SAM vs OIG Exclusion Lists

Not as a general rule. No federal statute or regulation requires a healthcare employer to check either list. In practice, though, most employers screen the LEIE before hiring and every month, because that is how they avoid OIG penalties. Checking SAM as well becomes a requirement mainly when the organisation works under Medicare Advantage or Part D contracts, or when a state Medicaid programme or a contract imposes it.

Approach: The datasets I can search hold the LEIE itself but no rules on screening duties. So I used OIG's 2013 Special Advisory Bulletin, the Medicaid regulation at 42 CFR 455.436 and CMS guidance. I did not survey each state's Medicaid provider requirements.

1. The LEIE: not required, but this is where the penalties are

• OIG says plainly: "Providers are not required by statute or regulation to check the LEIE." Providers can decide how often to check. Because OIG updates the list monthly, checking every month "best minimizes potential overpayment and CMP liability."
• Why it matters: if a provider employs or contracts with someone it "knows or should know" is excluded, OIG can impose civil money penalties (CMPs). These run up to $10,000 per item or service, plus up to three times the amount claimed, and the provider can itself be excluded. This applies to clinical staff, administrative and management roles, volunteers and staff supplied by agencies.
• Who to screen: look at each job category and contract. If the work is paid for, directly or indirectly, by a federal health care programme, screen everyone in it, including contractors and their staff.
• Using a vendor: you can have a vendor run the screening, but you keep the CMP liability. OIG recommends getting and keeping their screening records.

2. SAM: OIG treats it as secondary

• OIG recommends the LEIE "as the primary source" for its exclusions. The LEIE is updated monthly and holds more detail than SAM.
• OIG "has no authority to impose CMPs on the basis of employment of (or contracting with) a debarred person." So a SAM-only debarment does not create OIG penalty exposure for a provider.

3. Where checking both is required

• Medicare Advantage and Part D (CMS Medicare Managed Care Manual Chapter 21, §50.6.8): plan sponsors "must review" both the OIG LEIE and the GSA excluded-parties list (EPLS, now part of SAM). They must do this before hiring or contracting with any employee, temporary worker, volunteer, consultant, board member, or first-tier, downstream or related entity (FDR), and monthly after that. A hospital, pharmacy or medical group in a plan network is usually an FDR, so it may be held to this through its plan contract.
• State Medicaid agencies (42 CFR 455.436): states must check the LEIE and EPLS/SAM "no less frequently than monthly." The checks cover enrolled providers and their owners, agents and managing employees. CMS has said this rule does not make states require providers to screen their own staff. CMS does recommend that states require providers to screen employees and contractors against the LEIE at hire and monthly (State Medicaid Director Letter #09-001). Some states have done so through their provider agreements.
• Federal contracts or grants bring separate SAM obligations, as covered in the previous answer.

In practice: the usual approach is LEIE checks at hire and monthly, plus SAM checks, plus your state's Medicaid exclusion list wherever you bill Medicaid. A clean LEIE result does not clear SAM debarments, and a clean SAM result is not the record OIG itself relies on.

I can screen specific names or NPIs against the current LEIE if useful.

Sources:

• HHS-OIG Updated Special Advisory Bulletin on the Effect of Exclusion (May 8, 2013)
• 42 CFR 455.436, Federal database checks (govinfo, 10-1-21 edition)
• CMS Medicaid Program Integrity Toolkit: 42 CFR 455.436 (Dec 2014)
• CMS Medicare Managed Care Manual, Chapter 21
• HHS-OIG Exclusions FAQ

GSA folded EPLS into SAM.gov, the System for Award Management. The same debarment, suspension and exclusion records are now kept in SAM as "Exclusions" data. So when a rule or contract says "EPLS", you meet it by searching the SAM.gov exclusions. The DoD's acquisition guidance (DFARS PGI 209.105-1) says: "The former Excluded Parties List System (EPLS) information is within the Performance Information functional area of SAM, and is maintained as 'Exclusions' data."

Approach: The datasets I can search hold no records on EPLS or SAM exclusions, so I used official federal acquisition pages (acquisition.gov and GSA's SAM.gov API documentation). None of the official pages I opened gives the date EPLS was retired, so I don't state one.

What carried over

• The records: exclusions entered in EPLS are still in SAM. The guidance notes that individuals entered in EPLS under the Department of Justice reciprocal debarment code "can be found in the SAM Exclusions."
• The rule behind it: FAR 9.404 now names SAM as the system. It states that GSA "operates the web-based System for Award Management (SAM), which contains exclusion records." Each record includes the party's name and address, the acting agency, the cause, the termination date, its Unique Entity Identifier (UEI) and taxpayer ID, and an agency contact.

What changed

• Codes replaced by exclusion types: EPLS sorted records under about 71 "cause and treatment" codes. New SAM records no longer carry those codes. Each record gets one of four exclusion types instead: Preliminarily Ineligible (Proceedings Pending), Ineligible (Proceedings Completed), Prohibition/Restriction, or Voluntary Exclusion. Each old code maps to one type, and records created in EPLS show both.
• Read the exclusion type before acting: the guidance warns that being listed "does not necessarily mean the entity is ineligible for contract award." You need to check the exclusion type.
• Bulk downloads: SAM.gov publishes a public Exclusions Extract every day after 7 AM Eastern. It lists "all parties with a currently active exclusion," as CSV files inside ZIP archives. Downloading it needs a SAM.gov account with an API key or the right system-account permission.

Older rules still say EPLS. Some agency rules were never updated. For example, the Department of the Interior's acquisition rule (DIAR 1409.404) still tells contracting officers to use "the EPLS online at http://www.epls.gov." The same applies to the healthcare rules from the last answer: 42 CFR 455.436 and the CMS Medicare Managed Care Manual both name EPLS, and in practice that means checking the SAM.gov exclusions.

Sources:

• DFARS PGI 209.105-1, Obtaining information (acquisition.gov)
• FAR 9.404, Exclusions in the System for Award Management
• DIAR 1409.404, Excluded Parties List System (EPLS)
• GSA, SAM.gov Entity/Exclusions Extracts Download APIs