Credentialing and exclusion screening are not interchangeable. Credentialing confirms that a practitioner or vendor meets professional and contractual requirements to work with your organization, while exclusion screening checks whether that person or entity is barred from participating in federal health care programs. Treating them as a single process can leave compliance gaps, create repayment exposure, and increase risk under the False Claims Act.
What is credentialing?
Credentialing is the process of verifying that a practitioner has the qualifications, licensure, training, and experience required to provide services. In healthcare organizations, credentialing is commonly tied to medical staff appointment, payer enrollment, privileging, and vendor onboarding.
Depending on the role, credentialing may include verification of:
- State professional licenses
- Education, training, and board certification
- Work history and references
- DEA registration, if applicable
- Malpractice coverage and claims history
- Hospital privileges or scope of practice
- Sanctions or disciplinary actions reported by licensing boards
Credentialing is often required by accrediting bodies, medical staff bylaws, payer contracts, and internal policies. It is usually performed at onboarding and then repeated on a periodic cycle such as every two or three years, depending on the organization and requirement.
What is exclusion screening?
Exclusion screening is the process of checking whether an individual or entity appears on a government exclusion list that bars participation in federal health care programs. The most important federal list is the HHS-OIG List of Excluded Individuals and Entities (LEIE).
Under the OIG's exclusion authority in 42 CFR Part 1001, excluded persons and entities may not be paid, directly or indirectly, by federal health care programs for items or services they furnish, order, or prescribe. That risk extends beyond employed clinicians. It can include contractors, temporary staff, vendors, billing support, and other downstream parties whose work is connected to federally reimbursable care.
Organizations also commonly screen against the General Services Administration's System for Award Management (SAM), which includes debarment information relevant to federal contracting and grants. Some organizations also review state Medicaid exclusion lists, since state program requirements can create additional obligations.
Why are credentialing and exclusion screening different?
The two processes overlap in one important way: both are part of a sound compliance infrastructure. But they answer different questions.
- Credentialing asks: Is this person qualified and authorized to perform the work?
- Exclusion screening asks: Is this person or entity prohibited from participating in federal health care programs?
A practitioner may be fully licensed and professionally qualified but still be excluded. Likewise, a person may pass an exclusion screen and still fail credentialing because of an expired license, inadequate training, or missing privileges.
That is why relying on credentialing alone does not satisfy exclusion screening expectations. A license verification or payer enrollment check is not the same as confirming that the person is absent from the LEIE or other applicable exclusion databases.
Why does confusing the two create compliance risk?
1. It can lead to payment for excluded services
The OIG has long advised providers to screen employees and contractors against the LEIE to avoid employing or contracting with excluded parties. If a federal health care program pays for items or services furnished by an excluded individual or entity, the organization may face civil monetary penalties and may have to repay amounts received. The risk can apply even when the excluded person is not furnishing direct patient care.
For example, liability can arise where an excluded person provides administrative or management services that are integral to claims submitted to a federal program. The OIG has addressed this in its Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs.
2. It can create False Claims Act exposure
If claims are submitted for services connected to an excluded individual or entity, those claims may be alleged to be false or fraudulent. In practice, exclusion failures often become broader billing and overpayment problems. Once identified, organizations should assess potential overpayments and refund obligations promptly.
The Affordable Care Act's 60-day overpayment rule, codified at 42 CFR 401.305 for Medicare Part A and Part B, requires reporting and returning identified overpayments within 60 days of identification or by the date any corresponding cost report is due, if applicable.
3. It can weaken audit readiness
When organizations combine credentialing and exclusion screening into a single undocumented workflow, important details are often missed:
- Who was screened
- Which databases were used
- When the screening occurred
- How potential matches were resolved
- Whether re-screening happened on schedule
During an audit or investigation, the inability to show a consistent and documented screening process can be as problematic as the missed screen itself.
How often should exclusion screening be performed?
The OIG has recommended monthly screening of employees, contractors, and vendors against the LEIE. Monthly screening is widely treated as the compliance best practice because the LEIE is updated regularly, and screening only at hire leaves long gaps in which an exclusion could occur.
Screening should begin before an individual or entity starts work or is engaged, and then continue monthly thereafter. Organizations should define in policy which categories are screened, such as:
- Employees
- Licensed practitioners
- Temporary and agency staff
- Independent contractors
- Billing companies and coding vendors
- Referral management and prior authorization vendors
- Durable medical equipment or pharmacy-related vendors, where applicable
State Medicaid exclusion lists may have their own expectations. A practical program identifies all applicable federal and state sources and assigns clear responsibility for each one.
What should a compliant process look like?
Keep credentialing and screening as linked but separate controls
A strong process recognizes that these workflows support each other without replacing each other.
- Credentialing file: licenses, education, board status, privileges, payer enrollment, and related qualifications
- Exclusion screening file or log: databases checked, date of search, search terms used, result, and resolution of any potential hit
Document onboarding and monthly monitoring
Policies should specify:
- Who must be screened
- Which lists are checked
- When screening occurs
- Who reviews possible matches
- What happens if a confirmed match is found
If a potential match appears, the organization should use identifiers such as full name, date of birth, NPI, address, or other available data to determine whether it is a true match before taking action.
Respond quickly to confirmed exclusions
If screening identifies a confirmed exclusion, the organization should immediately evaluate whether the person or entity provided items or services payable by a federal health care program. That typically triggers a broader compliance review, including claim impact analysis, legal assessment, repayment review, and corrective action.
What are common mistakes organizations make?
- Assuming licensure checks cover exclusions. They do not.
- Screening only providers. Exclusion risk can extend to non-clinical staff, contractors, and vendors.
- Screening only at hire or onboarding. Ongoing monthly screening is the safer and recommended approach.
- Failing to keep evidence of screening. If it is not documented, it is difficult to prove it happened.
- Not reviewing state requirements. State Medicaid exclusion databases may add separate obligations.
What is the key takeaway for compliance officers?
Credentialing and exclusion screening serve different compliance purposes, and both matter. Credentialing helps confirm that a person is qualified to provide services. Exclusion screening helps ensure the organization is not employing, contracting with, or paying a person or entity barred from federal program participation. A compliant program treats them as distinct controls, documents both carefully, and performs exclusion screening at onboarding and monthly thereafter.
When organizations blur the line between the two, they create avoidable risk: unsupported staffing decisions, missed exclusions, repayment exposure, and preventable audit findings. Keeping the processes separate is a simple but important way to strengthen healthcare compliance.