"But it does little to track or police the future endeavors of those it has excluded," according to Tribble and Weber. "Federal overseers largely count on employers to check their hires and identify those excluded. Big hospital systems and clinics typically employ compliance staff or hire contractors who routinely vet their workers against the federal list to avoid fines. However, those who own or operate health care businesses are typically not subject to such oversight, KHN found. And people can sidestep detection by leaving their names off key documents or using aliases."

KHN — a Kaiser Family Foundation program that produces in-depth reports on health statistics — analyzed 300 of the more than 1,600 health care business owners and executives on the OIG's exclusion list since January 2017. Many had owned or operated home health care agencies, medical equipment companies, mental health facilities, and other entities, according to the report, which was published on KHN's website as well as USA Today.

"They'd submitted false claims, received kickbacks for referrals, billed for care that was not provided, and harmed patients who were poor and old, in some cases by stealing their medication or by selling unneeded devices to unsuspecting Medicare enrollees," KHN notes.

Read more: Office of Inspector General warns against telemedicine fraud

"If you intend to violate your exclusion, the exclusion list is not an effective deterrent," says David Blank, a partner at the Washington, D.C.-based law firm Arnall Golden Gregory, who previously worked as senior counsel at the OIG. "There are too many workarounds."