DOJ, HHS-OIG Announce Single-Point Self-Disclosure Policy for Criminal Healthcare Fraud

Healthcare companies that uncover potential misconduct have long faced a threshold question before any decision to disclose: which federal agency to approach. As the U.S. Department of Justice (DOJ) acknowledged in an October 15, 2026, press release, "a single arrangement – an illegal kickback, a scheme to bill Medicare for medically unnecessary services or a scheme concealing an excluded provider – routinely may result in potential criminal, civil or administrative consequences." That overlap forced companies to choose between DOJ and the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG), often without clarity on whether multiple disclosures were needed to receive the full benefits of voluntary self-disclosure.

The Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters, issued jointly by the two agencies, resolves that question by designating DOJ's National Fraud Enforcement Division (Fraud Division) as the single point of contact for potentially criminal conduct, with HHS-OIG extending the benefits of its Health Care Fraud Self-Disclosure Protocol (SDP) to disclosures made to DOJ.

The policy is the latest initiative of the Fraud Division, which DOJ created on April 7, 2026, in support of the second Trump Administration's Task Force to Eliminate Fraud, chaired by Vice President JD Vance. The Fraud Division centralized supervision of DOJ's fraud enforcement components, including the former Criminal Division Health Care Fraud Unit, under Assistant Attorney General (AAG) Colin McDonald, with nationwide authority over investigation, prosecution and coordination. (See Holland & Knight's previous alert, "DOJ Establishes National Fraud Enforcement Division," April 15, 2026.)

On October 1, 2026, AAG McDonald also issued Directive 26-12, "Corporate Enforcement in the Fight Against Fraud," which identified healthcare fraud as one of the Fraud Division's four enforcement priorities and reaffirmed that prosecutors must follow DOJ's Corporate Enforcement Policy (CEP). (See Holland & Knight's previous alert, "DOJ Fraud Division Issues New Corporate Enforcement Priorities," October 2, 2026.) The Fraud Division's Health Care Fraud Section operates nine strike forces nationwide, and the October 15 press release reports that it "has charged more than 6,200 defendants who collectively billed federal health care programs and private insurers more than $45 billion since 2007."

The New Self-Disclosure Policy

1 Disclosure, 2 Sets of Benefits

Under the policy, a company that voluntarily self-discloses criminal conduct affecting a federal healthcare program to the Fraud Division's Health Care Fraud Section will receive the benefits of HHS-OIG's SDP "automatically, with no additional direct submission necessary through the HHS-OIG portal." The company also remains eligible for the benefits of the CEP.

AAG McDonald framed the policy as eliminating "unnecessary bureaucratic barriers that have caused confusion about whether companies must make multiple disclosures of potentially criminal conduct," adding that there is "now one clear point of contact: DOJ's Fraud Division." HHS Inspector General T. March Bell stated that HHS-OIG is "committed to extending the benefits of the HHS-OIG Self-Disclosure Protocol" to companies that disclose criminal conduct to DOJ.

The Reverse Rule: HHS-OIG-Only Disclosures

HHS-OIG's companion update to the SDP addresses the opposite scenario. The SDP covers conduct that may violate civil or administrative law, and it now clarifies that criminal conduct should be disclosed to DOJ. Importantly, a company that discloses only to HHS-OIG generally will not be considered to have made a voluntary self-disclosure to DOJ and generally not qualify for a declination on that basis. DOJ's guidance is explicit: "Companies seeking the benefits of both programs should bring potentially criminal conduct to the Fraud Division first."¹

Eligibility and Conditions

There are several elements to the new policy that, when read together, indicate who qualifies for dual credit and on what terms:

• A Company That Voluntarily Self-Discloses. The policy applies to "any voluntary self-disclosure of potential criminal violations of Federal law affecting one or more Federal healthcare programs … made to the Fraud Division on or after the effective date of this Policy." (Policy Section 3(A).)
• Criminal Conduct Affecting a Federal Healthcare Program. Automatic SDP benefits attach to a voluntary self-disclosure of criminal conduct affecting a federal healthcare program. The release identifies illegal kickbacks, billing Medicare for medically unnecessary services and concealing an excluded provider as examples of arrangements that may carry criminal, civil or administrative consequences.
• Disclosure to the Health Care Fraud Section. The disclosure should be made to the Fraud Division's Health Care Fraud Section, which may be reached at enforcement@usdoj.gov.² Benefits then follow "automatically, with no additional direct submission necessary through the HHS-OIG portal."
• Company Comes Forward, Cooperates Fully and Remedies the Misconduct. AAG McDonald tied the benefits to three steps: "[i]f a company comes forward, cooperates fully, and remedies the misconduct, the benefits are clear and predictable." By contrast, a company that "conceals what it knows … should expect a very different conversation."
• Bring Potentially Criminal Conduct to the Fraud Division First. A company that discloses only to HHS-OIG "generally will not have made a voluntary self-disclosure to the Department and generally will not qualify for a declination on that basis." The word "generally" suggests some room for exceptions, but the release offers no guidance on when one would apply.

Significance of the Policy

Greater Predictability for Overlapping Exposure

The policy removes a meaningful source of friction for companies weighing disclosure of conduct that may straddle criminal and civil/administrative lines. Rather than coordinating parallel submissions, a company with potentially criminal exposure can now make a single disclosure and obtain credit under both programs. That predictability may make disclosure a more attractive option in close cases.

Higher Stakes for Forum Selection

The flip side is that disclosure to the wrong agency now carries real consequences. Companies may understandably be more comfortable disclosing civil exposure than criminal exposure, but the new policy heightens the risk of making the wrong choice. If a company discloses conduct as a civil or administrative matter and DOJ later concludes that the conduct was criminal, the company may have forfeited declination eligibility, lost the timing advantages of a voluntary disclosure and given the government a factual record that can be used to build a criminal case against the company or its personnel.

These risks are greatest where the line between civil and criminal conduct is difficult to draw, as in matters implicating the federal Anti-Kickback Statute (AKS), a criminal statute that also routinely serves as the predicate for civil False Claims Act (FCA) liability. Many AKS-based FCA matters are handled solely by DOJ's civil components, yet the same facts can support either path, often depending on nuanced questions of intent, knowledge and individual conduct.

A misjudgment at this stage can be difficult or impossible to undo. The early assessment of whether conduct is potentially criminal is therefore a consequential judgment that warrants counsel with integrated healthcare, FCA and white-collar criminal defense experience.

An Aggressive Enforcement Backdrop

The announcement pairs its incentives with a clear warning that companies who conceal potentially criminal conduct "should expect a very different" from those who do disclose, and it arrives amid a visible enforcement push, including recent sentencings in a nearly $270 million Medi-Cal medication reimbursement scheme and a $34.8 million orthotic brace scheme targeting Medicare beneficiaries. DOJ also noted that the Centers for Medicare & Medicaid Services, working with HHS-OIG, is taking steps to hold providers accountable for involvement in healthcare fraud schemes.

Key Takeaways

1. Assess Potential Criminality with Experienced Counsel: For AKS-related and other overlapping civil/criminal conduct, engage counsel with healthcare, FCA and criminal defense experience before deciding how to characterize and where to disclose the conduct.
2. Route Criminal Matters to DOJ's Health Care Fraud Section First: When disclosing potentially criminal conduct, disclose to the Health Care Fraud Section to obtain both DOJ and HHS-OIG credit. An HHS-OIG-only disclosure risks forfeiting a DOJ declination.
3. Update Escalation Protocols: Revise compliance policies and investigation playbooks to designate who decides whether conduct is potentially criminal and underscore the need for prompt decision-making.
4. Reassess Pending SDP Matters: Evaluate whether pending or planned HHS-OIG submissions with potential criminal dimensions warrant disclosure to the Fraud Division under the new policy.
5. Prepare to Cooperate and Remediate: Benefits depend on full and timely cooperation and remediation, so be ready to preserve evidence, investigate credibly and fix root causes.
6. Act Promptly: DOJ warns that concealment brings "a very different conversation"; move quickly from discovery to a disclosure decision.

Holland & Knight continues to monitor developments related to DOJ and HHS-OIG healthcare fraud enforcement. For additional information or questions, please contact the authors.

Notes

¹ The updated 2026 HHS-OIG protocol provides: "SDP is not available for disclosure of Federal crimes. Criminal self-disclosures should be disclosed to the Department of Justice (DOJ)."

² Notably, the policy states that a "disclosure discussed herein constitutes a voluntary self-disclosure to the Fraud Division only if it is made to the Fraud Division." Elsewhere, however, the policy acknowledges that, consistent with the CEP, good faith disclosures to others in the Fraud Division or other DOJ components "will also qualify for credit."

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.