The U.S. Department of Justice (DOJ) Civil Division, the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG), and the Centers for Medicare & Medicaid Services (CMS) have announced a new FCA SDPP for health care entities.
What You Need to Know
|
The SDPP is available to resolve potential violations of 31 U.S.C. § 3729 et seq., as well as HHS administrative violations resulting in revocation of Medicare enrollment (42 C.F.R. § 424.535), exclusions for false or improper claims (42 C.F.R. § 1001.901), and exclusions based on fraud and kickbacks (42 C.F.R. § 1001.951).
“For companies unwilling to take accountability, the Civil Division, in partnership with whistleblowers, will root out the fraud,” Assistant Attorney General Brett A. Shumate said in the DOJ announcement.
Who Can Participate
Entities eligible for the SDPP, according to the DOJ announcement, are health care “providers, suppliers, manufacturers, payors, and related entities that furnish, arrange for, manufacture, distribute, insure, administer, or bill for items or services reimbursed, subsidized or otherwise paid for, directly or indirectly, by HHS Federal health care programs[.]”
How to Participate
To take advantage of the SDPP, these entities must supply the following by 11:59 p.m. on April 22, 2027:
- Disclose a potential FCA violation previously unknown to the federal government. (If the government was aware, the disclosing company will still be eligible for self-disclosure and cooperation credit under § 4-4.112 of the DOJ Justice Manual (JM), though it cannot resolve the conduct by participating in the SDPP.)
- Describe all relevant details relating to the disclosing company’s conduct that, in its reasonable assessment, potentially violates the FCA, including the specific laws, regulations, or other binding requirements that were violated, and the time period.
- Documents. Append as exhibits all documents sufficient to fully reflect the nature, terms, and operation of the disclosed potential FCA violations. (The written description and the exhibits should be cross-referenced.)
- Remedial actions. Describe remedial measures or other corrective actions taken to end the FCA violations and prevent them from recurring (examples of such measures are in JM 4-4.112).
- Supply financial information sufficient for DOJ to calculate a base self-disclosure repayment, which DOJ then adjusts with a 1.25 to 1.6 multiplier, depending on factors including the timeliness of the self-disclosure, the duration and scope of the misconduct, the involvement of senior leadership, the financial benefit to the disclosing company, and whether the disclosing company has successor liability for the misconduct but promptly remediated.
- Certification and contact information. Certify, through an authorized representative, that the submission contains truthful and complete information and provide a phone number and email address of a designated point of contact.
Why Participate?
Participating entities will receive a coordinated civil release from liability, with no factual admissions, under the FCA and HHS administrative authorities. OIG shall not require a Corporate Integrity Agreement as part of any resolution of OIG’s exclusion authorities, and CMS shall not impose civil monetary penalties or seek revocation. The release covers only the federal FCA and the listed HHS authorities and does not resolve state law exposure, so companies should assess that separately.
Key Takeaways
DOJ notes that the new civil SDPP builds on DOJ’s Corporate Enforcement Policy for criminal matters, launched in March 2026; and its new Self-Disclosure Protocol for criminal health care fraud, launched by DOJ’s National Fraud Enforcement Division (NFED) on October 15, 2026 (see related Epstein Becker Green blog post here.) Entities may want to coordinate both civil and criminal self-disclosure with respect to violations of the AKS.
Companies that disclose potential criminal conduct to NFED need not make a duplicate submission to the SDPP, which covers potential civil and administrative violations, although DOJ may request supplemental information if the company also wants a civil FCA release.
The takeaway is that health care entities with potential exposure should evaluate disclosure now rather than later. The six-month window is short, and the government is increasingly incentivizing whistleblowers to surface misconduct. Under the FCA, qui tam relators may receive 15 to 25 percent of any recovery when the government intervenes, and 25 to 30 percent when it does not. On the criminal side, NFED’s new Fraud Whistleblower Incentive Program pays upfront awards for information leading to criminal charges.
Several practical points stand out. First, because the SDPP covers only conduct previously unknown to the government, timing is critical, and companies should consider whether a whistleblower or data analytics may already have surfaced the issue. Second, the release covers only the federal FCA and the listed HHS authorities, so state-law exposure, other agencies, and any pending qui tam action need separate assessment. Third, conduct that may carry both criminal and civil consequences, such as a potential kickback arrangement, requires a decision about where and in what order to disclose. For kickback-based conduct, the base repayment is not built on the full amount of claims paid, as is typical in AKS-based FCA cases; DOJ will instead consider the remuneration, the revenue derived from the conduct, and the absence of aggravating factors such as patient harm.
Submissions for the SDPP will be accepted through April 22, 2027, electronically to FCA-SDPP@usdoj.gov. Late or incomplete submissions will not be reviewed, so entities should plan accordingly. Questions may be directed to the authors.
* * * *
If you have questions, please reach out to the author(s).
The Health Law Advisor blog is currently edited by Emily Chi Fogler.
Epstein Becker Green Staff Attorney Ann W. Parks contributed to the preparation of this post.
Authors
Member of the Firm
Member of the Firm