The Centers for Medicare & Medicaid Services (CMS) recently posted a database on its website that identifies individuals and entities whose Medicare billing privileges have been revoked under 42 C.F.R. § 424.535. For health care providers and suppliers that participate in Medicare, Medicaid, and other federal health care programs, this list is an important compliance tool. Regular screening can help organizations avoid hiring or retaining individuals whose revoked status may expose the organization to enrollment risk, payment disruption, audit exposure, and broader program integrity concerns.
I. What is a Medicare Revocation Action?
CMS’s revocation authorities are broad, can apply to W-2 employees and contractors, and can lead to rejections or adverse actions across multiple programs. CMS’s revocation authority under 42 C.F.R. § 424.535 permits the agency to revoke Medicare billing privileges for a range of reasons, including:
- False or misleading information on enrollment applications;
- Felony convictions;
- License suspensions or revocations;
- Certain ownership or managing control issues; and
- Other conduct CMS determines warrants revocation under its enrollment rules.
Because the database identifies persons and entities whose Medicare billing privileges have been revoked, it gives providers and suppliers a direct means of checking whether a current or prospective worker, contractor, owner, or affiliated person has already been flagged by CMS.
II. What is the Difference Between an Exclusion Action and a Revocation Action?
Below is a concise chart distinguishing exclusions from revocations.
A. Difference Between Exclusions and Revocations
| Feature | Exclusion Actions | Revocation Actions |
|---|---|---|
| Definition | A Medicare exclusion is an Office of Inspector General (OIG) imposed, or statutorily required bar, preventing an individual or entity from participating in Medicare, during which Medicare will not pay for items or services furnished by the excluded person, absent reinstatement. | A Medicare revocation is CMS’s action revoking a currently enrolled provider’s or supplier’s Medicare enrollment and billing privileges, with termination of any corresponding provider or supplier agreement. |
| Purpose | Simply put, there are two primary purposes for the OIG exclusion program. First and foremost, the OIG exclusion program protects federal health benefit program beneficiaries from individuals and entities whose conduct has resulted in their exclusion from participation in Medicare and other federal programs. Second, the exclusion program protects the federal fisc from potential fraud that may be committed by excluded parties. | The CMS revocation program is intended to protect the Medicare program and its beneficiaries by revoking the billing privileges of providers and suppliers: (1) that do not meet Medicare’s enrollment requirements; (2) pose program-integrity risks to the Medicare program; or (3) have been found to be unfit to be authorized to have Medicare billing privileges. |
| Size of Database | Approximately 85,000 individuals and entities are currently listed on the OIG’s List of Excluded Individuals and Entities (LEIE). | Approximately 7,400 individuals and entities are currently on CMS’s revocation database. |
| Length of Adverse Action | Mandatory exclusion actions impose a 5-year minimum period of exclusion. Depending on the facts, the period of a mandatory exclusion imposed can range from 5 years to lifetime exclusion. Permissive exclusions do not have a set minimum period of exclusion. Depending on the basis for permissive exclusion, the duration can last from a period of months to 3 years. | Medicare revocation actions can result in a re-enrollment bar that can last from 1 to 10 years, depending on the severity of the reason for revocation. However, if a provider is being revoked for a second time, CMS may impose a re-enrollment bar of up to 20 years. |
| Access | The OIG exclusion list (LEIE) is available to the public. However, providers must also review approximately 44 state Medicaid exclusion databases in order to properly screen an individual or entity. | Effective February 2026, CMS has made its Medicare revocation database publicly available for the first time. |
| Potential Penalties | The improper employment or engagement of an individual or entity on the OIG exclusion list can result in overpayments, significant Civil Monetary Penalties, and a variety of other administrative, civil, or criminal actions. | A Medicare provider that employs a physician who has been revoked by CMS could conceivably face a revocation of its own Medicare enrollment and billing privileges if the employment violates CMS’s affiliation rule. A more serious situation can arise if the services of a revoked physician are improperly billed under the NPI of a Medicare credentialed, participating physician. Depending on the facts, the government could pursue civil and/or criminal charges against the entity and individuals involved in the fraudulent billing scheme. |
III. Why is Screening the CMS Revocation Database Required?
A. Hiring or Retaining a Revoked Individual Can Create Medicare Enrollment Risk
A provider or supplier that knowingly employs, contracts with, or otherwise affiliates with a person whose Medicare billing privileges have been revoked may create serious compliance concerns. CMS enrollment rules require providers and suppliers to maintain accurate enrollment information and avoid arrangements that undermine program integrity. If a revoked individual is placed in a position involving billing, enrollment, ownership, or managerial control, CMS may scrutinize the organization’s own participation in Medicare. In practice, this can lead to:
- Enrollment denial;
- Revalidation problems;
- Re-enrollment restrictions;
- Payment suspension or delay; and
- Revocation proceedings against the organization itself.
B. A Revocation Action Can Signal Broader Program Integrity Problems
A Medicare revocation action is often not an isolated event. It may reflect:
- Prior false claims or enrollment statements;
- Fraudulent or abusive billing conduct;
- Criminal or civil enforcement activity;
- Professional license discipline; or
- Other serious compliance breakdowns.
Screening the revocation database helps an organization identify individuals whose prior conduct suggests heightened risk, even if that conduct does not automatically bar employment. It is therefore a useful component of a risk-based due diligence program.
C. Revocation Screening Supports Medicaid and Other Federal Program Compliance
Although the database concerns Medicare revocations, the underlying risk is not confined to Medicare. Providers and suppliers that participate in Medicaid, CHIP, TRICARE, the Veterans Health Administration, or other federal programs should be concerned that a revoked individual may also pose compliance risks to those programs. Reasons include:
- State Medicaid enrollment and participation rules may incorporate federal program integrity concepts;
- Medicaid managed care plans often require screening and disclosure of adverse credentialing history;
- Federal and state payors may treat revocation as a red flag in credentialing or contracting; and
- Employers may face contract or disclosure obligations triggered by revocation status.
D. Failure to Screen for Revocations Can Lead to False Certifications
Many enrollment and contracting documents require certifications about the organization’s owners, managing employees, agents, and contractors. If a provider fails to identify that a person on its roster has had Medicare billing privileges revoked, the organization may later make inaccurate statements in:
- Enrollment applications;
- Revalidation submissions;
- Credentialing packets;
- Contracting representations; or
- Internal compliance attestations.
That creates exposure not only under CMS rules, but potentially under the False Claims Act, 31 U.S.C. §§ 3729–3733, if false statements are tied to claims, payments, or government certifications.
E. Revocation Screening Is a Low-Cost, High-Value Compliance Measure
Compared with the potential cost of an enrollment action, the screening process is simple and inexpensive. Regular screening can be built into:
- Pre-employment and pre-contracting checks;
- Monthly exclusion and sanctions screening;
- Credentialing and recredentialing workflows;
- Revalidation processes; and
- Ownership and managing control due diligence.
IV. Recommended Screening Practices
Providers and suppliers should consider adopting a written process that includes:
- Step #1: Pre-hire screening. Medicare providers and suppliers should check all prospective employees, contractors, owners, managers, and vendors before bringing them on board or engaging them as a vendor.
- Step #2: Monthly rescreening. Medicare providers and suppliers should recheck existing personnel, contractors, and vendors at least monthly.
- Step #3: Scope expansion. The best practice is for providers and suppliers to screen all medical directors, locum tenens, staffing agency personnel, and subcontractors with billing or administrative access.
- Step #4: Documentation. Providers and suppliers should retain screenshots, search results, and date-stamped records of each search.
- Step #5: Escalation protocol. If a violation (employment of a revoked individual or entity) is identified, providers and suppliers must conduct a compliance review and implement remedial measures to ensure that no future violations occur.
- Step #6: Corrective action. Medicare providers and suppliers who have identified a violation must conduct a complete review of the employment relationship to determine if an overpayment has occurred. The provider or supplier must immediately repay any monies owed to a federal health benefit program resulting from the violation. We recommend that you contact experienced health law legal counsel for assistance in identifying and meeting your obligations to an affected payor.
Because the CMS revocation database is now public, it should be integrated into existing compliance screening routines with minimal burden. That’s exactly what we have done at Exclusion Screening. CMS’s revocation database is now part of our monthly screening process.
V. Practical Takeaways
Providers and suppliers should screen CMS’s revocation database monthly because a revoked individual can create downstream risk across enrollment, reimbursement, contracting, and compliance. Regular screening helps organizations:
- Identify risky hires before they become a problem;
- Prevent inaccurate enrollment and certification statements;
- Support Medicaid and other federal program compliance;
- Strengthen internal compliance controls; and
- Demonstrate good-faith diligence in the event of a government inquiry.
VI. Conclusion
CMS’s public revocation database is a practical tool that providers and suppliers should use as part of their ongoing compliance program. While a revocation does not automatically mean that every relationship with the affected individual must end, it does warrant prompt review, escalation, and risk assessment. For organizations participating in Medicare, Medicaid, and other federal health care programs, regular screening is a prudent and defensible compliance practice. For additional information, give us a call. Exclusion Screening can be reached at: 1 (800) 561-0798.
