DOJ Fraud Division and HHS-OIG Announce Joint Self-Disclosure Policy, Directing Healthcare Companies to Bring Potential Criminal Matters to DOJ First

On October 15, 2026, the Department of Justice’s National Fraud Enforcement Division (“NFED”) and the Department of Health and Human Services Office of Inspector General (“HHS-OIG”) announced a joint policy (the “Policy”) directing companies seeking to self-disclose potential criminal healthcare matters to NFED’s Health Care Fraud Section. The Policy promises companies deemed to have made good faith, voluntary self-disclosures credit under both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Self-Disclosure Protocol. It arrives two weeks after the Fraud Division issued Directive 26-12, Corporate Enforcement in the Fight Against Fraud (the “Directive”), in which NFED identified healthcare fraud as its top priority.  You can read more about the Directive here.

The New Self-Disclosure Policy: One Disclosure, Two Agencies

A Single Front Door

The Policy identifies a practical problem facing healthcare organizations that identify compliance issues:  one set of facts, such as a kickback arrangement or a coding and billing problem, “frequently gives rise to overlapping criminal, civil, and administrative matters” involving both NFED’s Health Care Fraud Section and HHS-OIG. For a company that uncovers conduct that may be criminal, the question is therefore not only whether to come forward, but also to which agency and office to disclose the conduct. Under the Policy, a company that voluntarily self-discloses possible criminal violations affecting a Federal health care program to NFED’s Health Care Fraud Section receives the benefits of both DOJ’s CEP and HHS-OIG’s Self-Disclosure Protocol (“SDP”):

• Under the CEP, there are three levels of benefits that attach to self-disclosures and other forms of cooperation. Under Part 1, a company that self-reports voluntarily, cooperates fully, and remediates in a timely and appropriate manner can receive a declination, unless aggravating circumstances are present.[1]
• Under the SDP, which resolves liability for civil monetary penalties, the company can expect to resolve the matter more quickly, at a lower multiplier, and with a release of HHS-OIG’s permissive exclusion authorities without a corporate integrity agreement.

The Disclosure Must Qualify

These benefits are available only if the disclosure goes to NFED, and meets every requirement the CEP sets for a voluntary self-disclosure. In short, the company must (1) report in good faith to NFED; (2) report conduct DOJ did not already know about; (3) not have been legally required to report it; (4) report before disclosure or a government investigation was imminent; and (5) report reasonably soon after learning of the misconduct. The Policy is somewhat forgiving on the first requirement. As under the CEP, a “good faith disclosure to . . . other Department of Justice components will also qualify” under the Policy.

However, a disclosure only to HHS-OIG through the SDP will not qualify as voluntary self-disclosure under the Policy and so would ordinarily fall short of the requirements for a Part I declination. Indeed, the SDP is designed for self-reporting of conduct that may trigger civil monetary penalties, and HHS-OIG is revising the SDP to make clear that it cannot be used to report criminal violations. A company that wants both sets of benefits should therefore go to NFED first if the conduct at issue may be criminal.

Still, other disclosures are not worthless if a criminal resolution ultimately becomes necessary. A report made only to HHS-OIG, or to another regulator or civil enforcement body, may still earn the company credit when DOJ assesses its cooperation and remediation. So, the Policy leaves intact any credit available for cooperation, remediation, or other mitigating factors under the CEP, DOJ’s Principles of Federal Prosecution of Business Organizations (Justice Manual § 9-28.000), or the U.S. Sentencing Guidelines.

No Provisions for False Claims Act Liability

Despite the Policy’s acknowledgement that there is frequently overlapping civil liability with potential criminal healthcare fraud, and despite the reality that the civil False Claims Act is in many respects the government’s most significant enforcement tool – used to extract almost $6B from the industry in 2025 alone – the Policy makes no mention of cooperation with the Civil Division’s Civil Fraud’s Section on disclosures of issues that implicate the statute.  This is a significant gap for the Department to address if it wants to encourage self-disclosures by healthcare companies.

Takeaways for Healthcare Companies

Read together, the Directive and the Policy show DOJ both pursuing healthcare fraud aggressively and encouraging companies to come forward. The Policy removes uncertainty about where to report potential criminal violations of healthcare laws, but it leaves companies without a similar program addressing False Claims Act liabilities.  Nonetheless, a company that identifies potential criminal conduct that touches a Federal health care program should promptly evaluate a disclosure to NFED’s Health Care Fraud Section rather than rely on an HHS-OIG submission alone. Maintaining compliance monitoring that surfaces potential misconduct early will help companies preserve the option to disclose.

The Policy can be found here, Directive 26-12 can be found here, and the CEP is available here.

[1] Part II is a “near miss” tier offering reduced resolution terms to companies that cooperate and remediate but do not qualify for a declination. Part III covers everything else and gives prosecutors discretion to decide the form of the resolution.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.