On October 15, 2026, the U.S. Department of Justice (“DOJ”) National Fraud Enforcement Division (“Fraud Division”) and the U.S. Department of Health and Human Services Office of the Inspector General (“HHS-OIG”) announced a joint policy (“Policy”) designed to streamline the voluntary self-disclosure process for potential criminal health care fraud.
Background
Historically, federal health care providers and suppliers have had several avenues for voluntarily disclosing misconduct. Two of the most significant are DOJ’s Corporate Enforcement Policy (“CEP”) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (“SDP”).
Under the CEP, companies that voluntarily self-disclose criminal misconduct, fully cooperate with DOJ’s investigation and timely remediate may receive substantial benefits, including a presumption of declination in appropriate circumstances. Separately, the SDP allows health care entities to disclose conduct that may violate federal health care program requirements and potentially resolve administrative and civil liability on more favorable terms. Among other benefits, the SDP may provide for a faster resolution, reduced multiplier and exclusion release without integrity agreement obligations. Notably, however, participation in the SDP does not resolve potential mandatory exclusion obligations.
Because a single health care arrangement may implicate criminal, civil and administrative authorities simultaneously, providers have often faced uncertainty regarding the appropriate disclosure path. In a press release announcing the Policy, Colin M. McDonald, Assistant Attorney General of DOJ’s Fraud Division, described these challenges as “unnecessary bureaucratic barriers.” The Policy attempts to streamline that process by allowing qualifying entities to obtain the benefits of both DOJ’s CEP and HHS-OIG’s SDP through a single disclosure to DOJ.
The Policy
Under the Policy, an entity may obtain benefits of both DOJ’s CEP and HHS-OIG’s SDP through a single disclosure to DOJ’s Health Care Fraud Section. DOJ will then provide the disclosure to HHS-OIG, eliminating the need for a separate SDP submission.
The Policy also clarifies the reverse scenario. HHS-OIG concurrently updated the SDP to state expressly that criminal health care matters should be disclosed to DOJ. As a result, a company that discloses only to HHS-OIG generally will not qualify for a DOJ declination under the CEP. Companies seeking the benefits of both programs should therefore report potentially criminal conduct to DOJ first. To receive those benefits, the disclosure must satisfy the CEP’s requirements for timeliness, voluntariness, cooperation and remediation. The Policy further notes that disclosures made only to HHS-OIG may still be considered by DOJ as part of its evaluation of a company’s cooperation and remediation efforts, even if they do not qualify as a voluntary self-disclosure under the CEP. Importantly, the Policy applies to qualifying disclosures made on or after October 15, 2026.
Although the Policy largely answers where companies should disclose potential health care fraud, it does not answer the often more difficult question: whether the conduct is potentially criminal in the first place. Because choosing the wrong disclosure path can carry significant consequences, companies should assess potential criminal exposure and disclosure strategy with counsel early in any internal investigation.
Practical Takeaways
- One disclosure, two potential benefits. One disclosure may now be sufficient to obtain benefits under both DOJ’s CEP and HHS-OIG’s SDP, eliminating the need for duplicative submissions and providing a more streamlined voluntary self-disclosure process.
- The benefit is not reciprocal. A qualifying disclosure to DOJ may unlock the benefits of both the CEP and the SDP, but a disclosure made only to HHS-OIG generally will not satisfy the CEP’s voluntary disclosure requirements. As a result, companies that report solely to HHS-OIG risk losing eligibility for a DOJ declination if the conduct is later determined to be potentially criminal. Although such a disclosure may still be considered as part of DOJ’s assessment of cooperation and remediation, it generally will not qualify as a voluntary self-disclosure under the CEP.
- Disclosure strategy still matters. The Policy simplifies the disclosure process, but not the disclosure decision. Companies must still evaluate whether to disclose, when to disclose and whether they can satisfy DOJ’s expectations regarding cooperation and remediation.
For more information about these developments, or if your organization needs assistance in assessing pending or future HHS-OIG self-disclosures in light of the Policy, please contact:
- Brandon Helms at (248) 457-7847, or bhelms@hallrender.com;
- Katherine Kuchan at (414) 721-0479, or kkuchan@hallrender.com;
- Matthew Schappa at (317) 633-4847, or mschappa@hallrender.com;
- Kennedy Bunch at (317) 977-1420, or kbunch@hallrender.com;
- Taylor Moorer at (202) 370-9584, or tmoorer@hallrender.com; or
- Your primary Hall Render contact.
Hall Render blog posts and articles are intended for informational purposes only. For ethical reasons, Hall Render attorneys cannot—outside of an attorney-client relationship—answer specific questions that would be legal advice.
