DOJ and HHS-OIG unify the path for healthcare fraud self-disclosure
The Department of Justice and the Department of Health and Human Services Office of Inspector General have moved to a single-entry disclosure model for healthcare organizations that uncover potential criminal fraud. Under the new policy, organizations are directed to bring potential criminal matters to DOJ alone, while still preserving the civil and administrative advantages associated with the HHS-OIG process.
The change is designed to reduce the procedural friction that can discourage voluntary disclosure in the first place. In practical terms, a company that discovers questionable conduct inside its own operation no longer faces the same uncertainty about whether it must approach multiple agencies to secure the available benefits. For an industry where the same arrangement can trigger criminal exposure, civil monetary penalties, and administrative consequences such as program exclusion, that simplification carries real weight.
One sentence captures the shift plainly: there is now one principal doorway for potential criminal healthcare fraud disclosures.
Declination incentives now sit at the center of the new policy
Both agencies have long maintained disclosure pathways that can soften the blow when an organization comes forward before the government knows about the conduct. Under DOJ’s framework, voluntary self-disclosure can lead to a declination of corporate criminal prosecution. Under HHS-OIG’s process, disclosure can reduce civil monetary damages, speed resolution, and eliminate the need for a corporate integrity agreement in some cases.
The new policy keeps those incentives in view, but routes the initial disclosure through DOJ. Assistant Attorney General Colin M. McDonald said companies that discover fraud within their operations should not have to move through a maze of agencies before reporting it. He framed the revised process as a way to eliminate bureaucratic barriers that had created confusion over whether multiple disclosures were required for conduct that could be criminal.
The message is direct: cooperate, remediate, and the response can be more predictable; conceal the conduct, and the government’s posture changes sharply.
HHS-OIG disclosure still matters, but it no longer carries the same criminal benefit
HHS-OIG also updated its Health Care Fraud Self-Disclosure Protocol to reflect the joint policy. The agency specified that a disclosure made to HHS-OIG alone will generally not qualify for a DOJ declination. That detail matters for compliance teams because it changes the strategic value of the initial filing and raises the stakes of getting the first disclosure decision right.
Healthcare fraud investigations often do not stay neatly confined to one legal box. A billing scheme, kickback arrangement, false documentation practice, or other improper payment structure can involve overlapping criminal, civil, and administrative consequences. In that setting, the pathway chosen at the outset can affect the size of the settlement, the speed of resolution, and whether the organization is pushed into a more burdensome oversight arrangement.
The new rule does not erase those downstream risks. It does, however, create a more unified route to the criminal side of the equation.
Internal investigations remain mandatory before any disclosure goes out
Law firm Womble Bond Dickinson urged healthcare organizations to move carefully despite the streamlined route. Its white collar defense team described the policy as a one-way street toward DOJ, while warning that organizations still need to decide whether the conduct they are reviewing truly belongs in that channel.
A filing to HHS-OIG that later turns out to involve potentially criminal conduct could leave a company without the chance for a DOJ declination. That possibility creates a sequencing problem for compliance leaders: if the organization reports too narrowly, it may lose the benefit tied to DOJ’s criminal disclosure process.
The firm also stressed that a declination does not end the compliance burden. Companies still need a thorough internal investigation that addresses the expectations of both regimes. That means identifying responsible individuals, documenting cooperation, quantifying damages, and taking remediation seriously enough to satisfy government reviewers. In other words, the new process may simplify the front door, but it does not simplify the work that has to happen before anyone opens it.
False Claims Act exposure remains outside the new framework
Sidley separately pointed out a major boundary in the policy update: the False Claims Act is not part of the new disclosure structure, and neither is the DOJ Civil Fraud Section’s enforcement team. In practical terms, the new policy does not resolve every avenue of liability that can arise from healthcare billing and reimbursement misconduct.
That exclusion creates a gap for organizations hoping for a single clean resolution path. The fraud division may have made the disclosure route more unified, but the False Claims Act remains a separate and powerful enforcement tool with its own liabilities and protections. For hospitals, physician groups, insurers, and other healthcare entities, the omission means the new policy is best understood as a channel for potential criminal matters, not as a shield against every related enforcement risk.
The distinction is operational as much as legal. A compliance team that assumes the new policy covers the whole problem can misjudge the exposure and under-scope the review from the start.
A tougher enforcement posture sits behind the new disclosure channel
The policy update lands in a period when healthcare fraud remains a central enforcement priority. DOJ launched its National Fraud Enforcement Division in April, and the Health Care Fraud Section now includes nine strike forces. That structure signals an enforcement environment built for speed, coordination, and broader reach across the industry.
Against that backdrop, the streamlined self-disclosure policy works both as an incentive and as a sorting mechanism. Organizations that disclose early may still secure leniency, but the government is also making clear that the benefits flow through a more disciplined process. The revision narrows the path for voluntary disclosure while preserving the agencies’ leverage when companies delay, conceal, or present incomplete information.
For healthcare executives and compliance officers, the immediate task is not theoretical. Any internal suspicion of fraud now demands a fast, well-documented assessment of whether the conduct may be criminal, whether DOJ should receive the first disclosure, and whether the organization can meet the expectations that follow. The policy rewards early candor, but only after a careful internal investigation has mapped the facts and measured the exposure.