Contributors

Related

On October 15, 2026, the U.S. Department of Justice (DOJ) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) announced a joint policy aligning their approaches to voluntary self-disclosures of potential criminal health care fraud. 

Under the new policy, a company that voluntarily self-discloses such conduct to DOJ’s National Fraud Enforcement Division, Health Care Fraud Section, will receive the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol.

But the policy is a one-way street. A disclosure made only to HHS-OIG generally will not support a declination under the CEP, and HHS-OIG has revised its protocol to direct potential criminal conduct to DOJ. For companies confronting potentially criminal conduct affecting a federal health care program, the message is clear: disclosure to DOJ is the path to securing the benefits of both policies.

Two aspects of the change warrant particular attention. First, companies must determine whether conduct is potentially criminal before deciding where to disclose, and that determination may not be straightforward. Conduct implicating the Anti-Kickback Statute, for example, may carry both criminal and civil monetary penalty exposure. A company that discloses to HHS-OIG and later determines that the conduct was potentially criminal may have forfeited the opportunity for a declination under DOJ’s CEP. Second, the policy streamlines disclosure, but not the underlying investigative and remediation work. A CEP declination still requires a thorough internal investigation, identification of the individuals involved, and timely remediation, while administrative resolution continues to require quantification of damages.

Overview of DOJ’s and HHS-OIG’s Voluntary Self-Disclosure Policies

DOJ prosecutes criminal health care fraud, and HHS-OIG assists in criminal investigation, and administers civil monetary penalty and exclusion authorities. Each agency maintains a policy that affords leniency in exchange for timely voluntary self-disclosure.

Under the CEP, DOJ will decline to prosecute corporate criminal conduct that a company self-discloses in good faith so long as the misconduct was previously unknown to DOJ; the company had no pre-existing obligation to disclose to DOJ; the disclosure occurred before an imminent threat of disclosure or government investigation; the disclosure was reasonably prompt; the company fully cooperates; the company timely and appropriately remediates; and no aggravating circumstances are present (e.g., pervasive misconduct, severe harm, or corporate recidivism). DOJ’s CEP encourages voluntary self-disclosure “at the earliest possible time, even when a company has not yet completed an internal investigation, if it chooses to conduct one.”

Under the HHS-OIG Protocol, companies that voluntarily disclose health care fraud may obtain benefits in related civil and administrative proceedings. Those benefits include an expedited resolution, reduced damages, and a presumption against implementation of integrity measures. Unlike the CEP, HHS-OIG’s revised Self-Disclosure Protocol expects the investigation to precede the disclosure: a company “is expected to conduct an internal investigation and report its findings to OIG” in its disclosure. 

One Disclosure to DOJ’s Health Care Fraud Section Now Counts Under Both Policies

A single arrangement, such as an illegal kickback or billing for medically unnecessary services, may create criminal, civil, and administrative exposure. Before October 15, a company confronting that overlap had to decide both whether to disclose and where to do so. Under the joint policy, a qualifying voluntary disclosure of suspected health care fraud to DOJ’s Health Care Fraud Section is shared with HHS-OIG, allowing the company to obtain the benefits of both policies through a single submission.

The same is not true of a disclosure to HHS-OIG alone. Such a disclosure generally does not qualify as a voluntary self-disclosure under the CEP. DOJ may credit it as evidence of cooperation and remediation, but it generally will not support a declination.

HHS-OIG’s Revised Protocol Clarifies Where Potentially Criminal Conduct Should Be Disclosed

HHS-OIG simultaneously revised its Health Care Fraud Self-Disclosure Protocol to clarify the appropriate forum for different types of potential misconduct. Potentially criminal conduct should be disclosed to DOJ, while the HHS-OIG Protocol remains available for conduct that may violate HHS-OIG’s civil monetary penalty authorities. Conduct implicating only the physician self-referral law continues to fall outside the HHS-OIG Protocol. The practical significance of the change is therefore not that potentially criminal matters can reach DOJ, which was always the case, but that a company seeking the benefits of both self-disclosure regimes should make its disclosure to DOJ in the first instance. 

What the Policy Does Not Change

The joint policy streamlines the disclosure process but does not reduce the investigative work required to obtain its benefits. Unlike the HHS-OIG Protocol, the CEP does not require a completed internal investigation before disclosure. But obtaining a declination under the CEP requires full cooperation, including disclosure of all relevant non-privileged facts, identification of the individuals involved, and attribution of facts to specific sources, as well as timely remediation, including root-cause analysis. Companies therefore still need to conduct a thorough internal investigation and quantify damages to resolve potential administrative liability.

Key Takeaways

The joint policy continues the approach reflected in DOJ’s recent corporate enforcement directive (see our alert here) and its directive on fraud prosecutions (see our alert here): incentives for prompt voluntary disclosure, paired with increasingly aggressive enforcement against companies that do not come forward.

  • Escalate potential health care fraud to counsel promptly. Because the appropriate forum for disclosure, and the availability of a potential declination, may depend on whether the conduct is potentially criminal, that assessment should be made early and under privilege. Hotline reports, audit findings, or other indications of potential misconduct involving kickbacks, billing practices, or excluded individuals should be escalated to counsel before a disclosure decision is made.
  • Disclose promptly, but plan for the full investigation. The CEP does not require a completed internal investigation before disclosure, and companies should not delay a potential disclosure simply to complete the investigation contemplated by the HHS-OIG Protocol. The joint policy does not, however, reduce the work ultimately required to obtain its benefits. Companies should scope the investigation from the outset to address the requirements of both regimes, including full cooperation, identification of responsible individuals, appropriate remediation, and quantification of damages.
  • Choose the disclosure forum carefully. Conduct involving only civil or administrative exposure may still be disclosed directly to HHS-OIG. But where the conduct is potentially criminal, a disclosure to HHS-OIG alone generally will not qualify as a voluntary self-disclosure under the CEP or support a declination. Companies should therefore assess potential criminal exposure before selecting the disclosure path.
  • Consider the potential False Claims Act benefits of disclosure. A voluntary disclosure may provide benefits beyond the CEP and HHS-OIG Protocol. Depending on how the disclosed allegations or transactions subsequently enter the public domain, the False Claims Act’s public disclosure bar may provide an additional defense against a later qui tam action. Companies should consider that potential protection, as well as the original-source exception, when assessing the timing and scope of disclosure. 
  • Maintain compliance procedures that support early detection and escalation. An effective compliance program remains the first line of defense. Health care companies should have mechanisms to identify potential fraud promptly, escalate significant allegations to appropriate decision-makers, preserve relevant information, and evaluate potential criminal exposure before making a disclosure.

Womble Bond Dickinson (US) LLP’s White Collar Defense and Criminal Investigations Team navigates domestic and international clients in all manner of white collar, regulatory, corporate and congressional investigations. Our team includes a distinguished roster of veteran defense attorneys, former federal prosecutors and U.S. Attorneys who served at the highest levels of the Department of Justice and at leading United States Attorneys’ Offices. Our team includes Chambers Ranked (Band 1) lawyers and alumni of the U.S. Department of Justice, the SEC’s Enforcement Division, the U.S. Senate, House of Representatives, and in-house compliance specialists of publicly traded companies.