A healthcare company that discovers questionable billing or a problematic financial arrangement needs to determine what happened before it chooses how to report it. An overpayment, a potential civil fraud violation and potentially criminal conduct can require different responses. The labels used in an internal email do not decide which problem the company has.
Two October 2026 policies make that assessment especially important. On October 15, DOJ and HHS-OIG announced coordination for qualifying disclosures of potential criminal healthcare conduct. A week later, DOJ’s Civil Division and HHS launched a six-month False Claims Act (FCA) self-disclosure pilot. HHS-OIG’s current routing FAQ, listed as updated November 2, distinguishes the available paths. They should be read together, not treated as a single offer of immunity.
What the civil pilot offers
The October 22 announcement describes a coordinated civil resolution for eligible healthcare companies. It includes a federal FCA release for disclosed conduct and specified HHS administrative relief. Repayment uses a 1.25 to 1.6 multiplier on the program’s defined Base Self-Disclosure Repayment, with the multiplier affected by factors including timing, scope, senior leadership involvement and remediation.
The three-page protocol limits participation to potential FCA violations previously unknown to the federal government. A matter already known to the government may still receive credit under other applicable policies, but it does not qualify for this pilot on that basis. The protocol requires a complete account, supporting documents, remediation information, financial information and an authorized representative’s certification. Late or partial submissions will not be accepted or reviewed.
Submissions are due April 22, 2027. A company should not mistake that closing date for permission to defer assessing other reporting, repayment or preservation obligations. Nor should it assume every matter’s base repayment is calculated the same way. The protocol provides different illustrations, including an acquisition-related kickback example. The calculation needs to be tested against the conduct and the program’s actual terms.
Potential criminal conduct requires its own assessment
The October 15 coordination policy says a qualifying disclosure of potential criminal conduct to DOJ’s Fraud Division Health Care Fraud Section can obtain the benefits of both the Corporate Enforcement Policy and HHS-OIG’s self-disclosure protocol without a duplicate OIG portal submission. Disclosure only to OIG generally does not qualify as a voluntary self-disclosure to DOJ. The policy preserves credit considerations and recognizes qualifying good-faith disclosures to other DOJ components.
The civil pilot expressly addresses the overlap: a company disclosing potentially criminal conduct must use the criminal process. If it also seeks a civil FCA release under the pilot, supplemental information may be requested as necessary rather than a duplicative submission. The civil release is therefore not a substitute for addressing potential criminal exposure. The coordination policy also expressly excludes resolution of mandatory exclusion from its description of OIG-protocol benefits.
These benefits have conditions. A disclosure must qualify under the applicable policy, and cooperation and remediation matter. The criminal coordination document disclaims enforceable rights or benefits. A company should evaluate the proposed resolution and its remaining exposure rather than assume that sending a report guarantees a declination or resolves every proceeding.
The existing routes still matter
HHS-OIG’s current FAQ directs criminal conduct to DOJ; OIG administrative matters to its protocol; combined FCA and specified OIG/CMS matters to the FCA pilot; and physician self-referral matters without FCA implications to CMS’s voluntary protocol. The updated OIG protocol separately explains that matters involving only overpayments or errors, without potential violations within its civil monetary penalty authority, belong with the appropriate payer refund process. Selecting a route begins with the conduct, not a preference for the lowest advertised multiplier.
Questions to answer before submission
The response should start with records that can be tested. Preserve relevant billing data, contracts, communications and prior audit material. Establish a chronology of the conduct, its discovery, any government inquiry and corrective steps. Determine which entities and individuals were involved, what they knew and which claims or payments were affected. Counsel should assess privilege, who the investigation represents and whether different participants’ interests require separate attention.
Then examine the proposed disclosure as a whole. Does it accurately distinguish established facts from unresolved questions? Do the financial methods match the records? Has the conduct ended, and can the company demonstrate the remediation it describes? Which releases are actually being requested, and which criminal, state, licensing or other issues would remain outside them? The relevant policies must be checked again before submission, together with any independent deadlines.
A coordinated process can reduce duplication. It does not remove the need for a careful investigation or a deliberate disclosure decision. The company needs a defensible understanding of the facts and of what each available process can resolve.
Charles Rollins represents individuals and businesses in white collar and healthcare fraud matters. Learn more at Charles Rollins, PC. General information, not legal advice. Contacting the firm does not create an attorney-client relationship; do not send confidential records before representation is agreed upon.