DOJ and HHS Open Two Self-Disclosure Paths for Healthcare Fraud: What Companies Need to Know

Key Takeaways

• DOJ and HHS established new criminal and civil healthcare fraud self-disclosure pathways, offering companies potential prosecution relief, reduced FCA repayment exposure, and coordinated resolutions.
• Healthcare companies face a limited opportunity to resolve potential FCA violations on favorable terms. The civil pilot program closes April 22, 2027, making early identification, investigation, and disclosure decisions critical.
• Disclosure strategy now carries significant financial and enforcement consequences. Companies must assess criminal versus civil exposure, preserve eligibility for available incentives, and address remaining exclusion risks before reporting misconduct.

---

On October 15, 2026, the U.S. Department of Justice (“DOJ”) and the U.S. Department of Health and Human Services Office of Inspector General (“HHS-OIG”) announced a joint criminal self-disclosure policy, and on October 22, 2026, DOJ’s Civil Division and HHS launched a Healthcare False Claims Act Self-Disclosure Pilot Program. Both build on the Corporate Enforcement Policy (“CEP”) that DOJ issued in March 2026 and DOJ’s pairing of increased scrutiny of corporate misconduct with incentives for self-disclosure. Together, they give healthcare companies clearer paths to resolve potential misconduct quickly and on more favorable terms than if the government discovered the conduct on its own.

Joint Criminal Self-Disclosure Policy

How Does the Joint Criminal Self-Disclosure Policy Work?

DOJ’s National Fraud Enforcement Division (the “Fraud Division”) and HHS-OIG issued a joint self-disclosure policy, and HHS-OIG separately updated its Health Care Fraud Self-Disclosure Protocol (“SDP”). Healthcare companies can now make a single report of potentially criminal conduct to the Fraud Division’s Health Care Fraud Section, which will forward it to HHS-OIG. That one qualifying disclosure earns the benefits of both DOJ’s CEP and the SDP. The reverse is not true: a disclosure to HHS-OIG alone will generally not qualify for a CEP declination, although DOJ may still consider it as part of the company’s cooperation and remediation.

What Conduct Qualifies Under DOJ and HHS-OIG’s Criminal Self-Disclosure Policy?

The policy applies to voluntary self-disclosures of potential criminal violations affecting one or more federal healthcare programs, such as Medicare, Medicaid, and TRICARE.

What Are DOJ’s Requirements for a Criminal Declination?

To earn a declination, a company must voluntarily self-disclose the conduct to the Fraud Division, fully cooperate, and timely and appropriately remediate.

Criminal Self-Disclosure Benefits: Prosecution Declination and HHS-OIG Relief

DOJ will decline to prosecute absent aggravating circumstances. Companies also automatically receive SDP benefits, including a speedier resolution, a lower damages multiplier, and an exclusion release without integrity agreement obligations. SDP benefits do not, however, resolve mandatory exclusion for criminal healthcare fraud convictions.

How DOJ Evaluates Cooperation, Remediation, and Aggravating Circumstances

Prosecutors apply the following CEP factors:

1. whether the company voluntarily self-disclosed to an appropriate DOJ component;
2. whether it fully cooperated;
3. whether it timely and appropriately remediated the misconduct; and
4. whether aggravating circumstances exist, such as the egregiousness or pervasiveness of the misconduct or the severity of the harm it caused.

Prosecutors retain discretion to recommend declination after weighing those circumstances against the company’s disclosure, cooperation, and remediation.

DOJ and HHS Healthcare False Claims Act Self-Disclosure Pilot Program

What Is the New FCA Pilot Program and When Does It End?

The pilot gives healthcare companies a way to quickly resolve past misconduct by self-disclosing potential FCA violations. Announcing the pilot, the Civil Division’s Assistant Attorney General stated that “[v]voluntary self-disclosure is a powerful indicator of a company’s commitment to compliance and accountability.” The pilot runs for six months, ending on April 22, 2027. Late or partial submissions will not be reviewed. Depending upon the utilization and success of the program, the DOJ may extend the program.

Which Healthcare Providers and Companies Qualify for the FCA Pilot?

Healthcare providers, suppliers, manufacturers, payors, and related entities that furnish, arrange for, manufacture, distribute, insure, administer, or bill for items or services paid for, directly or indirectly, by HHS federal healthcare programs. Importantly, the conduct must be previously unknown to the government; if the government already knows of it, the company may only receive self-disclosure and cooperation credit.

FCA Pilot Submission Requirements: Documentation, Remediation, and Repayment

Disclosing companies must provide:

1. The time period and all relevant details of the conduct, including the laws or other binding requirements potentially violated;
2. Exhibits sufficient to show the full nature, terms, and operation of the potential FCA violations, cross-referenced in the written description;
3. The corrective actions taken to stop the conduct and prevent its recurrence;
4. Financial information sufficient for DOJ to calculate the Base Self-Disclosure Repayment;
5. Certification by an authorized representative, that, to the best of that person’s knowledge, the submission is truthful and complete; and
6. A point of contact’s phone number and email address.

FCA Self-Disclosure Benefits: Reduced Repayments and Coordinated Civil Releases

Companies repay 1.25 to 1.6 times the Base Self-Disclosure Repayment. That is well below the roughly double damages typical in FCA settlements, and far below the treble damages DOJ can recover if it litigates. AKS disclosures also get a notable break: instead of counting all tainted claims, DOJ will calculate the base amount from the remuneration and the revenue tied to it, assuming no aggravating factors such as patient harm. Companies also receive a coordinated civil release from DOJ and HHS with no factual admissions, resolution of CMS revocation and specified OIG permissive exclusion authorities without a CIA, and no need to make separate disclosures under the HHS-OIG SDP or the CMS Self-Referral Disclosure Protocol.

How DOJ Calculates the FCA Self-Disclosure Repayment Multiplier

DOJ will consider:

1. the timeliness of the disclosure;
2. the duration and scope of the misconduct;
3. the involvement of senior leadership;
4. the financial benefit to the company; and
5. whether the company has successor liability for the misconduct but promptly remediated.

How DOJ’s Criminal and Civil Healthcare Fraud Self-Disclosure Programs Work Together

One filing can cover both tracks. A company that discloses criminal conduct to the Fraud Division need not make a duplicate submission to the civil pilot; if it also seeks a civil FCA release, DOJ will request supplementation only to the extent necessary.

Neither program eliminates all exclusion risk. The criminal policy does not resolve mandatory exclusion, and the civil pilot program resolves only revocation and specified permissive exclusion authorities.

Speed matters on both tracks. Companies need to quickly develop the factual record, assess potential exposure, and decide whether to disclose.  Under both tracks, timeliness affects the multiplier. Under the civil pilot program, late or partial submissions will not be reviewed and only conduct previously unknown to the government qualifies. DOJ has also signaled it will work with whistleblowers against companies that do not come forward, and a pending qui tam action could make the conduct known to the government first.

What Healthcare Companies Should Do Before Voluntarily Disclosing Potential Fraud

1. Promptly evaluate whether the conduct may be criminal, including whether the evidence may meet the applicable intent standard. If so, disclose it to the Fraud Division first.
2. If the conduct is purely a civil potential FCA violation, promptly consider whether disclosure under the civil pilot program is in the company’s best interest. This may include AKS conduct that does not meet the criminal intent standard but could still support FCA liability.
3. Ensure that any disclosure made to DOJ or HHS-OIG is complete and accurate.
4. Consider contacting outside counsel for guidance on self-disclosure decisions.