The Audit-Ready Compliance Package
Give us a National Provider Identifier and we return a signed, dated attestation of an exclusion and integrity screen — every federal and state list consulted, the per-source result with its category and snapshot date, the full provenance behind each source, and an Ed25519 signature chained to Fonteum’s append-only attestation chain. The same document is available as machine-readable JSON and as a human-readable PDF.
What the document records
- The subject NPI and the resolved graph entity it maps to.
- Every source consulted — OIG LEIE, SAM.gov, each state Medicaid exclusion list, OIG Corporate Integrity Agreements, CMS Civil Money Penalties, and any other registered source.
- The per-source result — excluded, compromised-flag, or clear — with its category, the snapshot date of the list version screened, and the methodology version.
- The full 14-field provenance record for each source.
- The check timestamp, the document SHA-256, and the Ed25519 signature.
How it is signed and chained
The attestation body is canonicalized and hashed with SHA-256. That hash is bound to the current head of Fonteum’s append-only attestation chain and signed with Ed25519. Anyone can recompute the hash from the document, re-derive the chain-bound identifier from the published chain head, and check the signature against the public key published at /.well-known/chain-public-key. A result of “clear” asserts that no matching record was found in the lists Fonteum holds at the snapshot dates shown — not a guarantee that none exists in any jurisdiction.
Where it fits
CMS audit response
Attach a dated, signed record of the exclusion + integrity screen you ran on a billing provider, with the snapshot date of each list at the moment of the check.
OIG inquiries
Show which lists were consulted — OIG LEIE, SAM.gov, state Medicaid exclusions, OIG Corporate Integrity Agreements, CMS Civil Money Penalties — and the per-source result, each carrying its source URL and methodology version.
NCQA / CAQH / URAC credentialing
Keep a reproducible screening-evidence artifact in the practitioner file: the document hash and the published signing key let a reviewer confirm the record was not altered after signing.
False Claims Act evidentiary use
A timestamped, signed screen documents diligence at a point in time. The attestation states what it asserts and what it does not — it is screening evidence, not a legal certification.
How to consume it
Signed JSON attestation for a single NPI:
GET https://fonteum.com/api/v1/exclusions/{npi}/attestationHuman-readable PDF package (same signed body):
GET https://fonteum.com/api/v1/exclusions/{npi}/attestation/pdfAnonymous access is rate-limited; an API key raises the limit. Every response carries an X-Fonteum-SHA256 header matching the document hash. A signed-vs-JSON consumer checks the signature against the published chain public key; an auditor files the PDF.
This package is screening evidence, not a credentialing decision or a legal certification. Re-confirm any flagged or excluded result against the primary source list before taking adverse action.
Reviewed by Dr. Jennifer Montecillo, MD, medical reviewer. Non-practicing medical reviewer. Questions: hello@fonteum.com.