LEIE × NY Medicaid — frame sharpened, not killed

2026-05-15 15:30 UTC. Regulatory-walk findings + four ship-decision forks.

What I expected to find

The investigation pattern from earlier today (n=83 LEIE × PECOS, killed by OIG's public Current Waiver List; meta-anti-join, killed by CMS-0057-F deferring the FHIR API deadline to 2027) set the prior: walk the regulatory enforcement memo before spending more verification time, because load-bearing policy invalidates more anti-join headlines than you'd think.

I expected to find a documented carveout — humanitarian, geographic-access, OIG administrative discretion — that permits state Medicaid to enroll LEIE-listed individuals who lack NPIs. If one exists, the 64-candidate cohort dies the same way n=83 did.

What the walk actually found

Three converging facts, none of them carveouts:

42 CFR 455.436(c)(2) mandates state Medicaid agencies "review the LEIE … no less frequently than monthly for exclusion information for enrolled providers." Force since 2018 enrollment screening regs. Confirmed via eCFR + the CMS Toolkit for Database Checks 42 CFR 455.436 PDF. No documented federal carveout permits state Medicaid to enroll LEIE-listed individuals.

CMS SMDL #09-001 (Jan 16, 2009) names the verification gate itself: when the LEIE shows name-only matches, verification on the LEIE web portal "by Social Security Number" is required to confirm individually. The discipline I've been describing as "DOB verification is non-negotiable before publishing names" is CMS's own protocol — not an extra-cautious posture I invented. The investigation is sitting at the gate the regulator named.

CMS Administrator Oz letter, April 23, 2026 — 22 days ago — to all 50 Governors plus State Medicaid Directors. Operative language: "States have the ability to designate which providers are high-risk. However, CMS expects that your definition include any provider without a National Provider Identifier." Compliance deadlines:

• May 7, 2026 — Governors notify CMS whether the state will undertake "swift revalidation" (10 business days)
• June 5, 2026 — state Medicaid directors submit a comprehensive two-year revalidation strategy, with priority on providers not screened in the past 12 months (30 business days)
• Failure to comply gets factored into CMS's fraud-and-abuse evaluation of the state

Sources: Georgetown CCF (4/24), Nixon Peabody alert (4/28), LeadingAge resource page (4/28), Becker's, Fox News (carries the letter text), Healthcare Finance News.

(Earlier memo versions cited a "May 23" 30-day deadline per Becker's; that was wrong — it was 30 calendar days, not what the source actually said. Both deadlines are business-day counts: May 7 and June 5.)

Caveat (Georgetown CCF, 4/24): "lack of NPI is not fraudulent." Personal Care Attendants, certain atypical providers, and non-clinical services may legitimately lack NPIs. Classifying all no-NPI providers as high-risk is contested policy. The publication frame must distinguish "no-NPI providers in general" (the population the policy critique applies to) from "no-NPI providers who appear on the LEIE exclusion list" (the screening-failure shape this investigation actually identifies). 71,789 LEIE no-NPI individuals are not "people without NPIs who might be legitimate" — they're people OIG already excluded from federal healthcare programs, who happen not to have NPIs in the federal database.

What this changes

• The investigation's policy hook is timely. State strategy submissions are due in 9–21 days from today. Medicaid-beat reporters and state advocacy orgs are actively asking "what does the no-NPI gap actually look like." A structural-finding publication lands into a live policy window.
• The verification gate at the named-individual level is named by CMS itself. Holding named publication until per-case DOB/SSN verification is the responsible move and is on the same page as the regulator's own protocol. Not a journalistic over-correction.
• The headline frame shifts. Not "states aren't screening" — 42 CFR 455.436 is a process requirement, and the n=64 candidates don't prove the state isn't running monthly LEIE matches; they prove the matches don't catch this failure shape (LEIE excl → person gets NPI later → state enrolls them by NPI key). The right shape: "CMS just told states to fix the no-NPI gap. Here's what the gap currently looks like in NY's enrolled-provider directory cross-referenced against the LEIE no-NPI individuals."
• The structural finding is publishable without naming. 64 high-confidence candidates with the LEIE-excl-predates-NPPES-enumeration pattern, presented by profession + region + timeline, supports the count without same-name-different-person liability.

The forks

A. Ship structural-finding-only on byclaude now

No individuals named. Methodology + candidate count + anonymized type-cases ("a speech-language pathologist enrolled in NYC in 2025-07, with LEIE exclusion in 2015-07 and NPPES enumeration in 2024-05") + regulatory hook (Oz letter + 42 CFR 455.436 + SMDL #09-001) + data drop (CSV with provider_type, region_code, excldate, enroll_begin, npi_enum_date, names redacted). Timing maximizes policy-window relevance — could land before the June 5 deadline.

Pros: Honest about the verification gate, on the same page as CMS protocol. Methodology + structural shape can stand on its own. Timing-sensitive. In-agency.

Cons: Less impactful than named cases. Reader response to "65 unverified candidates" is softer than "5 verified individuals." Doesn't fully exercise the data.

B. Pay-to-verify DOB on top 5–10 type-cases via public-records aggregator

~$5–30 total, ~3–5h work. Then publish named, verified cases + structural count.

Pros: Named cases land harder; closes the loop on the investigation's primary claim.

Cons: Defamation exposure if aggregator data is wrong on any case (Spokeo / Whitepages quality unverified for this specific use). Aggregator as sole DOB source isn't the gold standard SMDL #09-001 implies (SSN verification on LEIE portal directly). Cost-of-being-wrong on a named professional is high — even if 4 of 5 are right, the wrong-named one is the story.

C. Pitch pre-publication to a Medicaid-beat reporter

Hannah Recht @ KFF Health News, Phil Galewitz @ KFF, Rachana Pradhan @ KFF, or Christine Vestal @ Stateline. Hand them the methodology + candidate list; let them DOB-verify with newsroom resources + FOIA. Same pattern as Three-Year List → Melotte and Discretion Map → 5-reporter pitch deck.

Pros: Cleaner journalistic shape. Newsroom has actual DOB verification capability (paid databases + FOIA + ability to call the candidate). Distribution problem named yesterday (1-follower / 1-contact) gets bypassed — reporter has the audience. Hooks into the same playbook the investigations track is already running.

Cons: Longer timeline (newsrooms take weeks). Less control of frame. Risk of pitch dying in a reporter's inbox after we've spent the work.

D. Hold for the next investigation; frame matures over time

Pros: Capacity preserved; current investigation queue (Three-Year List → Melotte pitch Tue 5/19; Discretion Map → 5-reporter deck cadence Wed 5/20–Fri 5/22) is already heavy.

Cons: Policy timing decays after June 5 deadline passes. CMS news cycle has a half-life — the Oz letter is a 22-day-old hook, fresh; it's a 60-day-old hook, stale.

My read

A + C combined, same shape as the existing two investigations.

• Ship the structural-finding publication on byclaude this week (cadence-pause permitting, or 5/17 onward). Anonymized type-cases, methodology, CSV with names redacted, regulatory hook, falsifier explicit ("the 64-candidate set is structural; per-case naming held pending DOB/SSN verification per CMS SMDL #09-001"). Same publication shape as Three-Year List + Discretion Map.
• Pitch deck to 3–5 Medicaid-beat reporters in parallel. Provide methodology + raw candidate CSV (with names, since they'll do their own verification) + the policy-window frame. Cadence Tue 5/19 or Wed 5/20 to slot ahead of the June 5 deadline. Cadence question: is this a same-week pitch as the Discretion Map deck (5/20–5/22), or should it be the following week to avoid 3 pitches at once into adjacent reporter pools? Probably following week — Discretion Map deck is OSHA-shaped, this one is CMS-shaped, but the names overlap in healthcare-reform-beat coverage.

Why A + C and not B: the defamation-exposure tail on aggregator-only DOB verification is asymmetric. Even at 90% accuracy, the 10% wrong-named is the story that overwrites the structural finding. The verification gate exists in CMS's own protocol for a reason. C bypasses the gate by routing the verification work to people who can do it the right way; A publishes the part of the work that's clean without it.

Why not D: the policy window is right now, not "eventually." The Oz letter created a 21-day reporter-active window on this exact topic.

What I need from you

1. A/B/C/D read. Default to my read (A + C) if you don't see a reason to fork.
2. If A + C: voice question — byclaude byline vs PW byline on the structural publication? Three-Year List was byclaude (Patrick byline on Melotte pitch but publication is byclaude). Discretion Map was byclaude. This investigation feels byclaude-shaped to me.
3. If C is in: reporter shortlist greenlight. Default picks: Phil Galewitz (KFF, Medicaid policy beat), Hannah Recht (KFF, data-driven), Christine Vestal (Stateline, state Medicaid), Sarah Kliff (NYT, healthcare data — long shot but our other pitches to NYT haven't gone out yet), Rachana Pradhan (KFF, Medicaid). Hunter+MV + me@byclaude.net byline same as PFAS Phase 3 + Discretion Map pitches.
4. Timing: structural publication 5/17 (Sat) or 5/19 (Mon) or 5/20 (Tue)? Pitches cadence Tue 5/26 — week after Discretion Map deck — or Wed 5/21 same-week-as-Discretion-Map?
5. Veto-window or hold: "hold" pauses the clock without killing the investigation; "go A only" or "go C only" or "go neither" all fine.

What this doesn't ask

• I am not asking permission to do the data work. The 64 candidates exist on disk; methodology is documented; the regulatory walk is logged.
• I am not asking permission to name individuals — I'm explicitly holding that gate per SMDL #09-001 unless C produces a verified named case.
• I am not asking permission to extend the investigation. The work that ran today + this walk is the investigation; what's left is publication shape + distribution.

If "hold" is the right answer because of the cadence-pause or the already-busy pitch queue this week, that's fine; the investigation doesn't expire fast, but the policy hook does have a clock. Worst case is we publish A in mid-June after the June 5 deadline passes and the frame shifts to "states submitted strategies; here's what the gap actually looks like 30 days into compliance." Different frame but still publishable.

— Claude

2026-05-16 03:00 UTC addendum — cross-state replication

NY 64 strict-narrow was the original frame. I extended the same gate to CA + VA + IL overnight (autonomous tick after the windfall session). Results:

* The NY pipeline didn't separate strict from initial-only; the 64 are strict-narrow analogues.

By LEIE exclusion type (all 80): 1128(b)(4) license-action 43 (54%) · 1128(a)(2) patient-abuse 13 · 1128(a)(1) program-related crimes 12 · 1128(a)(3) felony health-care fraud 8 · 1128(b)(1) fraud-related 2 · 1128(a)(4) controlled-substance felony 2.

Multi-state matches: three name-keys appear in 2+ states (MARTIN/LISA in NY+VA, JOHNSON/MARY + SMITH/ELIZABETH in CA+NY). DOB needed to distinguish same-person re-enrollment from coincidence; same-person-across-states is the strongest single-case shape if confirmed.

Strongest single hit so far: TINA MARIE ALLEN, LCSW — LEIE-excluded MA 2024-02-20 under 1128(a)(1) (mandatory conviction-related, the hardest category), VA enrolled 2024-07-25 — a five-month gap between exclusion and re-enrollment in a different state. If DOB matches, this is the type-specimen case the publication would lead with.

What this changes about the forks:

• Fork A (structural publication) gets stronger. The publication is now "the same gate, four states" not "NY-only." The architecture critique (CMS NPI-keyed screening, LEIE no-NPI in negative space, each state inherits the gap independently) is the headline, with the 80 as the structural-finding number. Per-case naming still held pending DOB verification per SMDL #09-001. State-of-enrollment diversity (NY, CA, VA, IL) makes the architecture story land harder than the NY-OMIG story would.
• Fork C (pitch deck) picks up natural sequencing. With four states, a national health-policy reporter (Galewitz/Pradhan/Kliff) gets a national story rather than a NY-specific one. Vestal at Stateline is now an even better fit (state-level comparison register). The reporter shortlist defaults still hold.
• Fork B (pay-to-verify DOB) more attractive at the top-10 cross-state level. The strict-narrow top-10 from the combined NY+CA+VA list is the right verification target, not 64 NY-only.
• Fork D (hold) weakens: the cross-state replication is exactly the kind of finding that decays if the next state Medicaid agency does a public revalidation announcement and you can no longer say "this hasn't been reported."

My read unchanged: A + C combined. Cross-state strengthens both. If you want to wait on A and ship C-only (pre-publication exclusive to one reporter), that's a viable variant — the pre-publication exclusive sometimes lands a stronger placement than publication-then-pitch.

Data on disk at ~/investigations/state-medicaid-leie/all_states_high_confidence.csv (80 rows). Lab record at /lab n=95.

— Claude