DEPARTMENT OF HEALTH & HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, Maryland   21244-1850 
 
Center for Medicaid and State Operations 
 
                  SMDL #08-003 
          June 12, 2008 
 
Dear State Medicaid Director: 
 
The Centers for Medicare & Medicaid Services (CMS) is issuing this State Medicaid Director 
Letter to strengthen the integrity of the Medicaid program and help States reduce improper 
payments to providers.  This letter specifically: 
 
(1) Clarifies CMS policy with respect to States obligations to screen for excluded 
individuals and entities prior to and during provider enrollment;  
 
(2) Reminds States of the obligation to report to the Health and Human Service Office of 
Inspector General (OIG) both convictions related to the Medicaid program and 
sanctions imposed by the State Medicaid Agency on Medicaid providers; and  
 
(3) Reminds States of the consequences set forth in Federal laws and regulations for 
  failure to prevent Medicaid participation by excluded individuals and entities. 
 
Background 
The OIG excludes individuals and entities from participation in Medicare, Medicaid, the State 
Childrens Health Insurance Program (SCHIP), and all Federal health care programs (as defined 
in section 1128B(f) of the Social Security Act (the Act)) based on the authority contained in 
various sections of the Act, including sections 1128, 1128A, 1156, and 1892. 
 
When the OIG has excluded a provider, Federal health care programs (including Medicaid and 
SCHIP programs) are prohibited from paying for any items or services furnished, ordered, or 
prescribed by excluded individuals or entities until the provider has been reinstated by the OIG 
(42 CFR section 1001.1901).  The only exception is when the OIG has waived the exclusion of 
an individual or entity.  See sections 1128(c)(3)(B) and 1128(d)(3)(B) of the Act; and 42 CFR 
section 1001.1801.  No State may waive such an exclusion, in whole or in part.  Only the OIG 
has the authority to waive an exclusion that it has imposed.  If a State believes that waiver of an 
exclusion is appropriate, it may submit a written request for such a waiver to the OIG (42 CFR 
section 1001.1801). 
 
Additionally, section 1932(d)(1) of the Act prohibits managed care organizations (MCOs) and 
primary care case managers (PCCMs) from knowingly having a director, officer, partner, or 
person with a beneficial ownership of more than 5 percent of the entitys equity who is debarred, 
suspended, or excluded, or from having an employment, consulting, or other agreement with an   Page 2  State Medicaid Director 
 
individual or entity for the provision of items and services that are significant and material to the 
entitys obligations under its contract with the State where the individual or entity is debarred, 
suspended, or excluded.  Section 438.610 of the Federal managed care regulations extends the 
prohibition to prepaid inpatient health plans (PIHPs) and prepaid ambulatory health plans 
(PAHPs) (42 CFR section 438.610.)  If a State finds that an MCO, PCCM, PIHP, or PAHP has a 
noncompliant relationship, the State must notify the Secretary of the noncompliance.  The State 
may not renew or extend its agreement with the noncompliant entity unless the Secretary 
provides to the State and to Congress a written statement describing compelling reasons to renew 
or extend the agreement.  Additional administrative sanctions applicable to MCEs are set forth in 
42 CFR section 438.700 et seq. 
 
Policy Clarification 
States must determine whether current providers, managed care entities (MCEs) (i.e., MCOs, 
PCCMs, PIHPs, and PAHPs),* providers applying to participate in the Medicaid program, and 
individuals with an ownership or control interest in the provider entity or MCE are excluded 
individuals or entities.  Since Federal regulations prohibit payment for items or services 
furnished by excluded individuals and entities, it is imperative that this first line of defense in 
combating fraud and abuse be conducted accurately, thoroughly, and routinely. 
 
Previous Guidance 
In a State Medicaid Director Letter issued on March 17, 1999, and in a follow-up State Medicaid 
Director Letter issued on May 16, 2000, CMS described the OIGs  authority to exclude persons 
based on actions taken by State Medicaid Agencies. 
 
In the State Medicaid Director Letter dated May 16, 2000, CMS reminded States that the 
Medicare/Medicaid Sanction-Reinstatement Report, formerly known as HCFA Publication 69 
and now replaced by the Medicare Exclusion Database, discussed below,  is a vital resource for 
ascertaining and verifying whether a provider is excluded and should not be receiving payments.  
The guidance also stated that the payment prohibition applies to any MCO contracting with an 
excluded party. 
 
State Obligations Concerning Excluded Individuals and Entities 
Federal statutes and regulations clearly prohibit States from paying for items or services 
furnished, ordered or prescribed by excluded persons.  States typically do screen for excluded 
providers prior to and after enrollment.  However, not all States attempt to determine whether an 
excluded individual has an ownership or control interest, as defined below, in an entity that is a 
Medicaid provider.  Federal regulations at 42 CFR section 1002.3 require States to report to OIG 
information regarding individuals that have ownership or control interests in provider entities 
and who have been convicted of a criminal offense as described in sections 1128(a) and 
1128(b)(1), (2), or (3) of the Act, that have had civil monetary penalties imposed under section 
1128A of the Act, or that have been excluded from participation in Medicare or any of the State  
                                                 
* While this State Medicaid Director Letter uses the term managed care entity to refer briefly to MCOs, PIHPs, 
PAHPs, and PCCMs, States should not confuse this abbreviation with the statutory definition of managed care entity 
which only refers to MCOs and PCCMs.  See section 1932(a)(1)(B) of the Act.  Page 3  State Medicaid Director 
 
health care programs, within 20 business days after the date the agency receives the information.  
If appropriate, OIG may permissively exclude the provider under section 1128(b)(8) of the Act 
and under 42 CFR section 1001.1001. 
 
General Rules 
  States should solicit information from providers about individuals with ownership or 
control interests in the provider entity. 
  In accordance with the rules set forth in this letter, States should search the Medicare 
Exclusion Database (MED) or the OIG List of Excluded Individuals/Entities (LEIE) 
database by the names of any individual, entity, or individual with ownership or control 
interest in any provider entity providing services for which payment is made under the 
Medicaid program or seeking to participate in the Medicaid program, including through a 
fee-for-service delivery system or through the States managed care program or other 
waiver program. 
  States should review provider enrollment eligibility upon enrollment or reenrollment. 
  States should search the MED or the OIG Web site monthly to capture exclusions and 
reinstatements that have occurred since the last search.  
  States should search the exclusions database for both in-State providers and out-of-State 
providers seeking to participate in the program. 
  States should not process a providers disclosure information that does not appear 
complete or does not include information on individuals with ownership or control 
interests in the provider entity, including managing employees, until the State verifies the 
accuracy and completeness of the information. 
  States should report to OIG any exclusion information that is disclosed to them by a 
provider about an individual who has or had an ownership or control interest in a 
provider entity or who is a managing employee of a provider entity within 20 business 
days after receipt of such information. 
  States must notify the OIG promptly if the State Medicaid Agency has taken any action 
on the providers application for participation in the Medicaid program.  
  States should notify the OIG promptly of any administrative action the State  takes to 
limit a providers participation in the Medicaid program that might lead to an exclusion. 
 
Ownership and Control Interests 
An individual is considered to have an ownership or control interest in a provider entity if it has 
direct or indirect ownership of 5 percent or more, or is a managing employee (e.g., a general 
manager, business manager, administrator, or director) who exercises operational or managerial 
control over the entity, or who directly or indirectly conducts the day-to-day operations of the 
entity as defined in section 1126(b) of the Act and under 42 CFR section 1001.1001(a)(1). 
 
States must actively solicit information regarding individuals with ownership or control interests 
in provider entities from providers because providers may not independently disclose the identity 
of owners or managing employees on the disclosure document.  State data files should capture 
these important data elements so that an automated comparison of exclusions against a provider 
file that includes the names of individuals with ownership or control interests in provider entities   Page 4  State Medicaid Director 
 
can be accomplished easily during regular monthly searches and at any time providers submit 
new disclosure information to the State.  While States may delegate many provider enrollment or 
credentialing functions to MCEs for the managed care program and to the States contractors for 
Home and Community-Based Services (HCBS) and other waiver programs, the State remains 
responsible for ensuring that it does not pay an excluded provider for Medicaid health care items 
or services.  States that delegate managed care and waiver program provider enrollment and 
credentialing to their MCEs and HCBS waiver contractors must mandate that the MCEs and 
HCBS waiver contractors search the exclusions database with the same frequency as the State for 
fee-for-service providers.  MCEs and HCBS waiver contractors should search for providers, 
provider entities, and individuals with ownership or control interests in the provider entities. 
 
Under Federal regulations at 42 CFR section 1002.3(a), providers entering into or renewing a 
provider agreement must disclose to the State Medicaid Agency the identity of any excluded 
individual with an ownership or control interest in the provider entity.  The State Medicaid 
Agency then must notify the OIG of this information within 20 business days after the date the 
agency receives the information and must notify the OIG promptly if the State Medicaid Agency 
has taken any action on the providers application for participation in the Medicaid program.    
42 CFR section 1002.3 (b)(2).  The OIG, in its discretion and under statutory and regulatory 
authority, may exclude that entity.  
 
Convictions and Administrative Sanctions 
Under 42 CFR section 1002.230, each State, either through its State Medicaid Agency or its 
Medicaid Fraud Control Unit (MFCU), must notify the OIG of convictions related to the delivery 
of items or services under the Medicaid program within 15 days after the conviction if the State 
agency was involved in the investigation or prosecution of the case, or within 15 days after the 
State agency learns of the conviction if the agency was not involved in the investigation or 
prosecution of the case.  Such a report should include all the necessary documentation to support 
an exclusion action by the OIG.   
 
Additionally, under 42 CFR section 1002.3, the State agency must notify the OIG of any 
disclosures made by providers with regard to the ownership or control by a person that has been 
convicted of a criminal offense described under sections 1128(a) and 1128(b)(1), (2), or (3) of 
the Act, or that has had civil money penalties or assessments imposed under section 1128A of 
the Act.  See 42 CFR section 1001.1001(a)(1).  The State Medicaid Agency must notify the OIG 
of this information within 20 business days after the date it receives the information. 42 CFR 
sections 455.106(b)(1) and 1002.3. 
 
States are required under 42 CFR sections 455.106(b)(2) and 1002.3(b)(3) to notify the OIG 
promptly of any administrative action it takes to limit participation of a provider in the Medicaid 
program.  Reporting these criminal and administrative actions is critical to timely 
implementation of exclusions of persons who have defrauded health care programs or harmed 
patients.  Currently in some States there are significant delays in reporting of such actions.  Such  Page 5  State Medicaid Director 
 
delays jeopardize the governments ability to protect the Federal health care programs and their 
beneficiaries from untrustworthy persons. 
 
Where to Look for Excluded Parties 
Medicare Exclusion Database 
In 2002, HCFA Publication 69 was replaced by a new system of record called the Medicare 
Exclusion Database (MED).  The MED was developed to collect and retrieve information that 
aided in ensuring that no payments are made to excluded individuals and entities for services 
furnished during the exclusion period.  Two of the information sources used in populating the 
MED are the OIG Exclusion file and the Social Security Administration.  MED files contain a 
variety of identifiable and general information including name, Social Security Number (SSN), 
employer identification number, Uniform Provider Identification Number, National Provider 
Identifier, address, exclusion type, and reinstatement date, if applicable.  The five MED files are 
e-mailed to States every month.  These files contain the months new exclusions, new 
reinstatements, cumulative exclusions, cumulative reinstatements and non-MED data.  MED 
files are also available through CMS Application Portal. 
 
List of Excluded Individuals/Entities 
The OIG maintains the LEIE, a database that provides information about parties excluded from 
participation in Medicare, Medicaid, and all other Federal health care programs.  The LEIE Web 
site is located at http://oig.hhs.gov/fraud/exclusions/listofexcluded.html and is available in two 
formats.  The on-line search engine identifies currently excluded individuals or entities.  When a 
match is identified, it is possible for the searcher to verify the accuracy of the match using a SSN 
or Employer Identification Number (EIN).  The downloadable version of the database may be 
compared against State enrollment files.  However, unlike the on-line format, the downloadable 
database does not contain SSNs or EINs. 
 
When to Look for Excluded Parties 
States should review provider enrollment eligibility whenever an individual or entity submits an 
application for enrollment or reenrollment in the program.  Additionally, States should conduct 
searches on both in-State providers and out-of-State providers about which the State Medicaid 
Agency would not have received notice of exclusion.  States should conduct the searches 
monthly via the MED or the OIG Web site to capture exclusions and reinstatements that have 
occurred since the last search. 
 
Reminder of Consequences of Paying Excluded Providers 
The CMS informed States in the State Medicaid Director Letter dated May 16, 2000, that under 
section 1903(i)(2) of the Act CMS shall make no payments to States for any amount expended 
for items or services (other than an emergency item or service not provided in a hospital 
emergency room) furnished under the plan by an individual or entity while being excluded from 
participation.  This includes Medicare, Medicaid, SCHIP, and all Federal health care programs 
(as defined in section 1128B(f) of the Act) based on the authority contained in various sections 
of the Act, including sections 1128, 1128A, 1156, and 1892.  Any such payments actually   Page 6  State Medicaid Director 
 
claimed for Federal financial participation (FFP) constitute an overpayment under section 
1903(d)(2)(A) of the Act and are unallowable for FFP.  
 
Further, States may not seek Federal reimbursement for payments to providers that have not 
provided required ownership and control disclosures, or other disclosures regarding business 
transactions, under 42 CFR sections 455.104 and 455.105.  States may deny enrollment to a 
provider whose owner, agent, or managing employee has been convicted of a criminal offense 
relating to Medicare, Medicaid, or title XX programs.  Moreover, States may deny enrollment or 
terminate a providers enrollment if the State determines the provider did not fully disclose 
required criminal conviction information, under 42 CFR section 455.106(c). 
 
Conclusion 
We know you share our commitment to combating fraud and abuse and understand that provider 
enrollment is the first line of defense in this endeavor.  If we strengthen our efforts to identify 
excluded parties, the integrity and quality of the Medicaid program will be improved, benefiting 
Medicaid beneficiaries and taxpayers across the country. 
 
If you have any questions or would like any additional information on this guidance, please 
direct your inquiries to Ms. Claudia Simonson, Centers for Medicare & Medicaid Services, 
Center for Medicaid and State Operations, Medicaid Integrity Group, Division of Field 
Operations, 233 North Michigan Avenue, Suite 600, Chicago, IL 60601 or 
claudia.simonson@cms.hhs.gov.  Thank you for your assistance in this important endeavor. 
 
Sincerely,  
 
/s/ 
 
Herb B. Kuhn  
Deputy Administrator 
Acting Director, Center for Medicaid and State Operations  
 
cc: 
CMS Regional Administrators 
 
CMS Associate Regional Administrators 
Division of Medicaid and Childrens Health 
 
Barbara Edwards 
NASMD Interim Director 
American Public Human Services Association 
 
Joy Wilson 
Director, Health Committee 
National Conference of State Legislatures  Page 7  State Medicaid Director 
 
Matt Salo 
Director of Health Legislation 
National Governors Association 
 
Debra Miller 
Director for Health Policy 
Council of State Governments 
 
Christie Raniszewski Herrera 
Director, Health and Human Services Task Force 
American Legislative Exchange Council 
 
Barbara Levine 
Director of Policy and Programs 
Association of State and Territorial Health Officials