The Department of Justice (DOJ) has made fraud enforcement a priority in 2026. Earlier this year, the DOJ created the National Fraud Enforcement Division to coordinate criminal fraud enforcement, and it recently gave the Fraud Division primary responsibility for enforcing criminal laws involving health care fraud and health plans, among other priorities. The DOJ also announced that it would fast-track review of civil False Claims Act (FCA) cases. In October 2026, the DOJ built on these efforts by announcing two new self-disclosure programs for health care fraud matters.
For potentially criminal conduct, the Fraud Division and the Department of Health and Human Services Office of Inspector General (HHS-OIG) created a streamlined criminal self-disclosure policy that makes the Fraud Division the single point of contact for reporting potential criminal health care fraud. A qualifying disclosure to the Fraud Division can earn the benefits of both agencies’ programs, but a disclosure made only to HHS-OIG will not earn DOJ credit. HHS-OIG retains authority over potential civil and administrative violations.
The DOJ’s Civil Division and HHS announced a six-month self-disclosure pilot program (SDPP) for previously unknown FCA violations. Participants may resolve their exposure by repaying 1.25 to 1.6 times a base repayment amount—substantially less than the treble damages and per-claim penalties the FCA otherwise permits—without admitting facts. Submissions are due by April 22, 2027.
These programs provide greater clarity on how companies can self-disclose potential violations and the benefits of doing so. But significant complexities remain, and the window for the civil pilot is short. Whether, when, how, and to whom to self-disclose requires early, careful analysis.
One Point of Contact for Self-Disclosure of Potential Criminal Violations
On October 15, 2026, the Fraud Division and HHS-OIG announced a new coordinated policy intended to encourage and streamline voluntary self-disclosures of potential criminal health care fraud. Companies that make a qualifying self-disclosure to the Fraud Division involving a federal health care program may receive the benefits available under both the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP)1 and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP) without a separate submission to HHS-OIG.
Under the DOJ’s program, a company that voluntarily self-discloses misconduct, fully cooperates, and timely and appropriately remediates may be eligible for a declination of prosecution. HHS-OIG’s program, in turn, offers faster civil resolution at a lower damages multiplier (generally starting at 1.5 times single damages) and a release of HHS-OIG’s permissive exclusion authority, typically without a corporate integrity agreement. The policy does not provide relief from mandatory exclusion.
The new policy establishes the Fraud Division as the initial point of contact for potentially criminal health-care-related conduct. It is a meaningful step toward solving a recurring problem: A single course of conduct can give rise to overlapping criminal, civil, and administrative consequences, which were previously addressed by different federal offices, each with its own disclosure process.
New Civil FCA Self-Disclosure Pilot
On October 22, 2026, the DOJ Civil Division and HHS announced the six-month FCA SDPP for health care providers, suppliers, manufacturers, payors, and related entities whose products or services are paid for, directly or indirectly, with federal health care program funds. The disclosed conduct must be previously unknown to the government. If the government already knows of the issue, the company may still seek cooperation credit under Justice Manual Section 4-4.112, but it cannot obtain a resolution through the SDPP.
Participating companies may receive a coordinated civil release with no factual admissions. The resolution would cover the disclosed conduct under the federal FCA and specified HHS authorities over Medicare enrollment revocation and permissive exclusion. HHS-OIG will not require a corporate integrity agreement, and Centers for Medicare & Medicaid Services (CMS) will not impose civil monetary penalties or seek revocation. A participant won’t also need to submit under HHS-OIG’s Health Care Fraud Self-Disclosure Protocol or CMS’s Self-Referral Disclosure Protocol.
The repayment range is 1.25 to 1.6 times the base self-disclosure repayment. The DOJ will consider the timing of the disclosure, the duration and scope of the conduct, senior management involvement, the company’s gain, and whether the company inherited and promptly corrected the issue in a transaction.
Key Takeaways for Health Care Companies
The two policies clarify where companies may seek coordinated relief, but they do not eliminate the need for an early, fact-specific assessment. Companies considering disclosure should:
- Choose the appropriate pathway. Disclosures of potential federal criminal violations should be directed to the Fraud Division. Previously unknown civil FCA matters may qualify for the FCA SDPP through April 22, 2027. If the facts implicate both programs, companies should determine the sequence and scope of submissions at the outset.
- Move promptly while developing a complete record. Timing matters under both policies, and the DOJ states that late or incomplete FCA SDPP submissions will not be reviewed. At the same time, an FCA self-disclosure must include a developed factual narrative, cross-referenced documents, remediation information, financial data, and an authorized certification. Companies should investigate efficiently, preserve privilege, and establish a reliable damages analysis.
- Assess the value and limits of the available relief. The FCA program offers a federal FCA release and certain administrative relief, but it does not appear to resolve overlapping state-law exposure, other-agency issues, or all consequences of a pending qui tam action. Those risks should be evaluated separately. Additionally, a potential kickback arrangement may create criminal exposure under the Anti-Kickback Statute (AKS). The FCA repayment methodology may be favorable in appropriate cases, but companies still must decide whether to approach the Fraud Division, pursue a civil FCA release, or do both—and in what order. Assembling a small response team under the direction of counsel helps preserve privilege while these decisions are made.
Taken together, the criminal self-disclosure policy and the FCA SDPP provide more structured and streamlined avenues for resolving health care fraud matters, while placing a premium on early issue identification and disciplined coordination. The new programs come as the DOJ continues to emphasize corporate health care fraud enforcement, and they follow two early October 2026 Fraud Division directives emphasizing aggressive corporate enforcement.
These measures signal heightened scrutiny while preserving concrete incentives for prompt disclosure and cooperation. Companies should confirm that their compliance processes can identify potential misconduct quickly enough to preserve the option to disclose.
Alston & Bird’s False Claims Act and Health Care Litigation teams are monitoring both programs and the DOJ’s broader health care fraud enforcement priorities. Contact us with questions about eligibility for either disclosure pathway, the sequencing of criminal and civil submissions, or the potential implications for your organization.
Endnotes
- Alston & Bird analyses of changes to the CEP over time are collected here.
If you have any questions, or would like additional information, please contact one of the attorneys on our False Claims Act team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.