DOJ and HHS Coordinate Criminal and Civil Healthcare Self-Disclosures: What Companies Need to Know

The U.S. Department of Justice (“DOJ”) and the Department of Health and Human Services (“HHS”) have announced complementary initiatives to coordinate healthcare self-disclosures. On October 15, 2026, DOJ’s National Fraud Enforcement Division (“NFED” or “Fraud Division”) and HHS’s Office of Inspector General (“HHS-OIG”) issued a policy coordinating disclosures of potential criminal healthcare misconduct (the “NFED Coordination Policy”).¹ On October 22, DOJ’s Civil Division and HHS launched the Healthcare False Claims Act Self-Disclosure Pilot Program (“FCA SDPP”) for potential civil False Claims Act (“FCA”) violations.² Together, the initiatives reduce duplicative submissions, but eligibility, available relief and disclosure timing differ. Companies should assess both criminal and civil exposure before selecting a pathway.

I. Criminal Matters: The NFED Coordination Policy

The NFED Coordination Policy applies to voluntary self-disclosures of potential federal criminal violations affecting federal healthcare programs made to the Fraud Division on or after October 15, 2026. A company making a qualifying disclosure to its Health Care Fraud Section receives the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (“SDP”), without a separate submission through HHS-OIG’s portal. The Health Care Fraud Section will promptly share the disclosure with HHS-OIG. DOJ identifies corporate.enforcement@usdoj.gov as the submission address.³

Qualifying disclosures. The policy incorporates the CEP’s definition of voluntary self-disclosure: a good-faith disclosure to the appropriate DOJ component of misconduct not previously known to DOJ, without a preexisting obligation to disclose to DOJ, before an imminent threat of disclosure or government investigation, and within a reasonably prompt time after discovery. The company bears the burden of demonstrating timeliness. The CEP also contains a limited exception for certain internal whistleblower reports followed by prompt company reporting, subject to a 120-day outer limit and the policy’s other requirements.

Benefits and conditions. The coordination policy does not make disclosure alone sufficient for a criminal declination. Under CEP Part I, DOJ will decline prosecution where a company voluntarily self-discloses, fully cooperates and timely and appropriately remediates, absent specified aggravating circumstances. Prosecutors retain discretion to recommend a declination despite aggravating circumstances. A CEP declination still requires disgorgement or forfeiture and restitution or victim compensation, and declinations are public.

Where a company fully cooperates and timely remediates but misses Part I solely because of a good-faith disclosure that does not meet the voluntary-disclosure definition and/or aggravating factors warranting a resolution, CEP Part II provides a non-prosecution agreement absent particularly egregious or multiple aggravating circumstances, a term shorter than three years, no independent compliance monitor, and a 50–75% reduction from the low end of the applicable Sentencing Guidelines fine range. These are criminal-policy incentives, distinct from the civil pilot’s repayment range.

The SDP benefits extended by the coordination policy include a lower multiplier and an exclusion resolution without integrity-agreement obligations, subject to the applicable protocol and cooperation requirements. HHS-OIG’s existing SDP generally uses a minimum multiplier of 1.5 times single damages; the coordination policy does not import the civil pilot’s 1.25–1.6 range into criminal matters. Importantly, the extended SDP benefits do not resolve mandatory exclusion.

Choosing the recipient. A disclosure made only to HHS-OIG generally does not qualify as a voluntary disclosure to DOJ for CEP purposes, although it may count toward cooperation and remediation. Companies seeking both CEP and SDP benefits should therefore bring potential criminal conduct to the Fraud Division first. The updated SDP is not available for disclosure of federal crimes. The policy also recognizes qualifying good-faith disclosures to other DOJ components under the CEP; its preferred route should not be described as an absolute forfeiture rule for every misdirected filing.⁴

II. Civil Matters: The FCA Self-Disclosure Pilot

The FCA SDPP offers eligible healthcare companies a coordinated resolution of potential federal FCA liability and specified HHS administrative exposure. Unlike the criminal coordination policy, it is a six-month pilot with a submission deadline of April 22, 2027. Its principal incentives are a defined repayment range, a coordinated civil release without factual admissions, and specified relief from HHS administrative remedies.⁵

Eligibility and scope. Eligible participants include providers, suppliers, manufacturers, payors and related entities that furnish, arrange for, manufacture, distribute, insure, administer or bill for items or services paid for directly or indirectly by HHS federal healthcare programs.

The FCA SDPP disclosure must concern a potential FCA violation previously unknown to the federal government. Where the government is already aware of the potential FCA violation, the company is ineligible for a resolution under the FCA SDPP, though it may still receive self-disclosure and cooperation credit under Justice Manual Section 4-4.112.⁶

The coordinated pathway covers potential federal FCA liability and three specified HHS administrative authorities: Medicare enrollment revocation, permissive exclusion for false or improper claims, and permissive exclusion based on fraud, kickbacks or other prohibited activities. It should not be read as a release of all potential healthcare regulatory liability.

Interaction with criminal disclosures. Potential criminal healthcare misconduct must be disclosed through the NFED pathway. A company making a criminal disclosure that qualifies under the CEP need not submit a duplicate FCA SDPP filing; if it also seeks a civil FCA release, DOJ will request supplementation only as necessary. Avoiding a duplicate submission does not itself confer a civil release.⁷

Submission requirements and deadline.

The submission must describe the potential FCA violations, identify the specific requirements implicated and relevant period, attach and cross-reference supporting documents, explain completed remedial measures, provide financial information sufficient to calculate the “Base Self-Disclosure Repayment,” and identify a contact. An authorized representative must certify that, to the best of the individual’s knowledge, the submission contains truthful and complete information about the disclosed potential violations.⁸

Complete submissions must reach FCA-SDPP@usdoj.gov by 11:59 p.m. on April 22, 2027. Late or partial submissions will not be accepted or reviewed. The protocol does not specify a time zone; companies should plan to submit well in advance rather than rely on a last-minute filing.⁹

Repayment and Resolution Terms

The required repayment is 1.25 to 1.6 times the Base Self-Disclosure Repayment. The multiplier depends on how promptly the disclosure was made, the breadth and duration of the underlying conduct, whether senior leadership was involved, the economic advantage the company derived, and, for companies that inherited liability through an acquisition, whether remediation followed promptly.¹⁰

The repayment base matters as much as the multiplier. The protocol illustrates use of sampling and extrapolation for billing violations. For Anti-Kickback Statute (“AKS”) violations, the government states that, for this pilot only, it will forgo claim-paid damages and instead calculate the base by considering remuneration, revenue derived from the conduct and the absence of aggravating factors such as patient harm. This is a program-specific resolution methodology, not a change to the governing law of FCA damages.¹¹

Qualifying companies receive a coordinated civil resolution without factual admissions, including a DOJ Civil Division release under the federal FCA for the disclosed potential violations. HHS-OIG will not require a Corporate Integrity Agreement (“CIA”) as part of resolving its exclusion authorities under the pilot, and the Centers for Medicare & Medicaid Services ("CMS") will not impose civil monetary penalties or seek revocation as part of a pilot resolution. These commitments are tied to the program resolution, not blanket protection from future enforcement.

Companies also need not separately disclose the same conduct through other applicable civil self-disclosure programs, including HHS-OIG’s Health Care Fraud Self-Disclosure Protocol and CMS’s Self-Referral Disclosure Protocol. This allows companies to evaluate the repayment obligation and administrative relief together, rather than through separate processes.¹²

III. Practical Takeaways Across Both Pathways

• Assess exposure and choose the recipient early. Review the facts for potential criminal, civil and administrative implications before deciding where to disclose. Where potential criminal conduct is implicated, the NFED policy directs companies seeking both CEP and SDP benefits to the Fraud Division first; an HHS-OIG-only filing generally does not preserve CEP voluntary-disclosure treatment. A civil pilot submission should not be treated as criminal protection.
• Do not confuse the pilot deadline with permission to wait. The civil pilot requires a complete filing by April 22, 2027, while criminal CEP qualification generally requires reasonably prompt disclosure before an imminent threat of disclosure or investigation. The CEP encourages early reporting even before an internal investigation is complete. Companies facing both types of exposure should coordinate the criminal disclosure and any civil supplementation rather than delay the first report until a civil submission is ready.
• Define the residual exposure. Map the proposed release against the entities, conduct, time periods and authorities at issue. The civil pilot identifies federal FCA and specified HHS administrative relief, not a general release of state-law claims or other agencies’ authority.¹³ The NFED policy expressly excludes mandatory exclusion from the SDP benefits it extends. Any known or suspected whistleblower matter should be evaluated with counsel when assessing government knowledge and the scope of a proposed resolution.
• Model the total resolution, not just the multiplier. Assess the repayment base, potential criminal restitution or disgorgement, administrative consequences and investigation costs together. The civil pilot’s 1.25–1.6 range is not a single fixed multiplier, and it does not guarantee a faster or cheaper result in every matter. Acquisition-related reviews should also document when legacy misconduct was discovered and how promptly it was remediated.

IV.  Immediate Next Steps

Healthcare and life sciences companies should prioritize a counsel-led review of open investigations, internal reports, audit findings and post-acquisition compliance issues. Identify the affected programs and entities, assess what the government may already know,¹⁴ preserve relevant evidence, and document corrective action. Develop the financial analysis and obtain internal approvals early, while protecting privileged legal advice. The central decision is not simply whether a new program appears attractive, but which disclosure route fits the facts and what protection the resulting resolution would actually provide.