DOJ, HHS Announce One-Stop Shop for Companies Voluntarily Disclosing Potential Health Care Fraud

In the latest wave of press releases ramping up the new National Fraud Enforcement Division (NFED), the Department of Justice (DOJ) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) announced a new policy (the “Coordination Policy”) on October 15, 2026, directing that companies seeking to voluntarily self-disclose potential criminal conduct relating to health care should now make self-disclosures to NFED.

Such disclosures will automatically trigger both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP).

A company disclosing only to HHS-OIG generally will not receive the benefits of DOJ’s CEP covering criminal conduct and will not be deemed to have made a voluntary self-disclosure to DOJ. This is critical, since a voluntary self-disclosure to DOJ could qualify a company for a declination. Consequently, companies seeking the benefits of both programs should disclose potentially criminal conduct to NFED first.

The NFED Coordination Policy: Where to Disclose

The new NFED Coordination Policy notes that “an illegal remuneration arrangement, a scheme to bill for medically unnecessary services,” or a scheme involving a person excluded from federal health benefits programs could mean overlapping violations of criminal, civil, and/or administrative law involving both DOJ and HHS-OIG. Yet a company generally needs to make only one voluntary self-disclosure to DOJ’s NFED within the meaning of the CEP—i.e., related to conduct involving a “federal health care program,” as defined in 42 U.S.C. § 1320a-7b(f), “Criminal penalties for acts involving Federal Health Care Programs”—to receive the benefits of both the DOJ CEP and the HHS-OIG SDP. A company that identifies potentially criminal conduct must decide not only whether to disclose, but where.

DOJ CEP: Whether to Disclose

Under the DOJ CEP, which remains unchanged, DOJ will decline to prosecute a company for criminal conduct when the following four factors are met:

1. The company voluntarily self-disclosed the misconduct to an appropriate [DOJ] criminal component;
2. The company fully cooperated with [DOJ’s] investigation;
3. The company timely and appropriately remediated the misconduct; and
4. There are no aggravating circumstances related to the nature and seriousness of the offense, egregiousness or pervasiveness of the misconduct within the company, severity of harm caused by the misconduct, or corporate recidivism, specifically, a criminal adjudication or resolution either within the last five years or otherwise based on similar misconduct by the entity engaged in the current misconduct.

Beyond a declination, the CEP offers companies other options that health care companies should weigh before disclosing potential criminal conduct:

• “Near Miss” Voluntary Self-Disclosures or Aggravating Factors (CEP Part II): Companies that fully cooperate and timely remediate but fall short of declination because their report did not meet the definition of a “voluntary self-disclosure,” or because aggravating factors warrant a criminal resolution, must receive a non-prosecution agreement absent “particularly egregious or multiple aggravating circumstances.” DOJ must:
  • allow a term length of fewer than three years;
  • forgo an independent compliance monitor; and
  • reduce the fine by at least 50 percent but no more than 75 percent off the low end of the U.S. Sentencing Guidelines fine range.

HHS-OIG SDP: Civil Monetary Penalties

A new October 2026 version of the HHS-OIG’s SDP clarifies that the SDP “is not available for disclosure of Federal crimes. Criminal self-disclosures should be disclosed to the Department of Justice [NFED].” All health care providers, suppliers, or other persons subject to civil monetary penalty authorities found at 42 C.F.R. Part 1003 are eligible to use the SDP by submitting disclosures through the HHS-OIG website, in the manner described in the SDP. The SDP provides the following:

• Companies may disclose potential violations of federal laws that carry civil monetary penalties, such as false billing and Anti-Kickback Statute (AKS) violations. The SDP has specific requirements for conduct involving false billing, conduct involving excluded persons, and conduct involving the AKS and Physician Self-Referral Law. 
• Disclosing parties should disclose conduct for which they may be liable, including potential successor liability based on their purchase of another entity.
• Disclosing parties already subject to government investigations, audits, or other oversight activities may still use the SDP if the disclosure is made in good faith and not an attempt to circumvent any ongoing inquiry.
• Disclosing parties subject to corporate integrity agreements may use the SDP.

In addition to federal crimes, the SDP is not available for:

• matters that do not involve potential violations of federal law for which civil monetary penalties are authorized, such as matters involving overpayments or errors (instead, disclose them to the Centers for Medicare & Medicaid Services (CMS));
• requests for HHS-OIG opinions regarding whether, for example, an arrangement violates the Anti-Kickback Statute;
• disclosures of arrangements involving only liability under the Physician Self-Referral Law, without accompanying potential liability under the AKS for the same arrangement (disclose matters involving only liability under the Physician Self-Referral Law to CMS); and
• conduct more appropriately disclosed under HHS-OIG’s grant self-disclosure or contractor self-disclosure programs.

Exclusion Is Not Resolved by Disclosure

Under the new Coordination Policy, SDP benefits do not include resolution of mandatory exclusion under 42 U.S.C. § 1320a-7(a).

Takeaways

• Bring potentially criminal conduct to the NFED first. Under the Coordination Policy, a voluntary self-disclosure to DOJ NFED triggers SDP benefits without a separate HHS-OIG submission. A disclosure only to HHS-OIG generally does not qualify as a voluntary self-disclosure to DOJ.
• Sort the conduct before disclosing. The SDP covers only conduct that carries civil monetary penalties, while DOJ handles criminal violations. Illegal remuneration and billing schemes often raise overlapping liability.
• Treat voluntary disclosure as only one CEP factor. The CEP also requires full cooperation, timely remediation, and no aggravating circumstances. A company that falls short of full eligibility may still qualify for a non-prosecution agreement with a reduced fine.
• Expect to pay above single damages. The SDP generally requires a minimum of 1.5 times single damages, with minimum settlements of $100,000 for kickback matters and $20,000 for other conduct. SDP benefits do not resolve mandatory exclusion, and a criminal resolution may carry different terms.
• Cooperate fully and acknowledge potential violations. Submissions must acknowledge potential violations, and disputing them can delay resolution. Companies that fail to cooperate in good faith will be removed from the SDP.
• Do not assume that reporting to NFED automatically resolves civil exposure under the False Claims Act (FCA). FCA liability exists whether or not a company discloses, and whistleblowers may file FCA qui tam suits regardless of disclosure. A company seeking an FCA release must expressly ask DOJ to resolve FCA liability, because HHS-OIG cannot release those claims.

* * * *

If you have questions, please reach out to the author(s).

The Health Law Advisor blog is currently edited by Emily Chi Fogler.

Epstein Becker Green Staff Attorney Ann W. Parks contributed to the preparation of this post.