INTERNATIONAL TRADE LAW
Sanctions Compliance for Healthcare Organizations
Sanctions compliance for a healthcare organization means screening everyone you pay, employ, or contract with against the federal restricted-party lists — and refusing prohibited dealings before they happen. In practice that splits into two separate legal regimes that healthcare compliance officers routinely confuse: OFAC economic sanctions, which are about national security, and healthcare program-integrity exclusions, which are about fraud and abuse. Both require screening, both carry serious penalties, and neither forgives a good-faith mistake.
Two Different Regimes, Two Different Lists
The single most useful thing a healthcare compliance team can do is stop treating “sanctions” and “exclusions” as one obligation. They come from different agencies, rest on different laws, and trigger different penalties.
OFAC — the Treasury Department’s Office of Foreign Assets Control — administers economic sanctions rooted in national security and foreign policy. Its core tool is the Specially Designated Nationals (SDN) list. Dealing with an SDN is prohibited for every U.S. person, in every industry, on a strict-liability basis: intent does not matter.
The healthcare exclusion lists are different. The HHS Office of Inspector General (OIG) maintains the List of Excluded Individuals and Entities (LEIE), and the General Services Administration runs the broader exclusion database inside SAM.gov. These bar a person or entity from participating in Medicare, Medicaid, and other federal health care programs because of fraud, abuse, or program violations — not national security.
| List | Agency | Purpose | Who must screen |
|---|---|---|---|
| SDN list | OFAC (Treasury) | National-security / foreign-policy sanctions | All U.S. persons, strict liability |
| LEIE | HHS-OIG | Excludes individuals/entities from federal health programs | Any provider billing Medicare/Medicaid |
| SAM.gov exclusions | GSA | Government-wide debarments and exclusions | Federal contractors and grantees |
| State Medicaid exclusion lists | State agencies | State-level program exclusions | Providers in those states |
Why Both Matter to a Provider
A provider that bills federal health programs cannot be paid for any item or service furnished by an excluded individual or entity — and that prohibition reaches beyond direct patient care to salaries, administrative staff, and contractors. Employing an excluded person can itself trigger civil monetary penalties and an obligation to repay amounts already received. Because OIG can add or reinstate people at any time, OIG’s own guidance recommends screening the LEIE monthly, not just at hire.
OFAC exposure is rarer in a domestic clinic but real in any organization that touches cross-border activity: international patients, foreign medical-device or pharmaceutical suppliers, research collaborations, or charitable medical missions in sanctioned regions. Because OFAC liability is strict, a single payment to a blocked supplier can be a violation even if no one knew.
Building the Program: OFAC’s Five Components
OFAC’s 2019 Framework for OFAC Compliance Commitments is the recognized blueprint, and it maps cleanly onto a healthcare compliance program. OFAC looks for five components:
- Management commitment — senior leadership funds and backs the program.
- Risk assessment — identify where sanctions and exclusion exposure actually sits (vendors, staffing agencies, foreign suppliers, telehealth across borders).
- Internal controls — written policies and screening procedures that catch prohibited parties before money moves.
- Testing and auditing — periodic independent review that the controls actually work.
- Training — role-specific education for credentialing, procurement, and finance staff.
A healthcare organization can fold exclusion screening into the same five-part structure it already uses for its broader compliance plan, rather than running a parallel system.
What Non-Compliance Costs
The penalties differ by regime. For OFAC violations, the civil maximum per violation is, as of 2026, the greater of roughly $377,700 or twice the value of the transaction, and that statutory cap is adjusted for inflation every January. On the healthcare side, employing or contracting with an excluded person can mean repayment of federal funds plus civil monetary penalties under the Civil Monetary Penalties Law, and continued violations can themselves lead to the provider’s own exclusion.
Voluntary self-disclosure cuts OFAC exposure sharply — in a non-egregious case it roughly halves the base penalty — which is why a real program with documented screening is worth far more than its administrative cost.
A Practical Screening Routine
- Screen every new hire, contractor, vendor, and ordering or referring provider against the LEIE, SAM.gov, and applicable state Medicaid lists before onboarding.
- Re-screen existing staff and vendors monthly against the LEIE.
- Add OFAC SDN screening for any party tied to cross-border payments, foreign suppliers, or international programs.
- Keep a dated record of each screen and its result — documentation is your defense.
- Route any potential match to a named decision-maker before payment, and pause the transaction until it is cleared.
For the mechanics of matching names and clearing hits, see our guide to sanctions screening, and for managing supplier exposure specifically, the sanctions vendor risk management checklist.
Frequently Asked Questions
Is OFAC screening the same as OIG exclusion screening?
No. OFAC’s SDN list enforces national-security sanctions on a strict-liability basis and applies to all U.S. persons. The OIG LEIE and SAM.gov exclusion lists bar participation in federal health programs for fraud and abuse reasons. A complete healthcare program screens against both.
How often should we check the OIG exclusion list?
OIG guidance recommends monthly screening of the LEIE, because individuals can be excluded or reinstated at any time and federal program payment is prohibited for any item or service an excluded person furnishes.
Does OFAC liability require intent?
No. OFAC sanctions violations are strict liability — a prohibited transaction can be a violation even if your organization did not know the counterparty was sanctioned, which is why screening before payment is essential.
What happens if we employ an excluded individual?
The organization generally cannot be reimbursed for items or services that person furnished, may have to repay amounts already received, and can face civil monetary penalties — even if the person never provided direct patient care.
Healthcare organizations sit at the intersection of two screening regimes, and the strict-liability one leaves no room for a good-faith excuse. Reidel Law Firm builds and reviews sanctions and exclusion-screening programs for a predictable flat fee: get a flat-fee compliance memo before your next audit.
