DOJ and HHS-OIG Announce Coordinated Self-Disclosure Policy for Criminal Health Care Fraud

On October 15, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division (Fraud Division) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) announced a joint policy coordinating voluntary self-disclosures of potential criminal health care fraud. A company making a qualifying disclosure to the Fraud Division’s Health Care Fraud Section can now receive the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP), without a separate submission to HHS-OIG.

The policy also clarifies that reporting potentially criminal conduct only to HHS-OIG generally will not qualify a company for a DOJ declination on that basis. The policy simplifies reporting, but companies must still meet the conditions for favorable treatment, and any resulting resolution may not cover all potential liabilities.

The announcement follows the Fraud Division’s October 1 corporate enforcement directive, which identifies health care fraud as a priority and emphasizes credit for disclosure, cooperation, and remediation. We discussed that directive in our recent Legal Update, DOJ’s National Fraud Division Outlines New Corporate Fraud Enforcement Priorities and Factors.

How the Coordinated Disclosure Process Works

The policy addresses conduct that may create overlapping criminal, civil, and administrative exposure, such as unlawful kickback arrangements, billing for medically unnecessary services, or schemes involving excluded providers. Its stated scope is potential criminal violations of federal law affecting one or more federal health care programs.

For disclosures made on or after October 15, 2026, a company can obtain the benefits of both the CEP and HHS-OIG’s SDP through a single qualifying disclosure to the Health Care Fraud Section of potential criminal conduct affecting a federal health care program. The Section will promptly provide HHS-OIG with a copy, without the company having to make a separate submission through the SDP portal. The policy also recognizes that a company may initially approach a different DOJ office. A good-faith disclosure to other Fraud Division personnel or another DOJ component can still qualify, including where the matter is subsequently referred to the appropriate component for investigation, provided the disclosure otherwise meets the CEP’s requirements.

Eligibility and Available Benefits

The disclosure must satisfy the CEP’s requirements. These generally include a good-faith report to an appropriate DOJ component, misconduct not already known to DOJ, no pre-existing obligation to disclose the misconduct to DOJ, and disclosure before an imminent threat of disclosure or government investigation. The company must also report reasonably promptly after becoming aware of the misconduct and demonstrate that its disclosure was timely. The CEP encourages early reporting, even before an internal investigation is complete.

Under Part I of the CEP, DOJ will decline prosecution where a company makes a qualifying voluntary disclosure, fully cooperates, and timely and appropriately remediates, absent aggravating circumstances. Prosecutors retain discretion to recommend a declination despite aggravating circumstances. A declination does not necessarily eliminate financial consequences: the CEP requires disgorgement or forfeiture and restitution or victim compensation resulting from the misconduct. Other CEP resolution options remain available where Part I’s conditions are not met.

The SDP offers a separate set of benefits for resolving liability under HHS-OIG’s civil monetary penalty authorities. These include a potentially faster resolution, a lower damages multiplier than in a government-initiated investigation, and release from permissive exclusion without a corporate integrity agreement. HHS-OIG’s general settlement practice is a minimum multiplier of 1.5 times single damages, although a higher multiplier may be appropriate. These benefits remain subject to the company’s cooperation throughout the process.

A Disclosure to HHS-OIG Alone Generally Will Not Suffice

The revised SDP directs criminal disclosures to DOJ, rather than HHS-OIG. An SDP submission alone generally does not satisfy Part I’s disclosure requirement, but the joint policy preserves credit for cooperation, remediation, and other mitigating circumstances. Accordingly, an HHS-OIG disclosure may still be relevant to DOJ’s assessment if the matter subsequently becomes a criminal investigation.

False Claims Act Exposure and Other Limits

The new policy does not provide an automatic resolution of potential False Claims Act (FCA) liability, nor prescribe a new process for coordination with DOJ’s civil fraud attorneys. The updated SDP continues to contemplate DOJ participation in civil settlements and requests for an FCA release, but DOJ determines the approach to resolution when it participates. Separately, Justice Manual Section 4-4.112 provides for disclosure, cooperation, and remediation credit in FCA matters. The policy does not guarantee an FCA release, but companies may still qualify for cooperation credit in civil FCA matters.

The SDP can provide a release from permissive exclusion, meaning exclusion from federal health care programs that HHS-OIG has discretion to impose. The policy does not extend that protection to mandatory exclusion under 42 U.S.C. § 1320a-7(a). Under that provision, certain criminal convictions, including for Medicare or Medicaid fraud, generally require exclusion for at least five years. Department of Justice Exclusion generally prevents federal health care programs from paying for items or services furnished, ordered, or prescribed by the excluded company or individual. A company could therefore receive a release from permissive exclusion through the SDP but still face mandatory exclusion, if its criminal resolution results in a conviction covered by the statute.

Practical Steps to Consider

Companies considering whether to disclose potential health care misconduct should consider the following:

• Assess potential criminal exposure early: Legal and Compliance should evaluate whether a matter involves potential criminal conduct, civil or administrative liability, or a combination. Not every billing error involves criminal fraud, so companies should assess the conduct before deciding whether to approach DOJ or HHS-OIG.
• Make disclosure decisions promptly and document remediation: Preserve relevant records, establish when the company learned of the issue, and identify who is responsible for the disclosure decision. Where disclosure is being considered, avoid unnecessary delay while investigations continue, and document corrective action as it is taken.
• Consider the full range of potential liabilities: Assess criminal liability, FCA implications, exclusion, and other regulatory consequences together. In discussions with the government, clarify which authorities will participate, how the disclosure will be treated, and what liabilities any eventual agreement will release. Separate agreements may still be needed to resolve criminal, civil, and administrative liability.