New Framework, Two Paths: Navigating DOJ and HHS's Newly Released Civil and Criminal Health Care Self-Disclosure Initiatives

In October 2026, the US Department of Justice (DOJ) and the US Department of Health and Human Services (HHS) announced two coordinated initiatives intended to make voluntary self-disclosure more predictable for healthcare companies. The first, announced 15 October, coordinates disclosures of potential criminal healthcare fraud between DOJ’s National Fraud Enforcement Division (NFED) and HHS’s Office of Inspector General (HHS-OIG) (the NFED Healthcare Self-Disclosure Program).¹ The second, announced 22 October 2026, establishes a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (FCA Self-Disclosure Pilot Program) for potential civil False Claims Act (FCA) violations.² Both initiatives follow DOJ’s March 2026 adoption of a uniform corporate enforcement and voluntary self-disclosure policy.³ Together, the initiatives establish distinct but coordinated pathways for addressing potential criminal and civil misconduct involving federally funded healthcare programs. They also address a recurring challenge for healthcare organizations, whereby the same underlying conduct may give rise to overlapping criminal, civil, and administrative exposure, depending on the nature of the conduct and the applicable enforcement framework.

Although neither initiative guarantees a particular outcome, both are intended to encourage timely disclosure, cooperation, and remediation by providing greater clarity about the applicable submission process and potential enforcement benefits. Companies evaluating possible misconduct should understand which pathway may apply, what each program requires, and which liabilities may remain outside any resulting resolution. It creates an avenue for arrangements involving alleged kickbacks, medically unnecessary services, misappropriated federal funds, or concealed participation by an excluded provider, which can implicate several enforcement regimes at once. 

Taken together, the NFED Healthcare Self-Disclosure Program and the FCA Self-Disclosure Pilot Program underscore DOJ’s focus on healthcare fraud as a top enforcement priority,⁴ while offering companies greater clarity about where to disclose potential misconduct and greater predictability regarding the benefits available for qualifying disclosures. Although neither program guarantees a particular outcome, both seek to reduce uncertainty surrounding voluntary self-disclosure and encourage companies to identify, report, and remediate misconduct promptly.

NFED Health Care Self-Disclosure Program

For criminal matters, the NFED Healthcare Self-Disclosure Program directs companies seeking to self-disclose potentially criminal conduct involving a federal healthcare program to NFED’s Health Care Fraud Section. Upon receipt of disclosure, NFED commits to promptly providing HHS-OIG with a copy of the disclosure. A qualifying disclosure under DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) will be treated as sufficient for purposes of both the CEP and HHS-OIG’s Self-Disclosure Protocol (SDP), without a separate submission to HHS-OIG. Companies should submit disclosures here. 

To qualify, a disclosure must be made in good faith, concern conduct not already known to DOJ, occur before an investigation or disclosure is imminent, and be made reasonably promptly. The potential benefits include a DOJ declination, an expedited resolution of civil monetary penalties at a lower multiplier, an exclusion release without a corporate integrity agreement, and suspension of the 60-day time limit to report certain overpayments to the government. Those benefits depend on satisfying the applicable policy requirements, including full cooperation and remediation; disclosure alone does not guarantee a particular outcome.

The policy also makes clear that disclosure to HHS-OIG alone is not a substitute for disclosure to DOJ. Such a submission generally will not constitute a voluntary self-disclosure to DOJ or qualify a company for a declination on that basis. HHS-OIG is revising its SDP to clarify that it cannot be used to disclose criminal violations.

The New Civil FCA Self-Disclosure Pilot Program

For purely civil matters, the FCA Self-Disclosure Pilot Program unveiled just a few days after the NFED Healthcare Self-Disclosure Program provides a time-limited route for healthcare companies to resolve potential civil FCA violations. Submissions must be made electronically to DOJ’s Civil Division by 22 April 2027, subject to the pilot’s eligibility and submission requirements. A participating company must provide a complete account of the potential violation; relevant supporting documentation sufficient to show the nature, terms, and operation of the conduct; describe completed remediation; and submit the required financial repayment. For qualifying entries, the FCA Self-Disclosure Pilot Program provides for the following:

Repayment Framework

The self-disclosing company will be required to make a “financial payment” with a multiplier of 1.25–1.6 (as opposed to a multiplier as high as three times the damages). DOJ will select the multiplier based on factors including disclosure timing, the duration and scope of the conduct, senior leadership involvement, the company’s financial benefit, and whether a successor promptly identified and remediated inherited misconduct.

Coordinated Release

In exchange, participants may receive a coordinated civil release from liability under the federal FCA and certain HHS administrative authorities. The scope of any release should be evaluated carefully against potential exposure involving state Medicaid programs, state false claims statutes, licensing authorities, contractors, and other federal or state regulators.

Because the pilot lasts only six months and excludes late or incomplete submissions, companies considering participation should complete threshold legal analysis, document collection, damages calculations, and remediation planning promptly. An accelerated submission should not come at the expense of accuracy or completeness.

Civil FCA Conduct

Through 22 April 2027, eligible companies may submit potential civil FCA violations to DOJ’s Civil Division under the FCA Self-Disclosure Pilot Program. The pilot requires a complete description of the conduct, supporting documents, remediation information, and repayment using a 1.25–1.6 multiplier. In exchange, DOJ and HHS may provide a coordinated civil release under the FCA and specified HHS administrative authorities.

Practical Implications for Healthcare Companies

The policies simplify the mechanics of reporting, but they do not eliminate the need for a prompt and carefully coordinated legal assessment. Healthcare providers, health plans, laboratories, pharmacies, pharmaceutical and medical device manufacturers, private equity sponsors, and other entities participating in federal healthcare programs should consider the following steps when potential misconduct is identified:

Classify the Conduct Before Choosing a Disclosure Channel

The October initiatives require an early assessment of whether the matter is potentially criminal, civil, or mixed. Mixed matters should be coordinated from the outset to avoid inconsistent submissions and to preserve the possibility of both criminal-policy credit and an appropriately scoped civil release.

Triage Criminal Exposure Early

Internal investigation teams should assess promptly whether the facts could support criminal theories, including knowing false claims, kickbacks, obstruction, concealment, or conduct involving excluded persons. 

Preserve Voluntariness

Counsel should evaluate whether the government already knows of the conduct or whether a disclosure obligation, subpoena, audit, or imminent whistleblower action could affect the availability of voluntary-disclosure credit.

Coordinate Remediation and Disclosure Readiness

DOJ emphasized that the anticipated benefits depend not only on coming forward, but also on full cooperation and remediation. Companies should preserve evidence, stop ongoing misconduct, discipline responsible personnel where appropriate, and address identified compliance weaknesses.

Avoid Assuming That One Disclosure Resolves Every Issue

Although the policy coordinates DOJ and HHS-OIG treatment, a matter may still implicate the Centers for Medicare & Medicaid Services, state Medicaid agencies, state attorneys general, licensing authorities, contractors, or other regulators. Separate repayment and reporting obligations also may apply.

Document the Decision Process

A contemporaneous record of the investigation, legal analysis, disclosure timing, corrective actions, and agency communications can be important if regulators later assess the company’s cooperation and remediation.

Model the FCA Self-Disclosure Pilot Program Economics

Before entering the civil pilot, companies should estimate single damages or other repayment amounts, apply the potential 1.25–1.6 multiplier range, and compare the expected resolution with alternatives, including ordinary Civil Division cooperation credit and HHS-OIG’s existing protocol.

Confirm the Needed Release Perimeter

A federal FCA and HHS administrative release may not resolve state law claims, Medicaid overpayments, contractual recoupment rights, licensing exposure, suspension or debarment risk, or individual liability. The disclosure plan should identify those residual risks and, where appropriate, coordinate parallel reporting or repayment obligations.

What Companies Should Do Now

Organizations should review and update investigation and escalation protocols to distinguish three routes: potentially criminal federal healthcare fraud to DOJ’s National Fraud Enforcement Division, qualifying civil FCA matters to the Civil Division’s FCA Self-Disclosure Pilot Program while the pilot remains open, and other civil or administrative matters to HHS-OIG’s existing protocol. Policies should require prompt cross-functional review by legal, compliance, finance, and relevant business personnel, with clear responsibility for document preservation, damages analysis, remediation, and agency communications.

The coordinated framework offers greater procedural clarity and potentially more predictable resolutions, but disclosure decisions remain fact-specific and consequential. Before approaching any agency, companies should assess the nature and scope of the conduct, the completeness of available facts, potential repayment and reporting duties, privilege considerations, the likely multiplier and release scope, and the government’s expectations for cooperation and remediation. 

The firm has extensive experience advising healthcare organizations on white-collar enforcement, internal investigations, compliance, and government self-disclosure. Our Policy and Regulatory team can help clients assess potential exposure, find available disclosure pathways, and coordinate strategies for investigation, remediation, and engagement with enforcement authorities.