The CMS Preclusion Blind Spot: How One Bad Provider Can Hide Behind a Dozen Good Numbers

Medicare has a list of providers who should never get paid again. An OIG audit found the government’s own system keeps losing track of who belongs on it.

Every health plan, hospital, and staffing agency that touches Medicare is expected to answer one simple question every month: is this prescriber or provider allowed to bill us? The answer should come from a short set of federal databases. In practice, it comes from reconciling several lists that don’t talk to each other, don’t update on the same schedule, and — according to a 2026 Office of Inspector General (OIG) audit — don’t always agree on who is actually excluded.

That gap isn’t theoretical. It let plans pay $72 million to providers who had already been excluded from federal health programs or convicted of felonies CMS itself had flagged as “detrimental” to Medicare.

What the CMS Preclusion List actually is

CMS’s Preclusion List is a database of providers, suppliers, and prescribers who are barred from receiving payment for services delivered under Medicare Parts C (Medicare Advantage) and D (prescription drugs). A provider lands on it for one of three reasons:

• Exclusion from a federal health care program;
• Conviction of certain felonies within a look-back period CMS considers relevant; or
• Revocation — or eligibility for revocation — from Medicare enrollment for conduct CMS determines is detrimental to the program’s best interest.

Who enforces the CMS Preclusion List

The Preclusion List isn’t self-policing. Federal regulations prohibit Part C and Part D plans from paying for services or prescriptions tied to a precluded provider. CMS implemented the requirement on January 1, 2019, and plans had to start rejecting associated claims by April 1, 2019. Oversight of how well that’s working falls to the OIG.

How the CMS Preclusion List differs from the OIG Exclusion List

The CMS Preclusion List is separate from, and not inclusive of, the DHHS-OIG List of Excluded Individuals and Entities (LEIE). A provider can be missing from one and present on the other. Effective compliance means monitoring both lists every month — treating either one as a complete picture is the first way organizations get exposed.

Why the CMS list is genuinely hard to monitor

On paper, the list sounds straightforward. In practice, three structural quirks make it one of the harder data sets in healthcare compliance to track cleanly.

1. The CMS list identifies people differently than Medicare bills them

Medicare claims run on the National Provider Identifier (NPI) — the 10-digit number every provider must obtain and keep current. The Preclusion List, however, is built around the Taxpayer Identification Number (TIN). A single TIN can sit behind many NPIs, registered to different practice locations.

A TIN can be an individual’s Social Security number or an organization’s employer ID — and CMS treats each TIN as a wholly separate entity for preclusion purposes. If an organization’s TIN differs from its owner’s, CMS generally cannot preclude the organization over the owner’s conduct, unless the owner is personally excluded or enrolled the organization using false information.

2. Reporting depends on providers reporting themselves

Providers are required to report changes to their NPI registration — including events that should trigger revocation — within 30 days. The burden of disclosure sits with the provider, not with CMS. That structure creates an obvious incentive problem: the people most likely to have something to hide are the ones responsible for flagging it.

3. The pharmacy carve-out

Under current regulation, pharmacies that only fill prescriptions — rather than prescribe Part D drugs themselves — aren’t subject to preclusion at all. A pharmacy can appear on the Preclusion List and still be paid under Part D for filling a precluded prescriber’s prescription, because CMS has confirmed it lacks authority to block that payment under existing rules.

What the OIG Audit Found

The OIG’s review (Report A-02-24-01013) set out to identify vulnerabilities in CMS’s preclusion process, focused on providers whose NPIs were revoked from Medicare Parts A and B enrollment. It found three recurring failure modes.

Timing issues and errors

CMS can only begin precluding a provider after it discovers the excluding event — an exclusion, a felony conviction, or other disqualifying conduct. In practice, that conduct sometimes went unreported and undiscovered for years. Even after CMS identified it and moved to revoke or preclude, providers could appeal, adding further delay during which billing continued uninterrupted.

Organizations shielded by ownership structure

Unless an organization’s owner is personally excluded, or CMS can prove the owner used false information to enroll the organization, CMS generally does not preclude the organization for the owner’s felony conviction. Because the organization is a separate TIN, it stays off the list unless every NPI under that TIN is revoked — even when the owner is a known excluded individual. The audit noted owners can continue enrolling new entities under different NPIs and TINs, effectively evading the process. Part B rules allow CMS to revoke an organization based on its owner’s conduct; Parts C and D preclusion rules do not extend the same authority.

The pharmacy gap, confirmed by CMS itself

CMS confirmed to the OIG that, under current regulation, placement on the Preclusion List alone does not stop a dispensing-only pharmacy from being paid under Part D for filling a precluded prescriber’s prescription.

CMS did not preclude some revoked providers from receiving Part C and Part D payment. Plans paid $72 million for services tied to excluded providers and felony-convicted revoked providers during the audit period. CMS later precluded most of them — but not all organizations, and not pharmacies filling prescriptions written by precluded prescribers.

What this means for anyone monitoring the CMS Preclusion List

None of this is an argument against using the Preclusion List — it’s an argument for not treating it as sufficient on its own. The audit’s findings map directly onto the identifier gaps built into the system: NPI versus TIN, individual versus organization, prescriber versus dispenser. A monitoring program built around a single monthly download of one list will miss exactly the cases this audit surfaced.

Enterprise risk mitigation means tracking multiple, non-redundant sources every month — not just the Preclusion List, but also the DHHS-OIG Exclusion List (LEIE), the NPI registry, and DEA registration status for prescribers. Each catches something the others structurally cannot. ProviderTrust’s automated, ongoing monitoring is built on enhanced data verified against the primary sources and helps healthcare organizations keep their networks compliant and their patients safe. Book a demo with our team today.

Source: U.S. Department of Health and Human Services, Office of Inspector General, Report A-02-24-01013, “CMS’s Preclusion List Process Had Vulnerabilities That May Have Allowed Some Excluded or Convicted Providers to Continue Receiving Medicare Payments.” oig.hhs.gov/documents/audit/11934/A-02-24-01013.pdf