Where should a company report evidence of potential criminal healthcare fraud? Under a new policy, the U.S. Department of Justice (DOJ) says: to us. But tricky questions for companies remain: is the matter really “criminal”? And should it be disclosed at all?
On October 15, 2026, DOJ’s National Fraud Enforcement Division (Fraud Division) and the U.S. Department of Health and Human Services Office of the Inspector General (HHS-OIG) announced a joint policy clarifying where companies should report potential criminal healthcare fraud. Under the policy, a company that makes a qualifying voluntary self-disclosure to the Fraud Division’s Health Care Fraud Section can receive the benefits of both DOJ’s Corporate Enforcement Policy (CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP) without a separate submission to HHS-OIG. A disclosure qualifies only if it meets the CEP’s requirements, which, of course, is determined by DOJ.
Explaining the rationale for the new policy, Assistant Attorney General Colin M. McDonald, who heads the Fraud Division, said companies that uncover fraud should not have to “navigate a maze of agencies” to report it. In DOJ’s view, the policy resolves confusion over whether multiple disclosures are required and offers predictable benefits to companies that come forward, cooperate fully, and remedy misconduct.
The announcement continues DOJ’s push to encourage voluntary self-disclosure, cooperation, and remediation while addressing the overlapping exposure a single course of conduct can create in healthcare matters. It also follows the Fraud Division’s October 1, 2026 directive on corporate fraud enforcement. By coordinating how DOJ and HHS-OIG treat qualifying disclosures, the policy clarifies the potential benefits of coming forward when misconduct falls within both agencies’ authority. More broadly, the federal government continues to elevate the Fraud Division as the centerpiece of national healthcare fraud enforcement.
How the New Policy Works
Under the new joint policy, a company would make a qualifying disclosure of potential federal criminal violations affecting a federal healthcare program to the Fraud Division’s Health Care Fraud Section, which would promptly share it with HHS-OIG. No duplicate submission through the HHS-OIG portal is required. HHS-OIG separately updated its SDP to clarify that criminal conduct should be disclosed to DOJ. Although an HHS-OIG-only self-disclosure generally does not satisfy the CEP’s voluntary disclosure requirement, DOJ may still consider it in evaluating cooperation and remediation.
To obtain the benefits of the coordinated process, a disclosure must still meet the CEP’s requirements to the DOJ’s satisfaction. The CEP generally requires a good-faith disclosure of misconduct previously unknown to DOJ, made before an imminent threat of disclosure or government investigation and within a reasonably prompt time after discovery. The company must also have no preexisting obligation to disclose to DOJ. DOJ encourages early reporting even before an internal investigation is complete. That encouragement carries a tradeoff: a company that discloses early does so before it has a complete picture of the facts.
Absent aggravating circumstances, under the CEP, DOJ states that it will not prosecute a company that makes a qualifying disclosure, fully cooperates, and undertakes timely and appropriate remediation. The company must still pay applicable disgorgement or forfeiture, along with restitution or other compensation to victims.
Where to Disclose Is Clearer. Whether to Disclose Is Not.
The policy answers the threshold question of where to disclose potentially criminal conduct, but it leaves companies with several judgment calls.
For companies considering disclosure, the recipient and timing are critical. The benefit runs in one direction: a disclosure to DOJ earns SDP benefits, but an HHS-OIG-only filing generally does not earn CEP credit, so a company that files first with HHS-OIG for conduct that proves to be potentially criminal may jeopardize a declination. The policy also does not say who decides whether conduct is “potentially criminal,” and a company that errs toward the DOJ door may send a matter to a criminal enforcer that could have been resolved as a civil or administrative issue. Companies should make that assessment, with counsel, at the outset and revisit it as facts develop. Because DOJ encourages reporting before an internal investigation is complete, companies may need to weigh disclosure while the facts are still emerging.
The benefits are conditional, and they have limits. Full cooperation and timely and appropriate remediation remain central to favorable treatment under the CEP, including providing relevant nonprivileged information and addressing the causes of the misconduct. A company that avoids prosecution under the CEP must still make applicable disgorgement or forfeiture and restitution or victim compensation payments. And although the SDP offers an exclusion release without integrity agreement obligations, those benefits do not include resolution of mandatory exclusion — a significant limit for any company that depends on participation in federal healthcare programs.
The policy makes disclosure easier to route, but not necessarily easier to decide. Before disclosing, companies should weigh what the decision sets in motion — cooperation obligations, information demands from enforcement authorities, and potential parallel criminal, civil, and administrative exposure — against the alternatives the facts may support. A company may also end up facing exposure for potential wrongdoing of which the company is not yet aware but which comes to light as the enforcement authorities investigate. In sum, the policy suggests where, but companies and their counsel must still decide whether, when, and on what facts.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
