DOJ and HHS Launch Healthcare FCA Self-Disclosure Pilot Program with Fixed Repayment Multiplier

On October 22, 2026, the Department of Justice (“DOJ”) Civil Division and the Department of Health and Human Services (“HHS”) announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (“FCA SDPP”). The program offers healthcare companies a defined path to resolve potential FCA violations the government does not yet know about, in exchange for a “coordinated civil release” and a repayment within a set multiplier range. DOJ says the goal is to free up government resources to focus on “recalcitrant actors.”

Who Is Eligible

The program is open to providers, suppliers, manufacturers, payors, and related entities whose products or services are paid for, directly or indirectly, with federal health care program dollars. The disclosed conduct must be “previously unknown” to the government. If the government already knew of the issue, the company may still seek cooperation credit under Justice Manual Section 4-4.112, but it cannot obtain a resolution under the pilot.

What a Submission Requires

Under FCA SDPP Protocol, a disclosing company must:

• explain the conduct it reasonably believes may violate the FCA, including the legal requirements at issue and the relevant time period;
• attach supporting documents that show how the conduct worked, cross-referenced in its written description;
• describe the corrective steps it has taken to stop the conduct and keep it from recurring;
• supply financial information that allows DOJ to calculate the “Base Self-Disclosure Repayment”; and
• provide a certification from an authorized representative that the submission is truthful and complete, along with a designated point of contact.

Submissions are due by 11:59 PM on April 22, 2027.

What Companies Receive

Participants receive a “coordinated civil release” with “no factual admissions.” DOJ will release the disclosed conduct under the federal FCA, and the resolution also covers certain HHS administrative authorities, namely Medicare enrollment revocation (42 C.F.R. § 424.535) and permissive exclusion (42 C.F.R. §§ 1001.901 and 1001.951). HHS-OIG will not require a Corporate Integrity Agreement. CMS will not impose civil monetary penalties or seek revocation. Companies also need not submit the same conduct under the HHS-OIG Health Care Fraud Self-Disclosure Protocol or the CMS Self-Referral Disclosure Protocol.

The Financial Terms

The repayment will be 1.25 to 1.6 times the “Base Self-Disclosure Repayment.” Where a company lands in that range will depend on how early it came forward, how long and how widespread the conduct was, whether senior leaders were involved, what the company gained, and whether it inherited the problem through a transaction and fixed it quickly.

Notably, the FCA SDPP Protocol departs from the usual approach to calculating the repayment for conduct premised on the Anti-Kickback Statute (“AKS”). The AKS is a criminal statute, but claims resulting from an AKS violation can give rise to civil FCA liability. For purposes of the pilot, the base repayment will not be built on the full amount of claims paid, which is what the government typically seeks in AKS-based FCA cases. Instead, the government will consider the remuneration, the revenue derived from the conduct, and the absence of aggravating factors such as patient harm.

Criminal Conduct

The pilot addresses civil exposure only. As we recently reported, DOJ’s National Fraud Enforcement Division (“NFED”) and HHS-OIG announced a joint policy (the “Policy”) directing companies that wish to self-disclose potential criminal healthcare matters to NFED. A company that makes a criminal disclosure to NFED need not submit it again to the FCA SDPP, although DOJ may ask for supplemental information if the company also wants a civil FCA release.

Takeaways

The pilot fills a gap we identified in our prior coverage, where the Policy made no provision for civil FCA liability. It also follows other recent DOJ developments we have covered, including the Justice Manual revisions on qui tam dismissals and the FOCUS initiative for data miners, suggesting DOJ is pairing aggressive enforcement with a more structured route to resolution.

Several practical points deserve attention. First, the “previously unknown” threshold makes timing critical, and companies should consider whether a whistleblower or data analytics may already have surfaced the issue. Second, the published materials describe a release under the federal FCA and specified HHS authorities, so companies should separately assess how a disclosure may interact with state-law exposure, other agencies, and any qui tam action. Third, conduct that may carry both criminal consequences and civil FCA consequences requires careful coordination, including a decision about where to disclose first. FCA cases premised on AKS violations are a prime example. Because the AKS is a criminal statute, a company that uncovers a potential kickback arrangement will need to decide whether to disclose to NFED under the Policy, seek a civil release under the pilot, or do both, and in what order.

The FCA SDPP Protocol can be accessed here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.