Healthcare companies that discover potential criminal fraud in their own operations now have one clear place to report it. On 15 October 2026, the Department of Justice's National Fraud Enforcement Division (the Fraud Division) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) issued a joint policy under which a company that voluntarily self-discloses potential criminal conduct related to healthcare to the Fraud Division receives the benefits of both the Justice Department's Corporate Enforcement Policy and HHS-OIG's Health Care Fraud Self-Disclosure Protocol (SDP), with no additional submission through the HHS-OIG portal required.
What Changed on October 15
The problem the policy addresses is overlap. The agencies note that a single arrangement, such as an illegal kickback, a scheme to bill Medicare for medically unnecessary services, or a scheme concealing an excluded provider, can routinely carry criminal, civil and administrative consequences at the same time. Until now, a company that uncovered such conduct had to decide not only whether to come forward, but where: the wrong door could mean losing credit with the other agency. Under the new policy, a disclosure to the Fraud Division's Health Care Fraud Section automatically carries the SDP benefits with it. Assistant Attorney General Colin M. McDonald of the Fraud Division summarised the change in the announcement: “There is now one clear point of contact: DOJ's Fraud Division.”
HHS-OIG settled the reverse question on the same day. Its updated Self-Disclosure Protocol now makes clear that the protocol covers conduct that may violate civil or administrative law, and that criminal conduct should be disclosed to the Department of Justice. A company that discloses only to HHS-OIG, the agencies said, generally will not have made a voluntary self-disclosure to the Justice Department and generally will not qualify for a declination on that basis. Organisations seeking the benefits of both programmes should therefore bring potentially criminal conduct to the Fraud Division first. Self-disclosures can be reported to the Fraud Division at corporate.enforcement@usdoj.gov. The Fraud Division, whose creation the department announced on 7 April, runs a Health Care Fraud Section with nine strike forces that, according to the department, have charged more than 6,200 defendants who collectively billed federal healthcare programmes and private insurers more than $45 billion since 2007.
The Conditions Attached to Credit
The single door does not make credit automatic. Analysis of the policy by Sidley Austin, published on 16 October 2026, sets out the qualifying conditions drawn from the Corporate Enforcement Policy: the company must report in good faith to the Fraud Division; the conduct must be something the department did not already know about; the company must not have been legally required to report it; the report must come before a public disclosure or a government investigation was imminent; and it must be made reasonably soon after the company learned of the misconduct. Where a company self-reports voluntarily, cooperates fully and remediates in a timely and appropriate manner, the Corporate Enforcement Policy can lead to a declination unless aggravating circumstances are present. Under the SDP side of the bargain, a qualifying company can expect a faster resolution, a lower multiplier on civil monetary penalties, and a release of HHS-OIG's permissive exclusion authority without a corporate integrity agreement. A disclosure made only to HHS-OIG, or to another regulator, may still earn some credit for cooperation and remediation, but it will not ordinarily meet the voluntary self-disclosure test.
What This Means for Compliance Teams
For hospital systems, clinic groups and healthcare software companies, the practical change is sequencing. When an internal review, a hotline report or a billing audit surfaces conduct that might be criminal and touches a federal healthcare programme, the first external step for a company that wants both sets of benefits is now the Fraud Division, not the HHS-OIG portal. That makes early internal detection more valuable: a disclosure can only be voluntary and prompt if compliance monitoring, exclusion screening and billing review surface problems before a payer audit, a whistleblower or a data-driven investigation does. The enforcement context raises the stakes of waiting. The Fraud Division's Directive 26-12, issued on 1 October 2026, identified healthcare fraud as its top priority, and at the STAT Summit in Boston on 15 October, Deputy Assistant Attorney General Jacob Foster, who oversees the health care fraud work, said the department is using data analytics and artificial intelligence to identify wrongdoing such as billing for unneeded services, fabricated patient records and redundant diagnoses added by health technology companies, and is designing whistleblower incentive programmes. Organisations that handle Medicare and Medicaid billing should treat this as a prompt to check that their compliance programme, documentation and internal reporting routes are in order. Background on related exclusion and security duties is at https://medclinicx.com/news/cms-permissive-exclusion-authority-medicare-medicaid and https://medclinicx.com/blog/website-security-patient-privacy-practices. This article is general information, not legal advice. Organisations facing a disclosure decision need their own counsel.
Analysis: A Simpler Door, With One Gap Left Open
Analysis (MedClinicX): The policy removes a genuine trap. Previously, a conscientious compliance team could disclose promptly and in good faith, but to the wrong agency, and lose the declination benefit it was trying to earn. Routing is now unambiguous for criminal matters. Two limits deserve equal attention. First, the benefits remain conditional and fact-specific: promptness, completeness and remediation will be judged on the record the company creates from the moment it learns of the conduct, so internal investigation discipline matters as much as the disclosure itself. Second, as Sidley's analysis points out, the policy is silent on civil False Claims Act liability, even though overlapping civil exposure is common in healthcare fraud matters and the False Claims Act is one of the government's most significant enforcement tools. A company can therefore clear the criminal and administrative route and still face an unresolved civil question. The direction of travel, though, is clear: one door, defined benefits for coming forward, and openly stated use of analytics to find those who do not.
Sources and References
- U.S. Department of Justice, National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud, 15 October 2026: https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self
- Becker's Hospital Review (Hailey Bosek), Justice Department, HHS rewrite the rules on fraud self-disclosure, 16 October 2026: https://www.beckershospitalreview.com/legal-regulatory-issues/the-new-federal-fraud-disclosure-mistake-that-could-cost-ascs/
- Sidley Austin LLP, FCA Blog, DOJ Fraud Division and HHS-OIG Announce Joint Self-Disclosure Policy, Directing Healthcare Companies to Bring Potential Criminal Matters to DOJ First, 16 October 2026: https://fcablog.sidley.com/2026/10/16/doj-fraud-division-and-hhs-oig-announce-joint-self-disclosure-policy-directing-healthcare-companies-to-bring-potential-criminal-matters-to-doj-first/
- STAT, DOJ targets health care fraud with new self-disclosure enticements, 15 October 2026: https://www.statnews.com/2026/10/15/healthcare-fraud-new-doj-policy-rewards-self-disclosure/
- Modern Healthcare, DOJ eases healthcare fraud self-reporting with new policy, 19 October 2026: https://www.modernhealthcare.com/politics-regulation/mh-doj-healthcare-fraud-self-reporting-policy/
Reporting based on the sources above, accessed 19 October 2026. The Justice Department announcement was read directly in full on justice.gov. MedClinicX did not conduct original reporting or interviews for this article. Corrections: contact us via https://medclinicx.com/contact