Understanding Federal Exclusion, Medicare Preclusion, and Contractual Screening Obligations

During a recent presentation to healthcare compliance professionals, an attendee asked whether a hospital has to screen the Medicare Preclusion List. The short answer is not necessarily. Federal regulations require Medicare Advantage (MA) organizations and Medicare Part D sponsors to comply with Preclusion List payment restrictions. They do not impose a freestanding screening requirement on a hospital merely because it participates in Medicare, and the list itself is not public—CMS makes it available to plans, not to hospitals. A hospital may nevertheless take on screening obligations through its MA contracts or delegated arrangements. 

The same analysis applies to any organization that contracts with an MA plan or Part D sponsor, from physician groups to credentialing and billing vendors, because the screening duty comes from the contract. For a hospital compliance officer, then, the first question is not whether to screen, but which compliance functions the hospital has agreed to perform for each payor.

1. What is the Medicare Preclusion List?

The Centers for Medicare & Medicaid Services (CMS) established the Preclusion List to prevent payment for certain items, services, and drugs under MA and Part D. CMS may list a provider or prescriber whose Medicare enrollment has been revoked, who remains under a reenrollment bar, and whose underlying conduct CMS determines is detrimental to the best interests of the Medicare program. Conduct that would have supported revocation had the provider been enrolled, and certain felony convictions within the preceding ten years, can also support preclusion. 42 C.F.R. §§ 422.2, 423.100 (defining “preclusion list”); 83 Fed. Reg. 16,440 (Apr. 16, 2018).

The Office of Inspector General (OIG) of the U.S. Department of Health and Human Services (HHS) maintains the public List of Excluded Individuals/Entities (LEIE). Exclusion generally bars federal health care program payment for items or services an excluded person furnishes, orders, or prescribes, even when another provider submits the claim. An OIG-excluded provider or prescriber is placed on the Preclusion List as of the effective date of the exclusion. A clinician may also be precluded without being excluded, so a clear LEIE search cannot establish that an MA claim is payable. 42 U.S.C. § 1320a-7; 42 C.F.R. §§ 1001.1901(b)–(c), 422.222(a)(3)(ii), 423.120(c)(6)(v)(C)(2).

CMS has also finalized an expansion of the felony criterion. Once the change takes effect, a qualifying felony conviction of an owner, managing employee, managing organization, officer, or director can support preclusion of the provider or prescriber itself. If a payor flags the hospital, the team responsible for the hospital’s ownership and managing-employee disclosures belongs in the response. 91 Fed. Reg. 72022, 72168 (Nov. 9, 2026) (to be codified at 42 C.F.R. §§ 422.2, 423.100).

2. Who is responsible for Preclusion List compliance?

An MA organization generally cannot pay for an item, service, or drug furnished, ordered, or prescribed by a listed individual or entity. The restriction reaches contracted and noncontracted providers, and it can affect a hospital’s claim even when the ordering clinician did not submit the bill. A companion provision prohibits direct or indirect MA payment for items or services furnished by an OIG-excluded or precluded provider. 42 C.F.R. §§ 422.222(a)(1), 422.224(a); 84 Fed. Reg. 15,680, 15,831 (Apr. 16, 2019).

Timing matters most for organizations with patients already receiving care from a newly listed clinician. When the provider is not also OIG-excluded, the plan must notify affected enrollees within 30 days after CMS posts the updated list, and it may not deny payment solely because of the new listing until 60 days after it sends that notice. MA provider agreements must also protect the enrollee from financial liability and place that liability on the contracted provider once the period ends. 42 C.F.R. §§ 422.222(a)(1)(ii)(A), (C), 422.504(g)(1)(iv)–(v).

Under Part D, the sponsor or its pharmacy benefit manager must reject a pharmacy claim for a drug prescribed by a precluded individual and deny a beneficiary reimbursement request that identifies the precluded prescriber by name. Prescription drug event records must meet the prescriber requirements for the date of service. As under MA, the regulation provides advance notice and a transition period for enrollees affected by a newly listed prescriber who is not OIG-excluded. 42 C.F.R. § 423.120(c)(6)(i)–(iv).

The MA organization remains accountable to CMS, but it must obtain commitments from its first tier, downstream, and related entities to prevent payments to precluded individuals and entities. When it delegates a function, the written arrangement must specify the delegated activities and reporting responsibilities and provide for ongoing monitoring. Part D sponsors likewise remain responsible for delegated functions. 42 C.F.R. §§ 422.504(i)(1), (i)(2)(v), (i)(3)–(4), 423.505(i)(1), (i)(3)–(4).

For a hospital, a commitment to prevent prohibited payments and an assignment to run a monthly roster check are different commitments. Read the provider agreement, incorporated payor manual, and delegation exhibits together. If the payor does assign screening, confirm how the hospital will obtain the results. Because CMS limits list access to plans and permits them to arrange access for entities performing delegated claims or credentialing functions the hospital must first ensure it can commit to the contracted term operationally. 42 C.F.R. § 422.504(i)(2)(v), (i)(4); Ctrs. for Medicare & Medicaid Servs., Preclusion List FAQs, Qs. 23–24 (Mar. 21, 2025).

3. Does the new CMS exclusion authority change what hospitals screen?

Since October 14, 2026, an exclusion can come from two places within HHS. An immediately effective delegation was issued by HHS authorizing the CMS Administrator to exercise the Secretary’s permissive exclusion authority under section 1128(b) of the Social Security Act, and OIG retains its own exclusion authority. The delegation adds no grounds for exclusion and no Preclusion List screening duties. What it changes is the number of places an exclusion can come from, and that matters because the consequences of working with an excluded individual fall on the hospital. Federal health care programs will not pay for items or services an excluded individual furnishes, even when the hospital rather than the individual submits the claim, and a hospital that employs or contracts with someone it knows or should know is excluded can also face civil monetary penalties. A screening program that misses one source of exclusions leaves the hospital exposed to both. A hospital that relies on the LEIE should ask its screening vendor whether CMS-imposed exclusions will appear in its results, and it should send any CMS exclusion notice to compliance and counsel so they can pin down the effective date and review the services the individual furnishes through the hospital. CMS has not yet said how it will publish its exclusions or how the MA and Part D provisions that refer to OIG exclusion will treat exclusions CMS imposes, and the answers will shape how hospitals screen going forward. Statement of Delegation of Authority, 91 Fed. Reg. 65,219 (Oct. 14, 2026); 42 U.S.C. §§ 1320a-7(b), 1320a-7a(a)(6); 42 C.F.R. § 1001.1901(b)–(c).

4. What should hospitals actually do?

The goal is to match each screening activity to the obligation it serves. Before adding a Preclusion List check, a hospital should be able to point to the statute, regulation, or contract term that requires it.

Review each MA contract for specific Preclusion List screening obligations. Identify who must be screened, how often, and what notification or corrective action the agreement requires. Give particular attention to delegated credentialing and other arrangements subject to 42 C.F.R. § 422.504(i).

Confirm that existing exclusion screening addresses federal payment restrictions under 42 U.S.C. § 1320a-7 and 42 C.F.R. § 1001.1901. A clear LEIE result does not discharge a separate contractual Preclusion List obligation.

Assign an owner for each required check and a path for its results across compliance, credentialing, medical staff services, human resources, and revenue cycle. Where possible, build any required Preclusion List screening into existing workflows rather than creating a parallel function.

Investigate potential matches before taking corrective action. Verify identity, the applicable payment restriction, effective dates, and the affected services or claims. Because exclusion and preclusion carry different consequences, determine which restriction applies before deciding whether an individual may continue furnishing services or whether particular claims may be submitted.

Document the program. Retain screening results, investigations of potential matches, communications with MA organizations, and any corrective action. A documented, contract-driven program addresses payment and compliance risk without the cost of duplicative or poorly defined screening.

5. What if screening turns up a problem?

The response depends on which restriction applies. A preclusion-only problem generally stays with the MA plan, which denies the claim or, if it has already paid, recovers the payment under its contract. The hospital’s task is to cooperate with the plan, correct the affected claims, and keep improper charges off the patient’s bill. 42 C.F.R. §§ 422.222(a)(1), 422.504(g)(1)(iv)–(v).

An excluded individual presents a different problem. Claims for items or services the individual furnished, ordered, or prescribed can create overpayments. For traditional Medicare, the hospital must report and return an overpayment within 60 days after identifying it, although the deadline is suspended for up to 180 days while the hospital conducts a timely, good-faith investigation of related overpayments. Employing or contracting with the individual can also support civil monetary penalty liability. That is the conduct OIG’s Health Care Fraud Self-Disclosure Protocol is designed to resolve, and the protocol sets specific requirements for disclosures involving excluded persons. 42 U.S.C. §§ 1320a-7k(d), 1320a-7a(a)(6); 42 C.F.R. § 401.305(a)(2), (b); Off. of Inspector Gen., U.S. Dep’t of Health & Hum. Servs., Health Care Fraud Self-Disclosure Protocol (updated Oct. 15, 2026).

The disclosure options also changed in October when OIG updated its protocol on October 15, 2026. The update makes clear that it does not cover potentially criminal conduct, which it now directs to DOJ’s Health Care Fraud Section, and a week later DOJ, OIG, and CMS launched a False Claims Act self-disclosure pilot that runs through April 22, 2027 and offers a coordinated civil resolution for conduct the government does not yet know about. Because the order in which a hospital contacts a plan or the government can determine which of these paths stays open, and because the overpayment clock may already be running, the hospital should bring in experienced health care counsel before making any of those contacts. Press Release, U.S. Dep’t of Just. (Oct. 15, 2026); U.S. Dep’t of Just. & U.S. Dep’t of Health & Hum. Servs., Healthcare False Claims Act Self-Disclosure Pilot Program (Oct. 22, 2026).

Conclusion

MA organizations and Part D sponsors bear the Preclusion List payment obligations; hospitals assume related responsibilities through contracts and delegated arrangements. A chief compliance officer can test the hospital’s process by asking the contracting, compliance, and revenue cycle teams to walk through a single payor notice together. Taking the clinician named in that notice, can the teams identify the governing contract provision, the affected dates of service, who will contact the plan, and how the hospital will keep an improper charge off the patient’s bill? The answers will show whether the hospital can carry out the commitments it has made.