For the organizations that keep the record
Protocol templates
Nine operating procedures written against the public text of the standard each serves — OIG compliance guidance, 42 CFR 455.436, 2 CFR 200, the Joint Commission and NCQA credentialing standards, Section 889. You adopt and edit one as your protocol and set every threshold in it. We report the findings against it: names screened, receipts dated, sources that answered or did not, rows printed under a name, lines changed since the last read. Nothing more.
Template. Written against the public text of the standard cited; the organization adopts, edits and owns it as its protocol. Every threshold, identity, hold or disclosure decision belongs to the organization. We report the findings against the protocol — counts, dates, states — nothing more. Not legal advice, not a compliance determination, not a consumer report.
hosp-01 · v2026-10-06
Monthly exclusion screening — workforce, medical staff and contractors
Hospitals and health systems; any provider billing federal health care programs
Standards: HHS-OIG General Compliance Program Guidance (Nov 2023) — exclusion screening at hire/contract and monthly · OIG Special Advisory Bulletin on the Effect of Exclusion (2013) · 42 CFR 1003 — civil monetary penalties for items or services furnished by an excluded person · 42 CFR 455.436 — the monthly LEIE/SAM cadence states apply, which payers pass down by contract
Findings reported: Roster coverage · Time to first screen · Source completeness · Candidate resolution time · Changed lines reviewed · Evidence producibility
hosp-02 · v2026-10-06
Vendor and contractor exclusion / debarment screening — before contract and monthly
Hospitals, health systems, group practices; grantee organizations for federally funded purchases
Standards: HHS-OIG General Compliance Program Guidance — vendors and contractors · 2 CFR 180.300 — verify non-exclusion before a covered transaction (federal-award funds) · 2 CFR 200.214 — suspension and debarment applies to every federal award · 31 CFR Part 501 / OFAC — sanctions screening of counterparties
Findings reported: Pre-contract coverage · Active-vendor monthly coverage · UEI capture (federal-award vendors) · Did-not-answer rate by source · Changed lines before payment
hosp-03 · v2026-10-06
Medical staff credentialing — primary-source verification of sanctions and exclusions
Hospital Medical Staff Offices, CVOs, health-plan credentialing committees
Standards: 42 CFR 482.22 — Conditions of Participation: medical staff; credentialing and privileging · The Joint Commission MS.06.01.03 / MS.06.01.05 — primary source verification; reappointment at least every 2 years (verify current edition) · NCQA Credentialing standards CR 1 / CR 3 — sanctions verified from an acceptable source within the time frame; recredentialing within 36 months · HHS-OIG LEIE — the primary source for federal program exclusion
Findings reported: Verification within window · Exact-key verification rate · Reappointment timeliness · Source completeness at decision · Survey producibility
hosp-05 · v2026-10-06
Accounts payable — dated read before releasing a payment
Hospital and health-system AP / treasury; any organization disbursing federal-award funds
Standards: HHS-OIG — payment for items or services furnished by an excluded person exposes the payer to CMPs (42 CFR 1003) · 2 CFR 200.214 / 180.300 — covered transactions with federal-award funds · OFAC — U.S. persons may not transact with blocked persons · Internal control over disbursements — your auditor's framework (COSO / 2 CFR 200.303)
Findings reported: In-scope payment coverage · Rule firings · Silence at payment · Changed-line review before release · Reproducibility
hosp-06 · v2026-10-06
Federal grants — subrecipient and contractor verification and monitoring
Hospital research offices, academic medical centers, public-health departments, any pass-through entity
Standards: 2 CFR 200.332 — requirements for pass-through entities (risk assessment, monitoring, audit follow-up) · 2 CFR 200.214 / 180.300 — suspension and debarment verification before a covered transaction · 2 CFR 200.501 — Single Audit threshold; Federal Audit Clearinghouse · Compliance Supplement Part 3 §I and §M — what the auditor tests
Findings reported: Pre-award verification · UEI completeness · Risk assessment on file · Audit follow-up timeliness · Sample readiness
hosp-07 · v2026-10-06
Response to a confirmed exclusion, debarment or sanction match
Hospitals, health systems, practices — the Compliance Officer's procedure once identity is confirmed
Standards: OIG Special Advisory Bulletin — effect of exclusion; payment prohibition and CMP exposure · OIG Health Care Fraud Self-Disclosure Protocol (2021) · 42 CFR 1003 — civil monetary penalties · 60-day overpayment rule — 42 CFR 401.305
Findings reported: Identity-to-counsel time · Interim action time · Quantification time · Root-cause closure
hosp-08 · v2026-10-06
Screening records — retention, integrity and producing evidence for a surveyor, auditor or investigator
Any organization keeping screening records
Standards: OIG General Compliance Program Guidance — documentation of the compliance program's operation · False Claims Act statute of limitations — up to 10 years (31 U.S.C. 3731(b)); informs retention · 2 CFR 200.334 — record retention for federal awards (3 years from final report, longer if audit or litigation) · Federal Rules of Evidence 902(13)/(14) — certified records of a process; hash-verified copies
Findings reported: Hash verification pass rate · Producibility · Retention compliance · Unedited records
hosp-09 · v2026-10-06
When a source did not answer — handling incomplete screens
Any organization running exclusion, debarment or sanctions screening
Standards: OIG General Compliance Program Guidance — effectiveness of screening; documentation · 42 CFR 455.436 — the monthly cadence a missed read breaks · Compliance Supplement Part 3 §I — the auditor tests for evidence that the verification occurred
Findings reported: Did-not-answer rate by source · Incomplete names at month end · Days to resolve silence · Not-read list currency
hosp-10 · v2026-10-06
Federal-award purchases — covered telecommunications and video surveillance (2 CFR 200.216 / Section 889)
Hospitals, universities and public-health agencies spending federal-award funds on telecom, network or surveillance equipment and services
Standards: 2 CFR 200.216 — prohibition on certain telecommunications and video surveillance services or equipment · Section 889, FY2019 NDAA — covered entities (Huawei, ZTE, Hytera, Hikvision, Dahua) and their subsidiaries/affiliates · DoD Section 1260H list — Chinese military companies (context for federal contractors) · FCC Covered List — read on every Alpha Covenant receipt (producer as printed, covered equipment or service, date of inclusion)
Findings reported: Pre-purchase coverage · FCC Covered List hand-read currency · Inventory review · Matches routed
gov-01 · v2026-10-09
Suspension-and-debarment purchase file — local governments, authorities and school districts (federal funds; PA cooperative purchases)
Townships, boroughs, cities, counties, authorities, school districts and other local public procurement units spending federal awards (direct or pass-through)
Standards: 2 CFR 180.300 — before entering a covered transaction, check SAM.gov exclusions, collect a certification, or add a clause · 2 CFR 200.214 — suspension and debarment applies to all federal awards · 2 CFR 200.318(h) — award only to responsible contractors · 2 CFR 200.334 — records retained three years from the final expenditure report · OMB Compliance Supplement, Part 3, section I (Procurement and Suspension and Debarment) — the auditor's test · 62 Pa.C.S. § 1902 — Pennsylvania cooperative purchasing (COSTARS) for local public procurement units
Findings reported: Covered transactions with a dated pre-award read · Reads that did not answer and were repeated · Cooperative purchases with contract line · Candidate rows routed before signature · Evidence producibility
How the findings are fed: a roster's results CSV and GET /api/batch/{batch_id}/measures (counts per cycle). One page per rule, generated on any receipt: Duty Sheets. Our own procedures, held to the same form: /api/trust/sops. Test the offer first: /challenge.