchmark: refresh before outreach and before any material decision, and record the new snapshot date. A refresh is never a reason to contact a target.

Implications and Future Directions

For private-equity screening practice

Three implications follow. Identity work moves ahead of the lookup, because nothing in OIG's tool resolves a brand to a legal entity. A LEIE result is a dated snapshot of one keeper's list, so every statement about it carries a date and a scope. And a hit is a routing event, not an endpoint.

In the M&A context, Department of Justice (DOJ) materials stress diligence in general terms. In 2023 a Deputy Attorney General said the Department was placing an enhanced premium on timely compliance-related due diligence and integration ^[38], and the Criminal Division's compliance program guidance says a well-designed program should include comprehensive due diligence of any acquisition target ^[39]. None of these documents sets an exclusion-screening standard for a pre-offer screen, and this report does not claim they do. They show that acquisition diligence is a recognized compliance theme, which is the context for a documented exclusion check.

For automation and data design

With no public API, any automated LEIE comparison depends on a monthly CSV and on name logic, and name logic produces candidates, not conclusions. A restricted-party screening FAQ from the U.S. Treasury's Office of Foreign Assets Control, a different program used here only as an analogy, makes a similar point: many potential matches identified through screening are false positives ^[40], and the way to resolve one is to compare all of the details in the listing with the information available ^[40]. It asks whether only the first or last name matches ^[40] and notes that multiple businesses may be registered at the same address ^[40]. The design principle is to build the review step around corroborating details, not name similarity.

State lists vary in the identifiers they expose, and California's own agency recommends cross-referencing its list with the federal one ^[35], so a multi-source screen should keep a per-source identifier map.

Frequently Asked Questions (FAQs)

How can an analyst check whether a healthcare company is excluded from Medicare?

Use OIG's LEIE. Start from the legal name, former names and DBAs, search the online tool with the first part of the entity name including punctuation, and use the Verify step with the entity's EIN if a record appears. The result is a statement about one list at one date; state Medicaid lists and SAM are separate.

What is the difference between searching an entity and an individual?

Entities are matched from the start of the name, so word order matters. Individuals are searched by first and last name, with former names and each part of a hyphenated surname checked. Entities are verified with an EIN and individuals with an SSN in the online tool, and OIG does not distribute SSNs in the CSV.

How can a LEIE match be verified using NPI, SSN or EIN?

OIG's online tool verifies with an SSN or EIN. Not every record carries an NPI, and an NPI alone does not carry other information about the provider ^[16]. An NPI match is corroboration, not the identity step OIG describes.

How should a possible false-positive name match be handled?

Treat it as a plausible unverified match. Compare state, address and other details, check former names, ask an authorized person to attempt identifier verification, and document every step. If the record has no identifier fields, OIG says the information is not available from OIG.

Does a clean LEIE result clear a target?

No. It is a statement about one keeper's current list on a dated snapshot. The list covers only OIG actions, and state lists and SAM are separate sources.

Does SAM replace the LEIE?

No. State Medicaid rules call for checking both the LEIE and SAM ^[10]. A buyer's screen can use both and record each separately.

What is the excluded-provider risk in a healthcare private-equity deal?

OIG's payment prohibition reaches those who employ or contract with an excluded person, and its bulletin discusses owner and provider exposure, as described above. How that applies to a specific transaction is a legal question for counsel, and this report does not assess it.

Conclusion

The practical answer to OIG LEIE screening for private-equity healthcare due diligence is a discipline, not a lookup. A sound screen resolves the legal entity first, searches every logged variant, verifies identity only in OIG's online tool through an authorized person, classifies the result into one of five classes, and keeps a dated record.

A no-hit result speaks only to OIG's current list for the logged variants on the retrieval date, not to state Medicaid lists, SAM or history. A hit is narrow too until identity is verified, at which point it becomes a routing event for counsel or compliance. Neither outcome is an investment conclusion.

The matrix in Table 1 and the worksheet in Table 3 can be adapted into a research workflow; the live OIG pages should be re-read before use, because file labels, cadence statements and tool behavior can change.