DOJ, HHS launch Healthcare FCA Self-Disclosure Pilot Program

On October 22, 2026, the US Department of Justice (DOJ) Civil Division and the US Department of Health and Human Services (HHS) announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (FCA SDPP, or the Program), which is set out in a published protocol (the protocol). The Program gives healthcare companies a defined framework for resolving civil False Claims Act (FCA) liability, and related HHS administrative exposure, for potential violations previously unknown to the federal government. In exchange for a complete disclosure, remediation, and repayment, participating companies can obtain a federal FCA release without factual admissions and repay 1.25 to 1.6 times a DOJ-calculated base amount. Submissions are due by 11:59 pm on April 22, 2027; late or partial submissions will not be accepted or reviewed. The defined benefits are notable, but companies must assess the Program’s limits and uncertainties as well as the risks of disclosure before proceeding.

Benefits of disclosure under the FCA SDPP

If a company meets the criteria for disclosure under the Program and completes the necessary steps (see below), the Program provides some certainty about what benefits self-disclosure will yield. Most notably:

Repayment terms. A participating company must repay 1.25 to 1.6 times the Base Self-Disclosure Repayment, calculated by DOJ using the financial information submitted. The multiplier will vary based on factors such as the timing of disclosure; the duration and scope of the conduct; senior management’s involvement; the company’s financial benefit; and whether the company has successor liability for the misconduct but promptly remediated. That range is materially lower than the 2x multiplier that DOJ usually contends is “standard” in a settlement, although the ultimate payment will depend on how DOJ calculates the base amount.

Coordinated civil release and administrative certainty. The DOJ Civil Division and HHS will provide the disclosing company with a coordinated civil release from FCA liability for the disclosed conduct, “with no factual admissions” (which are otherwise a required component of an FCA settlement in a few jurisdictions), and the company need not disclose “the same conduct to any other applicable existing civil self-disclosure programs.” Under the protocol, the HHS Office of Inspector General (HHS-OIG) will “not require a Corporate Integrity Agreement” (CIA), which is often a major sticking point in FCA settlements, and the Centers for Medicare & Medicaid Services (CMS) will “not impose civil monetary penalties or seek revocation” of the company’s Medicare enrollment. The release is limited to the federal FCA and the specified HHS authorities. Among other things, it does not address parallel state law claims or apply to conduct that gives rise to criminal liability. Companies should therefore evaluate separately where a disclosure leaves them exposed under criminal law or state law, with other agencies, and in qui tam litigation.

Alternative damages approach for AKS-based claims

The protocol’s example for FCA violations predicated on Anti-Kickback Statute (AKS) violations deserves close attention. Quantifying AKS-based FCA liability can be difficult, and DOJ usually takes the position that damages are tied to the value of the claims resulting from the kickback. Under the Program, by contrast, the government will forgo a claims-paid damages measure and instead calculate the Base Self-Disclosure Repayment by considering the amount of the remuneration, the revenue derived from the disclosed conduct, and the absence of aggravating factors such as patient harm. The reference to the “absence” of aggravating factors suggests that their presence could increase the base amount. The protocol itself acknowledges that courts generally have not treated remuneration or related revenue as measures of the government’s actual damages. The protocol’s example involves an acquirer that discovers potential AKS violations at an acquired company after closing, but the protocol does not expressly limit this calculation method to acquisitions. It applies, however, only for the limited purpose of the Program, and companies should not assume that DOJ will accept or apply it outside of the Program.

Who is eligible and what must be submitted

Eligible entities include healthcare providers, suppliers, manufacturers, payors, and related entities that furnish, arrange for, manufacture, distribute, insure, administer, or bill for items or services paid for, directly or indirectly, by HHS federal healthcare programs. The Program is limited to potential FCA violations previously unknown to the federal government. The protocol also describes the Program as intended for “legitimate American healthcare businesses” without defining that term.

Submissions are made by email to FCA-SDPP@usdoj.gov. In making the self-disclosure, the company must:

• Describe all relevant details of conduct that, in the company’s reasonable assessment, potentially violates the FCA, including the applicable legal requirements and relevant time period.
• Attach documents sufficient to reflect fully the nature, terms, and operation of the conduct, with cross-references in the written narrative.
• Identify corrective measures already taken to end the conduct and prevent recurrence. Justice Manual § 4-4.112 provides examples of potentially responsive measures.
• Provide financial information sufficient for DOJ to calculate the Base Self-Disclosure Repayment, subject to requests for supplemental information.
• Include an authorized representative’s certification that, to the best of that individual’s knowledge, the submission is truthful and complete.
• Identify a contact person, with a phone number and email address, for follow-up questions.

While the protocol provides clear guidance on some features, certain judgment calls remain. The company must make its own reasonable assessment of the potentially unlawful conduct; the protocol does not specify how DOJ will determine whether the supporting documents or financial information are sufficient; and it does not assign weights to the multiplier factors. Because late or partial submissions will not be reviewed, companies should expect to conduct a substantial investigation, develop a defensible repayment analysis, and take corrective action before filing. Given the element of subjectivity in these requirements, a company should take a hard look at whether it can truly satisfy every one before the deadline. The government may request supplemental information, but the protocol does not establish a general right to cure an incomplete initial submission. Companies that do not qualify (including because the government already knows of the conduct) or that disclose after the Program closes may still seek self-disclosure and cooperation credit under Justice Manual § 4-4.112, without the Program’s defined resolution terms.

Civil disclosures and potential criminal exposure

The Program concerns civil FCA liability, not criminal exposure. Companies seeking to self-disclose potential criminal healthcare misconduct should disclose it to the Health Care Fraud Section of DOJ’s National Fraud Enforcement Division (NFED) under the NFED and HHS-OIG Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters, announced on October 15, 2026. Under that policy, a single qualifying voluntary self-disclosure to the Health Care Fraud Section earns the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and the HHS-OIG Health Care Fraud Self-Disclosure Protocol, without the need for a separate HHS-OIG submission. Companies that disclose criminal conduct through NFED need not make a duplicative submission under the Program; if they also seek a civil FCA release, DOJ will request supplementation only to the extent necessary. A submission only to the Civil Division should not be assumed to qualify for criminal self-disclosure benefits, because the CEP generally does not treat disclosures made only to civil enforcement agencies as voluntary self-disclosures.

These distinctions are especially important for AKS-related conduct, which can implicate criminal, civil, and administrative authorities. Although civil FCA claims are the most prominent vehicle for pursuing AKS violations, a company considering self-disclosure of AKS-related conduct should evaluate whether the conduct presents potential criminal exposure and whether to proceed under the Program, DOJ’s criminal self-disclosure framework (including the CEP), or both, depending on the nature of the conduct. Again, the Program’s civil release does not resolve criminal liability.

Key takeaways

The Program is consistent with the government’s continued emphasis on self-disclosure and cooperation, and it is novel in giving companies that qualify and meet its requirements some certainty about what they will receive, including a defined multiplier range, a coordinated civil release, and no CIA. The Program seeks to incentivize self-disclosure and offers real benefits, but its requirements involve elements of subjectivity, and whether to self-disclose will likely remain one of the most complex judgment calls facing companies in heavily regulated industries like healthcare.

Companies considering self-disclosure under the Program should coordinate with experienced FCA counsel to evaluate whether and how to proceed.