Excluded by a state, invisible to a federal check

The OIG List of Excluded Individuals and Entities — the LEIE — is the list most compliance tools treat as the master federal registry of providers barred from Medicare, Medicaid, and other federal health programs. The SAM.gov debarment registry is the second federal list a thorough screen adds. But neither is the only list that bars a provider. Every state Medicaid agency runs its own exclusion program, on its own authority and its own clock. When a provider sits on a state list but not the federal ones, the disagreement is the story: that provider is invisible to anyone who screens federally and stops there.

This study measures the size of that blind spot from the state side. It joins the state Medicaid exclusion records Fonteum holds — 13 states — against both federal lists on the National Provider Identifier, and asks two questions a single-list comparison cannot: how many state-barred providers does the full federal screening stack still miss, and how many providers are barred across several states at once. It is the cross-state and second-federal-list extension of our earlier LEIE-only cut, the exclusion gap; where the excluded-provider landscape counted the union of every list, this one takes the state lists as the starting point and tracks what the federal stack does and does not recover.

The blind spot, in one number

64.4% of NPI-identified state-excluded providers carry no in-force OIG LEIE record: 3,189 of 4,950 across the 13 ingested states. Put the other way, a federal-LEIE-only screen catches only 1,761 of the 4,950 state-barred providers — it returns the rest as having no exclusion on file.

That is the headline an employer or payer feels directly. The OIG's own guidance is that a screen must run against every applicable list before a provider is hired, contracted, or billed through — federal and the relevant state Medicaid lists — and on an ongoing basis. Employing or contracting an excluded party in a federally billable role carries civil-monetary-penalty exposure under a "knew or should have known" standard. A federal-only screen does not meet that bar, and the 3,189 is how many providers fall through it across these 13 states alone.

A second federal list barely helps

The obvious reply is to add a second federal source. It does far less than expected. Layering the SAM.gov / GSA exclusion and debarment registry on top of the OIG LEIE recovers only 191 of the 3,189. After both federal lists are checked, 2,998 NPI-identified state-excluded providers — 60.6% of the 4,950 — are on neither.

A second federal list barely moves the number. Of the state-barred providers the OIG LEIE misses, all but 191 are missing from the SAM.gov debarment registry too.

The reason the second list adds so little is the same reason the first one misses: both federal registries are downstream of state action, and both lag it. A state Medicaid termination can be entered well before — or entirely without — a parallel federal exclusion or a SAM.gov debarment. Stacking two lagging federal lists does not recover a bar that has not propagated to either of them. The state list is where many of these decisions land first.

Why the state bars don't reach the federal lists

The gap is structural, not a data error. State Medicaid agencies exclude providers under state authority for Medicaid-specific reasons, and a federal action does not automatically follow. The OIG may adopt a state action under its permissive §1128(b) authority — most commonly §1128(b)(4) for a state license revocation, surrender, or suspension — but that adoption is discretionary and lagged, and many state bars never cross over at all. We documented the federal side of this in who actually gets barred from Medicare and why: the single largest basis on the LEIE is itself a downstream echo of state licensing discipline.

Timing compounds it. An exclusion is a trailing record on every list, and the trailing records do not move together. A provider can be off a state Medicaid program long before a federal list catches up — the same cadence mismatch we measured between a triggering event and CMS deactivation in the deactivation-lag study. The federal–state direction we measured directly in the exclusion gap; this study adds the second federal list and the cross-state view to it.

The cross-state dimension

The state lists also disagree with each other in a way no federal comparison can show: some providers are barred in more than one state at the same time. 198 of the 4,950 NPIs appear on two or more of the 13 state lists. The distribution is concentrated near the low end, but it has a long tail — one provider sits on seven different states' exclusion lists.

A provider barred across several state Medicaid programs is, on its face, the least ambiguous kind of standing exclusion — yet 82 of these 198 multi-state providers still carry no OIG LEIE record. A federal-only screen clears a provider barred in two, three, or seven states as having nothing on file. The cross-state overlap is small in count but sharp in implication: it is the subset where the federal blind spot is hardest to explain as a one-cycle timing lag.

How the blind spot breaks down by state

No single state drives the headline. New York carries the largest matchable population and Tennessee the smallest, and the federal-invisible share holds across the range.

The records with no NPI at all

The matchable population is itself a minority of the data. 74.2% of state exclusion rows — 16,995 of 22,917 — carry no NPI at all. They name an excluded party with no identifier that maps to any federal list, so identifier-based screening cannot reach them in either direction.

These rows are excluded from every matchable denominator above, because matching them would require a name match — and a name match is not a defensible identity assertion. We do not guess. But the practical implication is blunt: identifier-based screening, federal or state, cannot see three in four state exclusion records, and a complete check has to fall back to name-and-date matching against each primary source.

What this means for screening compliance

The magnitude puts a number on a familiar warning: a federal screen — even a two-list federal screen — is not a complete exclusion check. Across these 13 states, 64.4% of NPI-identified state-barred providers are outside the OIG LEIE, and 60.6% are outside both federal lists. Adding the SAM.gov debarment registry, the standard second federal source, closes only about 6% of the LEIE-only gap.

Two operational lessons follow. First, federal breadth does not substitute for state currency: the federal lists are national but lagging, while the state lists are program-specific but current, and only the union of the layers — read across frozen point-in-time snapshots — closes the gaps in each. Second, identifier-only screening is a floor, not a ceiling, because three in four state records carry no NPI. Fonteum exposes the layers through a single NPI lookup — the state exclusion data and the federal OIG LEIE — so a "barred anywhere on the lists we hold" answer does not depend on which single list a screener happened to check. It is a screening aid: re-confirm any match against the primary source before acting, and read the absence of a match as "nothing in the lists Fonteum currently holds," never as a guarantee that none exists.

Methodology

Every figure is a direct join across three public, read-only Postgres tables: state_exclusions (the State Exclusion Ring — 13 state Medicaid programs, 22,917 rows, data as of 2026-06-19), oig_leie_exclusions (the OIG monthly LEIE bulk download, release 2026-05-08, 68,055 active records, 7,025 with an NPI), and sam_exclusions (the SAM.gov / GSA federal exclusion and debarment registry, 167,582 records, 18,722 with an NPI). The join key is the 10-digit NPI, trimmed of whitespace; a name is never used to assert a match.

A record is treated as in force when its reinstatement date (state, LEIE) or termination date (SAM) is null or still in the future relative to the publish date — the same test the production exclusion lookup applies, and applied identically to every table. The matchable denominator is the set of distinct, in-force, NPI-identified state-excluded providers; records with no NPI are excluded from it and reported separately. The federally-invisible count is the subset of those NPIs with no in-force row in oig_leie_exclusions; the both-lists-invisible count is the subset absent from oig_leie_exclusions and sam_exclusions. Cross-state overlap counts distinct NPIs appearing on two or more distinct state lists. The exact SQL is in the reproducibility block below, and the provenance methodology documents the source-provenance contract. Methodology version: state-blind-spot/v1.

Limitations

• Thirteen states, not fifty. Coverage is New York, Pennsylvania, Ohio, Iowa, Maryland, Washington, North Carolina, Mississippi, New Hampshire, North Dakota, Montana, Georgia, and Tennessee. Every figure describes the 13 state Medicaid programs Fonteum currently ingests, not the nation. The blind spot in the 37 states not yet ingested is unmeasured here.
• NPI is the floor, not the ceiling. 74.2% of state exclusion rows carry no NPI and cannot be matched to any federal list by identifier; they are reported separately, never guessed at by name. The headline figures describe the matchable, NPI-identified set only.
• A state exclusion is not a federal one. State Medicaid and federal exclusions rest on different legal bases, authorities, and program scopes. This study measures only whether the same NPI appears on each list; it never treats a state bar as a federal one or infers conduct from either.
• Snapshot, not real time. All three lists are point-in-time. The state files reflect the 2026-06-19 ingest, the LEIE the 2026-05-08 release, and SAM.gov its current ingest. A bar in transit between releases can leave a provider looking absent from a list it will soon appear on.
• Small-sample states are illustrative. Georgia, Montana, North Dakota, and Tennessee carry small matchable denominators, so their per-state shares are unstable and should be read as illustrative, not as stable estimates.
• A compliance signal, aggregate-only. Exclusion counts are an enforcement and screening signal, never a measure of care quality, and never a wrongdoing finding about any provider. No individual excluded party is named, surfaced, or attached to any provider profile in this study.

Sources

• OIG LEIE — online database and monthly downloads — the federal exclusion list and the first comparison anchor.
• SAM.gov — exclusions and debarment registry — the GSA-administered federal exclusion list and the second comparison anchor.
• OIG — effect of an exclusion (screening duty, civil monetary penalties) — the obligation to screen all applicable lists and the "knew or should have known" penalty standard.
• New York OMIG — Medicaid exclusions — the largest state source in the ring.
• Pennsylvania DHS — sanctioned and precluded providers — the second-largest state source.
• Fonteum — state Medicaid exclusion data, all ingested states — the consolidated state exclusion layer across all 13 states.
• 42 U.S.C. § 1320a-7 (Social Security Act § 1128) — the federal exclusion statute, including the permissive §1128(b)(4) license-action authority.