New DOJ and HHS OIG Self Disclosure Pathway

Key takeaways‍

• For potentially criminal conduct affecting a federal healthcare program, a qualifying voluntary self-disclosure to the DOJ Fraud Division can provide the benefits of both DOJ's Corporate Enforcement Policy and HHS-OIG's Self-Disclosure Protocol.
• HHS-OIG updated its protocol to state that federal crimes should be disclosed to DOJ, while the OIG protocol continues to address eligible civil and administrative matters.
• The change simplifies agency routing, but it does not make every exclusion, license, billing, or credentialing issue reportable through the same process.
• Healthcare organizations still need counsel-led analysis supported by a complete operational record of discovery, investigation, affected periods, corrective action, and monitoring.

What changed in October 2026

On October 15, 2026, the Department of Justice National Fraud Enforcement Division and the Department of Health and Human Services Office of Inspector General announced a coordinated policy for voluntary self-disclosures involving potential criminal healthcare fraud.

Under the policy, a company that voluntarily self-discloses qualifying criminal conduct affecting a federal healthcare program to the DOJ Fraud Division's Health Care Fraud Section can receive the benefits of both DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy and HHS-OIG's Health Care Fraud Self-Disclosure Protocol. The company does not need to make an additional direct submission through the HHS-OIG portal to obtain the protocol's benefits.

HHS-OIG updated its protocol at the same time. The revised document states that the OIG protocol is not available for disclosure of federal crimes and directs criminal self-disclosures to DOJ. It also states that a company making a voluntary self-disclosure to DOJ within the meaning of DOJ's policy for conduct involving a federal healthcare program will receive the benefits of the OIG protocol.

What the policy does not change

The new coordination policy removes uncertainty about where a company should direct potentially criminal healthcare fraud. It does not eliminate the legal analysis needed to classify the conduct or determine whether, when, and how to disclose it.

The updated HHS-OIG protocol distinguishes several categories. Eligible civil or administrative matters may be disclosed through the OIG protocol. Conduct involving only an overpayment or error, without a potential violation for which civil monetary penalties are authorized, should be handled through the appropriate payor's refund process. Conduct involving only potential liability under the physician self-referral law belongs in the CMS Self-Referral Disclosure Protocol. Federal crimes should be disclosed to DOJ.

A compliance alert therefore does not answer the disclosure question. An OIG exclusion match, license lapse, missing record, or unusual billing pattern is a trigger for review. Counsel and appropriate leadership should determine what the facts mean and which process applies.

Why exclusion screening receives special attention

The DOJ announcement specifically identifies a scheme that conceals an excluded provider as an example of conduct that can create overlapping criminal, civil, and administrative consequences. The HHS-OIG protocol also devotes a separate section to disclosures involving excluded individuals and entities.

For an excluded-person disclosure, HHS-OIG requires information that reaches well beyond the match itself. The submission must identify the excluded person, describe the person's job duties, state the dates of employment or the contractual relationship, and describe the background checks performed before or during that relationship. It must also explain the screening process, any flaw or breakdown that allowed the relationship to continue, how the conduct was discovered, and the corrective action taken to prevent recurrence.

Before disclosing the employment or contracting of an excluded person, the organization must screen all current employees and contractors against the OIG List of Excluded Individuals and Entities and include all identified excluded persons in one submission.

These requirements explain why periodic screening and audit history matter. A point-in-time result cannot show what policy existed, how often checks occurred, whether the entire workforce and contractor population was covered, or how quickly the organization responded after discovery.

How OIG treats license problems

HHS-OIG's self-disclosure guidance also addresses claims for items or services furnished by an individual who did not possess a valid license. OIG states that items and services provided by unlicensed individuals are not payable by federal healthcare programs and may create liability under the Civil Monetary Penalties Law.

The damages approach depends on how the services were billed. When the unlicensed individual directly billed for the service, OIG identifies the amount paid by federal healthcare programs for those services as the measure of damages. When the person's work was not billed separately, OIG may use a proxy tied to the organization's employment or contracting costs during the unlicensed period.

This guidance does not mean every expired license automatically belongs in a self-disclosure. It does mean that organizations need reliable effective dates, verification evidence, work and billing periods, and a documented response when a lapse is discovered.

The records an organization may need

The updated protocol expects a disclosing party to conduct an internal investigation and report its findings. If the investigation is not complete at submission, the party must certify that it will complete the investigation within 90 days. Necessary corrective action generally should be complete and effective at the time of disclosure, subject to the protocol's specific treatment of improper kickback arrangements.

For exclusion, license, or credentialing issues, the operational record should allow counsel and compliance leaders to answer the following questions:

• When and how was the issue discovered?
• Which employee, contractor, vendor, location, service period, and federal healthcare program were affected?
• What verification, screening, onboarding, and monitoring records existed before discovery?
• What work did the individual perform, and which services or claims may be implicated?
• What immediate containment steps were taken?
• Who investigated the matter, what evidence was reviewed, and what findings were reached?
• What corrective action changed the process, and how was its effectiveness confirmed?
• When were compliance leadership and counsel notified, and what decisions were approved?

Organizations should preserve this material in a controlled record rather than reconstructing it from inboxes and spreadsheets after a legal deadline is already running.

A practical response workflow

1. Validate the alert. Confirm identity, dates, source records, and whether the result is a true match or a documentation error.
2. Contain the risk. Follow organizational policy for work restrictions, access, billing holds, vendor action, or other interim measures.
3. Preserve the evidence. Keep the original screening result, license record, personnel or contract history, assignments, claims data, and communications.
4. Escalate promptly. Notify compliance leadership and counsel according to a documented protocol. Technology should support escalation, not make the legal classification.
5. Investigate the full period. Determine when the issue began, what work occurred, which programs or claims were affected, and whether the same process failed elsewhere.
6. Correct the process. Address the individual matter and the system weakness that allowed it to occur.
7. Maintain the decision record. Preserve the analysis, approvals, corrective action, and continuing monitoring whether or not a disclosure is ultimately made.

How Perla supports the operational record

Perla helps healthcare organizations automate recurring OIG exclusion monitoring, professional license tracking and verification, credential collection, expiration alerts, document management, and assigned follow-up. These functions can help teams identify a potential issue earlier and preserve a dated record of the response.

Perla does not determine whether conduct is criminal, calculate legal liability, or decide whether an organization should self-disclose. Those decisions belong with qualified counsel and authorized leadership. The platform supports the underlying operational work: knowing when an alert occurred, who owned the response and allows facilities to document which records were reviewed, corrective action completed, and any follow up monitoring.

The practical lesson

The new DOJ and HHS-OIG policy creates a clearer route for qualifying criminal healthcare fraud self-disclosures. For healthcare operators, the more immediate lesson is that a disclosure decision depends on facts the organization must already be able to find.

Continuous exclusion screening and license verification reduce the time between a change in status and discovery. A structured follow-up process then turns the alert into a usable investigation record. When counsel needs to assess exposure, the organization should be able to provide the full timeline without rebuilding it from memory.

Sources

DOJ announcement on the self disclosure protocol for criminal health care fraud (October 15, 2026; updated October 19, 2026) - Open primary source

DOJ and HHS OIG policy on coordination of criminal and administrative remedies in health care fraud matters (October 2026) - Open primary source

HHS OIG Health Care Fraud Self Disclosure Protocol (issued October 15, 2026) - Open primary source

HHS OIG Health Care Fraud Self Disclosure webpage - Open primary source

DOJ Corporate Enforcement and Voluntary Self Disclosure Policy (March 2026) - Open primary source

This article is for general informational purposes and does not constitute legal advice. Organizations should consult qualified counsel about specific facts and disclosure obligations.