How to Write an OIG Screening Policy in Under 30 Minutes (42 CFR § 1001.1901)
Executive Summary
Every small medical practice that participates in Medicare, Medicaid, or other federal healthcare programs must screen employees, contractors, and vendors against the Office of Inspector General’s (OIG) List of Excluded Individuals and Entities (LEIE). Under 42 CFR 1001.1901, employing or contracting with an excluded person can lead to repayment obligations, civil monetary penalties, and possible exclusion of the practice itself. Many small practices lack the resources to hire compliance professionals to draft policies. The good news is that a defensible OIG screening policy can be written in under 30 minutes if practices follow a structured approach. This article provides step-by-step guidance, a case study, a self-audit checklist, and best practices to help small practices design a policy that is simple, affordable, and effective.
Introduction
In small practices, compliance duties often fall on administrators or clinicians with little formal compliance training. Writing an OIG screening policy can feel overwhelming when there are patients to see, claims to process, and phones to answer. Yet the absence of a policy leaves the practice exposed to major risks. Without written rules, screenings may be inconsistent, undocumented, or forgotten entirely.
A written OIG screening policy accomplishes several goals: it defines responsibilities, sets frequency, specifies documentation requirements, and provides clear escalation steps. Regulators expect to see such policies during audits or investigations. Fortunately, creating a policy does not require expensive consultants or lengthy legal drafting. By leveraging OIG’s free resources and adopting a simple template, small practices can protect themselves quickly and effectively.
Regulatory Breakdown
Requirements Under 42 CFR 1001.1901
42 CFR 1001.1901 states that no federal healthcare program payment may be made for any item or service furnished by an excluded individual or entity, whether directly or indirectly (42 CFR §1001.1901(b)(1)(i)–(ii)). This includes services provided by clinical staff, administrative employees, or contractors. It further makes clear that providers are responsible for ensuring they do not employ or contract with excluded persons (Federal Register, 42 CFR 1001.1901) However, §1001.1901 also establishes narrow exceptions. Payments may still be permitted in limited circumstances, such as inpatient services for patients admitted before the exclusion date, home health or hospice care under existing plans of care, or certain emergency services when accompanied by a sworn statement explaining why an eligible provider could not furnish the care (42 CFR §1001.1901(c)). These exceptions do not negate the general prohibition but highlight that exclusions are not always absolute.
The OIG enforces this requirement through its LEIE database, which is updated monthly. Providers are expected to check this list regularly and maintain documentation. Failure to do so may result in liability under the Civil Monetary Penalties Law, codified at 42 CFR Part 1003.
Documentation as Evidence
OIG guidance specifies that providers must be able to demonstrate compliance through documentation. Acceptable evidence includes dated search results, screenshots of LEIE queries, and written logs of monthly screenings. A policy must therefore require staff not only to perform screenings but also to keep records accessible for at least six years, consistent with HIPAA documentation retention standards (45 CFR 164.530(j)(2)).
The Role of Policy in Compliance Defense
In enforcement actions, OIG often looks at whether the practice had a written policy and whether staff followed it. A clear policy demonstrates intent to comply and can be a mitigating factor in enforcement decisions. In contrast, the absence of a policy is often cited as evidence of reckless disregard.
Case Study (a case study)
A family medicine clinic in the Northeast hired a part-time billing clerk without conducting an exclusion screening. The clerk had been excluded from federal healthcare programs five years earlier due to a state Medicaid fraud conviction. Over a year, the clerk submitted hundreds of claims to Medicare and Medicaid.
When OIG identified the clerk through a data match, the clinic was ordered to repay more than $350,000 in tainted claims and faced additional civil penalties under 42 CFR Part 1003. The investigation revealed that the clinic had no written screening policy. Staff believed screenings were the manager’s responsibility but could not produce any documentation of completed checks. Regulators cited the lack of a policy as a significant aggravating factor.
Had the clinic drafted a simple written policy requiring pre-employment and monthly screenings, with documentation procedures clearly assigned, it could have prevented the oversight or at least demonstrated good-faith compliance.
Self-Audit Checklist
A self-audit checklist helps small practices confirm that their OIG screening policy is both written and functional. Practices should review the following areas:
-
Policy Existence: Verify that a written OIG screening policy exists, signed by leadership, and accessible to staff (HHS OIG Exclusions Guidance).
-
Screening Frequency: Confirm that the policy mandates pre-employment checks and monthly re-screenings of all staff, contractors, and vendors.
-
Documentation Requirements: Ensure the policy requires dated logs, screenshots, or vendor attestations retained for at least six years.
-
Responsibility Assignment: Confirm the policy assigns a designated individual, often a practice manager or compliance officer, to perform and document screenings.
-
Escalation Protocols: Review whether the policy describes how to handle potential matches, including immediate suspension and legal consultation.
-
State Screening: Verify the policy requires checks against state Medicaid exclusion lists where applicable.
Completing this checklist ensures that the policy is comprehensive and defensible, reducing compliance risk.
Common Pitfalls and How to Avoid Them
Many small practices fail in predictable ways when writing or implementing OIG screening policies. Awareness of these pitfalls helps prevent errors:
-
Policies Without Specifics: Vague language such as “we will conduct screenings” is insufficient.
-
Avoidance: Include clear instructions on frequency, responsible parties, and documentation.
-
Excluding Contractors and Vendors: Practices sometimes limit screenings to employees.
-
Avoidance: Require checks for contractors, vendors, and staffing agencies as federal rules apply broadly (42 CFR §1001.1901(b)(1)(ii)).
-
Failure to Document: Performing screenings without saving proof leaves practices defenseless in audits.
-
Avoidance: Mandate retention of logs, screenshots, or reports.
-
One-Time Screening Only: Practices often screen only at hire, ignoring ongoing risk.
-
Avoidance: Require monthly re-screenings, consistent with OIG recommendations.
-
Not Reviewing Policy Regularly: A policy written once may become outdated.
-
Avoidance: Review and update the policy annually or when regulations change.
Avoiding these pitfalls strengthens compliance defenses and reduces exposure to civil penalties.
Best Practices
Step-by-Step Policy Drafting in Under 30 Minutes
Small practices can write an OIG screening policy quickly by following these steps:
-
Define Scope: State that the policy applies to all employees, contractors, and vendors.
-
Assign Responsibility: Designate one person (e.g., practice manager) to conduct and document screenings.
-
Set Frequency: Require screening before hire and monthly thereafter.
-
Specify Resources: Identify the OIG LEIE database and relevant state lists as sources.
-
Require Documentation: Mandate dated logs, screenshots, or reports stored in a compliance folder.
-
Outline Escalation: Describe actions if a potential match is identified, including suspension and legal review.
-
Retention Period: Require records to be kept for six years.
Each step aligns directly with regulatory requirements and can be written in plain language for staff understanding.
Affordable Tools and Resources
-
OIG LEIE Database: Free online tool updated monthly (oig.hhs.gov/exclusions).
-
State Medicaid Exclusion Lists: Free resources maintained by state agencies.
-
Shared Drive Folders: Low-cost method to store screening logs securely.
-
Compliance Checklists: Free templates from OIG and CMS websites.
These tools reduce cost barriers while ensuring compliance.
Training Staff on Policy
The policy should require annual training for all staff. Training reinforces why screenings matter, how to document them, and how to escalate concerns. Written sign-in sheets or electronic certificates should be maintained as evidence.
Building a Culture of Compliance
A written policy is only effective if staff embrace compliance responsibilities. Small practices can build a culture of compliance by:
-
Leadership Modeling: Owners and physicians must follow the policy and emphasize its importance.
-
Transparency: Share screening logs in staff meetings to demonstrate accountability.
-
Recognition: Acknowledge staff who diligently complete screenings or identify risks.
-
Integration: Make OIG screenings part of onboarding, payroll updates, and vendor contracting workflows.
A culture of compliance turns policy from a document into a daily practice, reducing risk of oversight.
Conclusion
Writing an OIG screening policy may sound daunting, but with a structured approach, small practices can complete it in under 30 minutes. Under 42 CFR 1001.1901, practices must ensure they do not employ or contract with excluded individuals, and a written policy provides both operational guidance and legal defense. Practices should also be aware of the limited exceptions in §1001.1901(c), which apply in narrow cases such as prior admissions, existing plans of care, or certain emergencies. Including reference to these exceptions in policy drafting helps ensure the practice’s compliance framework fully reflects the regulation. By following step-by-step drafting, using free OIG resources, training staff, and embedding compliance into culture, small practices can protect themselves from devastating financial and reputational harm. A defensible policy is not only a regulatory requirement, it is an essential safeguard for the survival of small healthcare providers.
To safeguard your practice, adopt a compliance management system. These tools consolidate regulatory obligations, provide ongoing risk monitoring, and ensure you’re always prepared for audits while demonstrating your proactive approach to compliance.