The Screening Vendor's False Negative
A 60-provider physician network outsources exclusion and sanction screening to a vendor that matches against the LEIE and SAM monthly. The contract states the vendor will match on name plus at least one secondary identifier and will report any hit within 24 hours. During an internal review, the compliance director discovers that a nurse practitioner who joined 8 months ago has a common name and was never flagged, despite a SAM record with a matching date of birth that has existed for 14 months. The vendor's monthly reports show zero hits for all 60 providers for 8 consecutive months, which the director now considers implausible. The network's compliance plan cites the vendor as the control for sanction screening.
1. Assess the compliance risk and identify what the director must verify about the vendor's performance.
Read the worked answer
Zero hits across 60 providers for 8 months is a warning sign, not reassurance - common names generate false positives routinely, so a true zero suggests the matching logic or the data feed is broken. The director must verify: (1) whether the vendor is actually matching on a secondary identifier or only on name; (2) whether the SAM extract is current and whether the vendor covers state Medicaid exclusion lists and OIG LEIE; (3) whether the 24-hour reporting obligation was met for any hits the vendor's own logs show; (4) whether the zero-hit reports are genuine or a formatting artifact. Request the vendor's matching logs and a sample reconciliation. Independently re-screen all 60 providers in-house to establish the true hit rate. The core governance failure is treating a vendor as the control: the network retains accountability, so the plan should describe network-side verification and periodic vendor audit, not delegation. Document the finding, the verification steps, and the remediation plan with dates and owners.
2. The flagged nurse practitioner has been billing for 8 months. What is the immediate sequence of actions?
Read the worked answer
First, confirm the SAM record is a true match - same individual, not a namesake - using date of birth, NPI, and any available identifier. If confirmed, determine whether the individual is excluded from federal healthcare programs and, if so, remove her from billing and patient-care duties immediately, pending HR and legal review. Second, preserve records of her duties, schedule, and claims. Third, quantify the exposure: claims she furnished or directed over 8 months. Fourth, evaluate overpayment return and self-disclosure with counsel, recognizing that the network's reliance on a defective vendor control does not excuse the billing of excluded-individual services. Fifth, remediate the control: bring screening in-house or add independent verification, run a full look-back across all providers and the prior 12 months, and revise the compliance plan to reflect network-side oversight. The director should also assess whether the vendor's failure is a breach and whether other clients are affected, but the network's own remediation cannot wait on that.