DOJ’s Fraud Division and HHS-OIG Streamline Self-Disclosure of Criminal Healthcare Fraud

On Oct.15, the NFED and HHS-OIG announced a Policy intended to eliminate the confusion many healthcare companies have faced in deciding not only whether to self-disclose potential misconduct, but also where. Under the new Policy, a company that voluntarily self-discloses criminal conduct affecting a federal healthcare program to the Fraud Division’s Health Care Fraud Section will automatically receive the benefits of HHS-OIG’s SDP “with no additional direct submission necessary” to HHS-OIG. That same day, HHS-OIG updated the SDP to clarify that potential criminal healthcare matters should be disclosed directly to the Fraud Division. 

The announcement is the latest development in an enforcement landscape that has shifted considerably this year, following DOJ’s March 2026 release of the CEP and its April 7 creation of the NFED. Healthcare companies evaluating potential misconduct should understand how the new Policy changes the disclosure roadmap — and what remains the same. 

The Oct. 15 Joint Policy 

The new Policy was issued jointly by DOJ’s NFED and HHS-OIG. It addresses a recurring problem in healthcare enforcement: a single arrangement, such as an illegal kickback, a scheme to bill Medicare for medically unnecessary services or a scheme concealing an excluded provider, may carry potential criminal, civil, and administrative consequences. Companies facing potential overlapping liability must therefore consider whether the conduct at issue merits disclosure, and if so, to which agency or agencies.  

The Policy addresses this scenario in two complementary ways: 

• Disclosure to DOJ earns SDP benefits. A company that self-discloses misconduct affecting a federal healthcare program to the Fraud Division’s Health Care Fraud Section will receive the benefits of the SDP without making a separate SDP submission. The updated SDP complements the Policy, providing that a company making a voluntary self-disclosure to DOJ within the meaning of the CEP related to conduct involving a federal healthcare program “shall receive the benefits of the SDP.” 
• Disclosure only to HHS-OIG does not earn CEP benefits. HHS-OIG’s updated SDP states that the SDP only covers conduct that may violate civil or administrative law and is not available for the disclosure of federal crimes, which should be disclosed to the Fraud Division. Therefore, any disclosure of criminal conduct made through the SDP will subsequently be referred to DOJ for resolution. And critically, the joint Policy indicates that a company that discloses only to HHS-OIG generally will not have made a voluntary self-disclosure to DOJ and may not qualify for a declination on that basis. 

Several conditions and limitations are embedded in the Policy. First, the cross-program benefit applies to criminal conduct affecting a federal healthcare program; conduct that does not meet that description falls outside the Policy’s express terms. Second, the disclosure must qualify as a voluntary self-disclosure within the meaning of the CEP, which carries its own requirements (discussed below). Third, the Policy does not displace the SDP for purely civil or administrative matters, which remain subject to the SDP’s eligibility and submission requirements. 

The Policy also reflects DOJ’s broader enforcement posture. The Fraud Division’s Health Care Fraud Section, currently comprising nine strike forces operating in federal districts across the country, has charged more than 6,200 defendants who collectively billed federal healthcare programs and private insurers more than $45 billion since 2007. 

Background: The Two Self-Disclosure Frameworks 

The significance of the new Policy is best understood against the two programs it connects. 

DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy 

On March 11, DOJ issued the CEP, which applies to all corporate criminal matters handled by DOJ. The CEP is designed to promote uniformity, predictability and fairness in white-collar enforcement and to incentivize companies to come forward when misconduct occurs so that DOJ may hold individual wrongdoers accountable. The CEP establishes three paths: 

• Part I (Declination Path): Absent aggravating circumstances, a company may receive a declination where it (1) voluntarily self-disclosed the misconduct to an appropriate DOJ criminal component, (2) fully cooperated with DOJ’s investigation and (3) timely and appropriately remediated the misconduct. 
• Part II (“Near Miss” or Aggravating Factors): Where a company self-reported in good faith but did not qualify for a voluntary self-disclosure, or where aggravating factors warrant a criminal resolution, DOJ will generally offer a nonprosecution agreement with a term of fewer than three years, no independent compliance monitor and a reduction of 50% to 75% off the low end of the U.S. Sentencing Guidelines fine range. 
• Part III (Other Cases): Where a company is not eligible for Part I or Part II, prosecutors retain discretion over the form, term, compliance obligations and monetary penalty of the resolution, and DOJ will not recommend a reduction of more than 50%.

Because Part I under the CEP requires disclosure to an appropriate DOJ criminal component, the joint Policy announced on Oct. 15 provides important clarity for healthcare entities. 

HHS-OIG’s Health Care Fraud Self-Disclosure Protocol  

HHS-OIG’s SDP establishes a process for healthcare providers, suppliers and other persons subject to HHS-OIG’s civil monetary penalty (CMP) authorities to voluntarily identify, disclose and resolve potential fraud involving federal healthcare programs. Common categories of disclosed conduct include false billing, the employment of or contracting with excluded persons, and arrangements implicating the Anti-Kickback Statute. 

The SDP offers several benefits to disclosing parties, including: 

• A presumption against requiring corporate integrity agreement obligations in exchange for a release of HHS-OIG’s permissive exclusion authorities. 
• A lower multiplier on single damages than in government-initiated investigations, with a general minimum of 1.5 times single damages. 
• Suspension of the 60-day obligation to report and return identified Medicare and Medicaid overpayments once HHS-OIG acknowledges receipt of a timely SDP submission. 
• A streamlined process, with an average case pendency of less than 12 months from acceptance into the SDP. 

The SDP is generally not available for matters involving only overpayments or errors, requests for an advisory opinion, physician self-referral law-only conduct or matters more appropriately disclosed through HHS-OIG’s grant or contractor self-disclosure programs — and, as now clarified, federal crimes. 

Key Takeaways 

The new Policy is intended to simplify the disclosure decision for criminal healthcare conduct, but it warrants careful consideration for healthcare entities. Specifically, they should consider the following: 

• Assess criminal exposure at the outset. Because an HHS-OIG-only disclosure generally will not qualify as a voluntary self-disclosure under the CEP, companies should evaluate early — with counsel and under privilege — whether identified conduct may be criminal. Where criminal exposure is reasonably possible, the Fraud Division should generally be the first point of contact. 
• Update internal escalation and disclosure protocols. Consider updating compliance programs, hotline procedures and investigation playbooks to reflect this new joint Policy. 
• Remember that disclosure is only the first CEP requirement. Declination under Part I of the CEP also requires full cooperation and timely and appropriate remediation. Companies should be prepared to conduct thorough internal investigations, identify responsible individuals and implement corrective action. 
• Monitor implementation and open questions. The Policy states that a DOJ disclosure carries SDP benefits “automatically,” but questions remain about how those benefits — such as the lower damages multiplier, the presumption against integrity obligations and the suspension of the overpayment reporting deadline — will be applied in practice where no SDP submission is made, and how parallel civil False Claims Act resolutions will be coordinated. Companies already in the SDP, or subject to corporate integrity agreements with their own reporting obligations, should evaluate with counsel whether the Policy affects their existing obligations. 

Healthcare providers, suppliers, manufacturers and other entities participating in federal healthcare programs should carefully consider these developments as they evaluate and respond to potential misconduct.