What the data says
Every number on this page was computed from the RosterProof unified exclusion dataset — the federal OIG LEIE plus 36 state and district Medicaid exclusion lists, resolved to NPIs against the CMS NPPES registry. These are analytical findings from the July 2026 edition; each is reproducible from the published dataset, and each carries its own honest caveat.
How this data is collected, matched and quality-checked: read the Methodology (PDF, 2 pages).
Even the exclusions that reach the federal list arrive late
For providers whose state exclusion later appeared on the federal LEIE (6,292 state-led cases), we measured the gap between the state's exclusion start and the LEIE's:
1,905 providers took more than a year. The gray bar is the share of active state exclusions absent from the LEIE entirely — see the federal gap, measured.
Even when state exclusions make it to the federal list, the median trip takes five months — a quarter take more than fifteen. Half never arrive.
Caveat: measured across NPI-verified matches appearing on both a state list and the LEIE — the survivors. Exclusions that never reach the LEIE are excluded by construction, so true federal visibility is worse than these numbers.
The specialty risk map
Active excluded providers per 10,000 registered providers of the same type (NPPES taxonomies, NPI-verified matches, minimum 5,000 providers per category):
1.6% of America's community hospice agencies are under an active exclusion somewhere — the highest rate of any provider category we track. Hospice, pain management, and labs at the top independently mirrors the federal enforcement pattern.
Caveat: NPI-verified matches only; categories are NPPES primary taxonomies; rates use the active-NPI registry as the denominator.
The serial-excludee window
One provider's trail, anonymized — nine states in three years:
The ten-month median between first and second state is the window where cross-state screening catches what single-state screening cannot — under ACA §6501, one state's exclusion is every state's problem.
Caveat: NPI-verified multi-jurisdiction matches; jurisdictions counted distinctly (federal counts once).
At least 1 in 340
1 in 340
actively-registered US individual providers is under an active healthcare exclusion that we have verified against the NPI registry — 21,639 of 7.37 million active individual NPIs.
Caveat: this is a floor. It counts only exclusions we can tie to an active NPI with registry-verified identity; most state exclusion records publish no NPI at all, so the true rate is higher.
Functionally permanent
Treat an exclusion as permanent unless proven otherwise. Fewer than one in twenty ever gets a published reinstatement, and those that do run a median five years.
Caveat: many sources publish no end dates by design — for those, an exclusion's end is observable only when the record leaves the source's list.
The state rate story
Raw counts crown the big states (California 23,166, Texas 11,892). Per 10,000 providers practicing in the state, the picture changes:
Caveat: a state's list includes some out-of-state providers, while the denominator counts providers practicing in the state — the ratio is directional, not exact. Full per-state view: the federal gap, measured.
Names change. NPIs don't.
6.5%
of matched excluded individuals carry a registered former, maiden, or other name in the NPI registry — 1,464 providers whom single-name screening can miss entirely. This is why RosterProof's matching includes a dedicated registered-alias tier: identity follows the NPI, not the spelling.
Caveat: counts only aliases formally registered in NPPES; informal aliases in state lists (a.k.a. annotations) are additional.
When excluded providers move
Time-ordering every multi-jurisdiction excludee's states reveals the corridors — and adjacency rules them. The Northeast triangle owns the migration map:
Providers excluded in the first state and later in the second (same NPI, ordered by exclusion dates). Median gap between a provider's first and second state: ~10 months — the window where cross-state screening catches what single-state screening cannot.
Excluded providers resurface one state over — six of the seven busiest corridors are inside the NY/NJ/PA triangle.
Caveat: corridor order reflects exclusion dates, which proxies but does not prove relocation order.
Excluded somewhere, practicing where nobody can see it
The actionable number. Take every provider we have proven is excluded right now (matched to a verified NPI), check where the national NPI registry says they currently practice, and keep the ones practicing in a state that has not excluded them. A clinic or health plan in that state, screening against its own state list, sees a clean provider.
2,260
A real one, initials only. Dr. K.B. is a family-medicine physician. Eight states carry an active exclusion on her — California, Colorado, Kansas, Michigan, Missouri, New Jersey, New York and Pennsylvania — the first in March 2023, the latest in September 2025. The national NPI registry says she practices in Tennessee. Tennessee has not excluded her, and she is not on the federal list either. A Tennessee Medicaid plan that checks its own state list and the federal LEIE sees nothing. Under ACA §6501 every one of those eight exclusions is grounds for termination in Tennessee too.
How we count it — five steps, nothing clever:
- Active only. The excluding state has published no end date (or a future one) and still carries the record on its list. Reinstated or expired exclusions are out.
- Proven identity only. The record carries an NPI confirmed against the CMS NPPES registry. Name-only records are not counted — a name alone could be two people.
- Count excluding states. Federal lists don't count as a state. One state is enough; the "two or more" figure above is the subset.
- Look up where they practice now — the practice-location state on their NPPES record.
- Keep the mismatches. Practice state not among the excluding states.
Where they practice:
Live from the published dataset — recomputed weekly.
Caveats, so the number holds up: NPPES practice state is self-reported by the provider and can lag a move. "Has not excluded" means absent from that state's published list — several states (Florida among them) publish no usable list, so there is nothing for the provider to appear on. And this counts only providers we can pin to a verified NPI; roughly three quarters of all exclusion records are name-only and are not counted here, so the true figure is larger.
And what changes when they move? About 1 in 30 multi-state excludees appears under materially different surnames in different states — sometimes a legal name change, sometimes the states themselves misspelling the same person three different ways. Either way, name-based screening loses. Identity has to follow the NPI.
Honest boundary: same-NPI tracking is what exclusion-list data can prove — a provider who abandons their identity behind a new organizational NPI or corporate shell is invisible to this method. Detecting that requires ownership linkage, which we name as future work rather than claim.
People and companies
…and the companies dominate the categories that bill at scale: 100% of excluded hospice agencies and 94% of excluded labs are organizations, while license-driven exclusions are 99.5% individual — licenses attach to people.
When a company goes multi-state, it lands everywhere at once. Organizations are 4.8% of two-state excludees but 20.4% of four-plus-state ones — mass multi-state enrollments mean an excluded company shows up in many states nearly simultaneously.
Caveat: type shares among NPI-verified matches; category percentages use NPPES enumeration type (Type 1 person / Type 2 organization).
Zero person/company conflicts across all 25,206 registry-verified matches — the entity-type invariant held end-to-end. When we say a match is verified, the registry agrees about what kind of thing it is, every single time.
There's more in here
These findings came from the data itself — there's more to find. Program-integrity teams: if you have a question this dataset could answer, ask us — support@rosterproof.com. Or get the dataset and ask it yourself.