Oh Medical Exclusions MCP server

@pipeworx/oh-medical-exclusions

Ohio Department of Medicaid (ODM) Provider Exclusion & Suspension List screening — check a provider by name, NPI, or ODM Provider ID against the ~2,122-row list of individuals and organizations excluded or suspended from Ohio's Medicaid program, the state-level counterpart to the federal HHS OIG LEIE (leie pack) and the sibling of ny-omig-exclusions (New York), ca-medical-exclusions (California), tx-medical-exclusions (Texas), fl-medical-exclusions (Florida), pa-medical-exclusions (Pennsylvania) and ga-medical-exclusions (Georgia).

Part of Pipeworx — an MCP gateway connecting AI agents to 1831+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.

Tools

screens a provider against the ODM exclusion/suspension list. An NPI or Provider ID match is an identification (both are exact identifiers, and either can be a comma-joined list on one row when a provider is excluded under multiple registrations); a name match — even an exact one — is a candidate lead only, since this list carries no date of birth. Every match carries ODM's own status and a currently_excluded flag derived from it.

• ohmedicalcheckexclusion(name?, npi?, providerid?, limit?) —

organizations), how many are currently excluded/suspended vs. status-unknown, how many carry an NPI, and the oldest/newest exclusion effective date. Pass year or startdate/enddate to instead count exclusions whose effective date falls in that range, over the whole list.

• ohmedicalexclusion_coverage() — total rows (individuals plus

Auth

Keyless.

Data sources

— the state's published roster of individuals and organizations excluded from, or currently suspended from, Ohio's Medicaid program, published at .

• Ohio Department of Medicaid (ODM), Provider Exclusion & Suspension List

The listing page 404s for a plain curl — that is a UA block, not a dead page

Verified live 2026-10-17: a request with no browser-shaped User-Agent gets a stale CloudFront 404 fallback from Ohio's CDN; the identical request with a browser-shaped UA string returns 200. This is the UA-sniffing class the "public data is public data" ruling already covers — not a login wall, not a CAPTCHA. scripts/bake-index.mjs still identifies the pack honestly (its UA string names it and carries a contact URL); the string is shaped to get past a bot filter, not to impersonate a browser. The asset CDN that actually serves the .xlsx does not need this — only the page that names its current URL does.

The download link is NOT stable — resolved fresh every bake

The linked .xlsx lives on Ohio's asset CDN (dam.assets.ohio.gov/raw/upload/medicaid.ohio.gov/...) and its FILENAME embeds the publication date (e.g. ExclusionSuspensionList1015_2026-3.xlsx). scripts/bake-index.mjs resolves the current link from the listing page every run — the same "resolve from the listing page, never guess the filename" discipline ga-medical-exclusions and scripts/ingest-dmepos.mjs use for their own unstable upstream filenames.

Why this is baked, not a live proxy

Per root CLAUDE.md's standing rule for a table this size, the full list (2,122 rows at capture time) is baked into src/oh-odm-index-data.ts, registered in workers/gateway/src/pack-baked-indexes.json, uploaded to KV at deploy, and injected into every call as args._bakedIndex — never a static module-scope import (fleet #2754). A missing or malformed injection throws loudly rather than answering "not found" — see src/index.test.ts.

No external XLSX library — hand-rolled, same discipline as the sibling packs

Shortened. The full README is on GitHub.