Written and maintained by CASRAI Editorial Board
Last updated
A federally funded institution — a hospital billing Medicare and Medicaid, a university operating under an NIH or NSF award, a health system that does both — cannot lawfully pay a vendor that is currently debarred, suspended, or otherwise excluded from participating in federal programs. Confirming that isn’t a one-time paperwork step performed at vendor setup and then forgotten. It’s two distinct, ongoing checks — a SAM.gov Exclusions search and an HHS Office of Inspector General List of Excluded Individuals/Entities (LEIE) search — that answer two different legal questions, and both need to be re-run on a defined cadence, not just performed once at onboarding.
This guide covers what each check actually verifies, why the obligation extends to vendors specifically (not just employees), who at a vendor needs to be screened, and a realistic screening cadence for a lab-equipment or medical-supply purchasing operation. For the rest of what to collect when a new vendor is added to the vendor master — W-9, business/entity information, insurance, banking verification, references — see Vendor Onboarding for Medical Supply Purchases: What Documentation to Request, which covers exclusion screening in a single checklist item. This page is the deeper dive on that one step.
Two different checks, two different legal questions
SAM.gov Exclusions is maintained by the General Services Administration (GSA) and covers federal procurement (FAR-based) and nonprocurement (2 CFR Part 180) debarment and suspension actions. A party listed there cannot be awarded, or participate as a lower-tier participant in, a federal contract, grant, or cooperative agreement. It absorbed the older Excluded Parties List System (EPLS) when GSA retired that system on November 21, 2012 and consolidated it into the System for Award Management. Debarment and suspension actions are reciprocal between the FAR procurement system and the 2 CFR Part 180 nonprocurement system — an exclusion recorded under either one blocks covered transactions government-wide, not just within the agency that imposed it.
The OIG LEIE is a separate list, maintained by HHS-OIG under the authority of Section 1128 of the Social Security Act (42 U.S.C. § 1320a-7). It covers a narrower but higher-stakes population: individuals and entities excluded specifically from participation in Medicare, Medicaid, and other federal health care programs. Exclusions fall into two categories — mandatory exclusions (for convictions related to program fraud, patient abuse or neglect, and related felony offenses) and permissive exclusions (discretionary, for a broader list of grounds such as license revocation or default on health-education-loan obligations). An institution that knowingly does business with an LEIE-excluded party can face civil monetary penalty exposure tied to every claim connected to that party, independent of any SAM.gov status.
The two lists overlap in coverage but are not the same database, aren’t maintained by the same agency, and don’t share a single search interface. A clean result on one does not clear the other. For a vendor with international ownership or sourcing, screening against the Treasury OFAC Specially Designated Nationals (SDN) list is the equivalent check on the trade-sanctions side — a third list, not a substitute for either of the two above.
Why this applies to vendors, not just employees
Institutions that receive federal awards are already bound by 2 CFR 200.214 (“Suspension and debarment”), which subjects recipients and subrecipients to the nonprocurement debarment and suspension regulations at 2 CFR Part 180. Those regulations restrict making federal awards, subawards, and contracts — the vendor relationship — with a party that is debarred, suspended, or otherwise excluded. The relevant threshold is defined at 2 CFR 180.220: a “covered procurement contract” is one awarded under a grant or cooperative agreement and expected to equal or exceed $25,000, any contract requiring the federal awarding agency’s consent regardless of dollar amount, and contracts for federally required audit services. A lab-equipment purchase order funded by a federal grant that crosses that dollar threshold is a covered transaction under this rule, full stop — whether or not the vendor’s own staff have ever been individually screened for anything.
2 CFR 180.300 sets out three acceptable ways to satisfy the verification obligation for a lower-tier covered transaction: checking SAM.gov Exclusions directly, collecting a signed certification from the vendor that it isn’t excluded, or adding an exclusion-related clause or condition to the purchase agreement. A SAM.gov search is the only one of the three that independently confirms the answer rather than relying on the vendor’s own representation.
For institutions that bill Medicare or Medicaid — which describes most hospitals and academic medical centers, regardless of whether a specific purchase was grant-funded — the LEIE obligation runs alongside the SAM.gov one and doesn’t depend on the $25,000 procurement threshold at all. Many institutions already run background screening on new employees as a matter of course but treat a new vendor relationship as pure paperwork — a signed W-9, a certificate of insurance, done. The same category of legal exposure attaches to a vendor as to an employee, and arguably more directly, since a vendor invoice traces straight back to program dollars. The parallel obligation on the people side of a research institution — screening principal investigators, sub-investigators, and research coordinators against the LEIE — is covered separately in OIG Exclusion List Screening for Clinical Research Staff and Investigators. Vendors are a distinct population from research staff and need the same discipline applied separately; screening your PIs does not screen your equipment supplier.
Who actually needs to be screened
- The vendor entity itself, under its exact legal name and any doing-business-as (DBA) name it operates under — screen by the name that will actually appear on the invoice and the vendor-master record, not just a brand name used in marketing.
- Disclosed principals and owners, where the institution’s onboarding process captures that information. This matters because a debarred individual or entity can resurface under a newly formed company with the same ownership; screening only the current entity name misses that re-emergence pattern entirely.
- A subcontractor the vendor uses to fulfill a covered order, if the institution’s award terms extend lower-tier coverage to that level — relevant mainly for larger equipment contracts involving installation, service, or integration work performed by a third party on the vendor’s behalf.
Individual sales representatives who simply call on the account generally aren’t the screening target; the contracting entity and its disclosed ownership are.
How to actually run the check
SAM.gov Exclusions is searched directly at SAM.gov’s Search Records / Exclusions module, by entity name, Unique Entity Identifier (UEI), or individual name. A result shows the exclusion type, the classification, the excluding agency, and the active/termination dates — enough detail to confirm whether a hit is current and whether it actually covers the transaction type in question.
The OIG LEIE is searched at oig.hhs.gov, either through the online search tool for a one-off lookup or by downloading the full LEIE database file, which HHS-OIG updates monthly, for a bulk re-screen of an entire existing vendor list at once. The downloadable file is the more practical option once a vendor master grows past a handful of names — running dozens of individual online lookups every screening cycle doesn’t scale, and a bulk match against the downloaded file does.
Neither list updates in real time in the way a live database query might imply. LEIE refreshes monthly; SAM.gov exclusions are added on a rolling basis as agencies process new actions. That update lag is exactly why a single check performed once, at onboarding, isn’t sufficient on its own — a vendor clean at onboarding can be added to either list at any point afterward.
Screening cadence: onboarding, then periodically
The federal rules described above require the check before entering a covered transaction; they do not specify a numeric re-screening interval for a vendor relationship that’s already active, which is why cadence for an existing vendor is a matter of institutional policy rather than a specific statutory number. In practice, two reference points make a defensible policy:
- At onboarding, before the first purchase order or payment — this part is non-negotiable and applies to every vendor entering the vendor master, not only ones expected to cross the $25,000 covered-transaction threshold on day one, since institutions rarely know in advance whether a relationship will grow past that line.
- Periodically thereafter, on a fixed, documented interval rather than an informal “we’d probably notice.” Tying the interval to LEIE’s own monthly refresh cadence is the most defensible approach for vendors connected to Medicare/Medicaid-billed purchases; many institutions run a lighter quarterly cycle for lower-risk, non-clinical vendors and reserve monthly re-screening for higher-risk categories.
Layer trigger-based re-screening on top of the fixed cycle: a contract renewal, a known change in vendor ownership, or an adverse-media flag on the vendor is each a reason to re-run both checks outside the normal schedule, not wait for the next cyclical pass.
What a match means, and what to do next
A name-based hit is not automatically a confirmed exclusion. Given how common many business and individual names are, both databases return false positives regularly — the correct first step on any hit is confirming identity using the additional detail the listing provides (address, specialty, exclusion type, dates), not acting on a bare name match alone.
Once a match is genuinely confirmed: stop future purchase orders and payments to that vendor immediately and escalate to compliance and institutional counsel before any further transaction. Costs charged to a federal award that connect to a debarred, suspended, or excluded party are typically unallowable and subject to disallowance or repayment, and missing exclusion-check documentation is itself a recurring finding area in a Single Audit — the absence of the check is treated as seriously as a confirmed hit that was never acted on. If the excluded status is discovered mid-relationship, after payments have already been made, the same escalation applies, plus an assessment of exposure on everything paid during the excluded period.
Documenting the screening
Keep a dated record of each check — a saved search result, an exported match report, or equivalent — for both the onboarding check and every periodic re-screen, not just an internal checkbox marked “done.” File it in the vendor record alongside the rest of the onboarding documentation described in the vendor onboarding checklist. An auditor reviewing a federal award reconstructs compliance from what’s on file, not from institutional memory of a check that was run but never recorded.
Frequently asked questions
What’s the actual difference between a SAM.gov exclusion and an OIG LEIE exclusion?
SAM.gov Exclusions, maintained by GSA, covers debarment and suspension from federal contracts, grants, and cooperative agreements generally, under the FAR and 2 CFR Part 180. The OIG LEIE, maintained by HHS-OIG under Section 1128 of the Social Security Act, covers exclusion specifically from Medicare, Medicaid, and other federal health care programs. They’re separate lists maintained by separate agencies; a vendor can appear on one, both, or neither.
Do we need to screen a vendor that only sells items never charged to a federal award?
If an institution can guarantee that literally none of a vendor’s purchases will ever be charged to a federal award and the institution doesn’t bill federal health care programs in connection with anything that vendor supplies, the specific debarment and LEIE regulations described here don’t formally attach to that relationship. Very few hospitals or universities can cleanly guarantee that segregation in practice, which is why most screen every vendor entering the vendor master rather than trying to track which purchase order ties back to which fund source.
How often should an existing vendor be re-screened?
There’s no single federally mandated number. A defensible approach ties the interval to LEIE’s monthly update cadence for higher-risk or clinically connected vendors, with a lighter quarterly cycle acceptable for lower-risk categories — the important part is a fixed, documented interval applied consistently, plus trigger-based re-checks on contract renewal or a known ownership change.
Does this apply to lab equipment specifically, or only to clinical billing?
It’s the funding source and the purchasing institution’s federal-program billing status that trigger the obligation, not the product category. A centrifuge, an analyzer, or any other piece of lab equipment purchased against a federal grant award, or purchased by an institution that bills Medicare/Medicaid, is squarely in scope — the same as any other covered purchase.
What if we already paid an excluded vendor before catching it?
Stop further payments immediately, escalate to compliance and institutional counsel, and have counsel assess the exposure on amounts already paid during the excluded period, including whether disclosure to the funding agency or HHS-OIG is warranted given the specifics of the case.
