If you hire in healthcare, someone has told you that you need a FACIS search. Fewer people can tell you what it checks, why there are three levels, or which one your roles need.
Here is the short version. FACIS is an exclusion and sanction search, not a criminal record check. It exists because employing an excluded individual can cost a healthcare organization far more than the hire was ever worth, and the level you run decides whether you catch a sanction from a board two states over or miss it.
Not sure which level your roles need? Send us your role titles and we will map each one to a level and come back the same business day. Get in touch.
What is FACIS?
FACIS stands for the Fraud and Abuse Control Information System. It is a database maintained by Verisys that aggregates debarments, sanctions, exclusions, suspensions, and disciplinary actions issued by federal and state agencies across all 50 states and the US territories. A single search runs against more than 5,000 federal and state sources, drawing on Verisys's 3,500-plus primary sources and 10 million records, refreshed every month.
A FACIS search asks one question: has this person or organization been barred, sanctioned, or disciplined by a body that matters to a healthcare employer? It is worth being clear about what it is not. FACIS does not tell you whether someone has a criminal record. It tells you whether a regulator has taken action. The two overlap, but neither substitutes for the other, which is why a FACIS search sits alongside a criminal background check rather than replacing it.
FACIS Level 1, Level 2 and Level 3 compared
All three levels cover the federal baseline. The difference is how far into state sources each one reaches.
| Source | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| OIG List of Excluded Individuals and Entities (LEIE) | Yes | Yes | Yes |
| Drug Enforcement Administration (DEA) | Yes | Yes | Yes |
| OFAC Specially Designated Nationals | Yes | Yes | Yes |
| Food and Drug Administration (FDA) | Yes | Yes | Yes |
| Medicare Opt-Out | Yes | Yes | Yes |
| Tricare | Yes | Yes | Yes |
| System for Award Management (SAM/GSA) | Yes | Yes | Yes |
| Department of Health and Human Services (HHS) | Yes | Yes | Yes |
| State Medicaid sanctions lists | Yes | Yes | Yes |
| State debarments and Attorney General sources | Yes | Yes | Yes |
| State licensing boards, state of residence | No | Yes | Yes |
| State Medicaid boards, state of residence | No | Yes | Yes |
| State licensing boards, all 50 states and territories | No | No | Yes |
| HEAT task forces and federal district Attorneys General | No | No | Yes |
Level 1 is the federal baseline plus state Medicaid and debarment sources: what a federally funded organization is expected to check, without state licensing boards.
Level 2 adds state licensing and state Medicaid boards, but only for the state the candidate lives in.
Level 3 extends state licensing board coverage to all 50 states and the territories, and adds HEAT task force and federal district sources.
Which level do you need?
It depends on how mobile your workforce is and how much risk you carry. Level 2 only searches the state of residence, which is a real gap for anyone who has practiced across state lines, and that is a large share of clinicians and almost all travel and agency staff. A nurse sanctioned in one state can hold a clean license in the next, and a Level 2 search run in the second state will not surface the first.
KRESS runs Level 3 by default, because it is the most comprehensive FACIS coverage and the difference in cost is small next to the exposure. Levels 1 and 2 remain available, and clients are charged for the level selected.
Why healthcare employers run it
Organizations that bill Medicare or Medicaid are, under OIG guidance, required to screen employees and vendors against federal exclusion databases. This is a compliance requirement, not a best practice.
The consequence sits with the employer, not the individual. If an excluded person works for an organization receiving federal healthcare funds, the organization faces the penalty. Civil monetary penalties now run to $25,595 per item or service, up from the $20,000 set in 2018 as the figure has climbed with inflation, and in serious cases the organization itself can be excluded from federal programs. The US Sentencing Commission puts the median loss in a healthcare fraud case above $1 million. Exclusion screening is cheap by comparison.
What a FACIS search finds
FACIS surfaces exclusions and sanctions across five categories of conduct.
Healthcare and financial fraud. Medicare and Medicaid fraud, billing fraud, kickbacks, and healthcare-related theft or financial exploitation.
Abuse and neglect. Patient abuse, elder abuse, child abuse, and caregiver neglect. This is the category that matters most for roles working with vulnerable people.
Controlled substances. Felony convictions and offenses involving unlawful manufacture, distribution, prescription, or dispensing.
Regulatory and licensing actions. License revocations, debarments, suspensions, and letters of reprimand or probation from federal agencies and state medical boards.
Violent or serious offenses. Global watchlists and serious federal offenses tied to the HHS-OIG exclusions list or to international terrorism and debarment registries. These appear at Level 3 only.
A reported match shows that a person has been excluded from Medicare or Medicaid, debarred from federal contracting, suspended or sanctioned by a federal agency, listed on OFAC, DEA, or FDA debarment lists, or subject to state disciplinary action.
Who has to be screened?
Everyone, and this is the most common misconception in healthcare screening. OIG guidance applies to all employees, vendors, and contractors at an organization receiving federal healthcare funds. That means clinical staff, but it also means:
- Pharmacists, therapists and licensed counselors
- CNAs, EMTs, paramedics and social workers
- Medical billers, coders and administrators
- Vendors, contractors and ambulance companies
Anyone can be excluded by the OIG. Screening only the people with patient contact leaves the organization exposed on the roles that touch the billing.
How often should you re-screen?
OIG guidance points to screening before hire, again just before the start date, and on an ongoing basis after that. The reason for the second check is timing: the Verisys database behind FACIS is updated every month, so a search that came back clear when the offer went out can be out of date by the time the person walks in. On a hire with a four to six week notice period, that gap is real. Ongoing monitoring answers the third point, because nobody is obliged to tell you when a current employee gets sanctioned.
Frequently asked questions
Is a FACIS search required by law?
For any organization receiving Medicare or Medicaid funding, OIG guidance requires screening employees and vendors against federal exclusion databases, both before hire and on an ongoing basis. Some states and accrediting bodies mandate it explicitly.
Can a FACIS search replace a criminal background check?
No. FACIS looks for healthcare exclusions and sanctions, not crimes. Pair it with a county or national criminal search for complete coverage. Our guide to county versus statewide criminal record searches covers how those differ.
We only need to screen clinical staff, right?
No. OIG guidance applies to all employees, including billing, administration, and vendors. This is the single most common gap we see.
How does FACIS relate to the OIG LEIE and SAM?
The OIG LEIE and the SAM database are each a single source, maintained by HHS and the GSA. FACIS is an aggregator that searches both, alongside thousands of other federal and state sources. Running all three as separate line items is not wrong, but it is not three times the coverage either.
What is the difference between FACIS Level 1 and Level 3?
Level 1 covers the federal baseline plus state Medicaid and debarment sources. Level 3 adds state licensing boards across all 50 states and the territories, plus HEAT task forces and federal district sources. KRESS runs Level 3 by default.
How fast is a FACIS search, and what happens on a potential match?
Most FACIS searches finish the same day, often within hours. Where the search surfaces a potential match, that record goes to a researcher for verification, which adds two to three business days. Names repeat, so a match on name alone is not a finding. Verification is what turns a possible hit into something you can act on.
How long is an exclusion reportable?
An active exclusion is current information, so it is reportable for as long as it stays in force. The conduct that led to it is treated differently. Under the FCRA, most adverse items other than records of criminal convictions cannot be reported once they are more than seven years old. There is an important exception: those time limits do not apply to reports for positions paying $75,000 or more a year, which covers a large share of clinical roles.
Does a FACIS hit mean we cannot hire the person?
It means you have information to weigh. The hiring decision belongs to the employer, and where a report costs someone the job, the adverse action process applies.
Who maintains FACIS?
Verisys, which specializes in healthcare compliance data.
Get the detail
We have put the level comparison, the sources behind each one, and what shows up in a report into a single sheet.
Download the KRESS FACIS sales sheet
If you are working out which level your roles need, send us the role titles. We will map each one and come back the same business day. See our healthcare background screening, or get in touch.