On October 15, 2026, the Department of Justice's (DOJ) National Fraud Enforcement Division (Fraud Division) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) issued a joint Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters (the Policy). It makes the Fraud Division's Health Care Fraud Section the single point of entry for companies disclosing potentially criminal conduct related to healthcare, and clarifies and streamlines the process for such disclosures.

The same day, Deputy Assistant Attorney General (DAAG) Jacob Foster, who oversees the Fraud Division's Health Care Fraud Section, discussed the Policy at the STAT Summit in Boston, a fitting venue given the region's concentration of life sciences companies and the Fraud Division's close coordination with the U.S. Attorney's Office for the District of Massachusetts, including through the New England Health Care Fraud Strike Force's September 2025 expansion into Boston. DAAG Foster stressed that DOJ is using artificial intelligence (AI), whistleblowers, and its own data to find fraud, and warned that companies that wait may lose the chance to come forward with a voluntary self-disclosure.

Announcement of the Policy follows Assistant Attorney General (AAG) Colin M. McDonald's October 1 directive, which, as we discussed in our October 6 client alert, "Full Speed Ahead," makes healthcare fraud and violations of the Federal Food, Drug, and Cosmetic Act (FDCA) the Fraud Division's top corporate enforcement priority, with particular focus on Food & Drug Administration (FDA)-regulated companies such as pharmaceutical, medtech, and other life sciences companies. That enforcement priority is already bearing out in Boston, where the New England Strike Force secured its first corporate resolution in March 2026: a deferred prosecution agreement with ExThera Medical for failing to report adverse events, including two patient deaths, to FDA. ExThera did not self-disclose.

With DOJ now mining data directly, healthcare, life sciences, and health technology companies should take note: the government may now spot potential misconduct before the company does. Early assessment of risk exposure is the best way for companies to preserve their options, including whether and where to disclose. 

Whether to self-disclose, however, remains a fact-specific and sensitive question from both business and legal perspectives, and requires careful and close balancing of a variety of factors. First, the business itself: its operations, its relationships with patients, payors, and partners, its reputation, and its long-term strategy. Other factors are critical too, including the scope of the company's potential legal exposure, the strength of the company's remediation efforts, the probability that the government learns of the conduct on its own, and collateral risks such as exclusion from government payment programs and False Claims Act (FCA) liability. While the Policy changes the disclosure process, it does not change the need to weigh those risks thoughtfully and deliberately with counsel before deciding whether to self-disclose. 

What the Policy Does: One Disclosure, Two Agencies

The Policy addresses a familiar problem. A single course of conduct, such as a kickback arrangement, billing for medically unnecessary services, or a scheme involving an excluded person, often creates overlapping criminal, civil, and administrative exposure from both the DOJ and HHS-OIG. Companies that identify potential criminal conduct have historically had to decide not only whether to disclose that conduct, but to which agency. The Policy simplifies that calculation: 

• Single front door. A company that voluntarily self-discloses criminal conduct affecting a federal healthcare program to the Health Care Fraud Section receives the benefits of DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG's Health Care Fraud Self-Disclosure Protocol (SDP), with no separate submission through the HHS-OIG portal (DOJ release).
• What each program offers. Under Part I of the CEP, a company that voluntarily self-reports, fully cooperates, and timely remediates "will" receive a declination absent aggravating circumstances. The SDP, which resolves civil monetary penalty liability, typically means a faster resolution, a lower multiplier, and release of HHS-OIG's permissive exclusion authority without a corporate integrity agreement.
• The disclosure must qualify. These benefits attach only if the disclosure meets all CEP requirements for a voluntary self-disclosure: made in good faith, of conduct DOJ did not already know about, not otherwise legally required, before an investigation or public disclosure was imminent, and reasonably promptly after the company learned of it. 
• HHS-OIG updated the SDP the same day. The revised HHS-OIG protocol confirms that the SDP covers conduct that may violate civil or administrative law, and that addressing criminal conduct belongs with the DOJ.

Disclosures are submitted to the Fraud Division at corporate.enforcement@usdoj.gov.

HHS-OIG-Only Disclosures Generally Will Not Support a Declination

The Policy states that a submission under the HHS-OIG SDP generally does not qualify as a voluntary self-disclosure within the meaning of the CEP, and therefore generally will not qualify as a Part I declination. For companies that have treated the SDP as the default route for disclosing billing and kickback issues, this is the most consequential change.

An SDP submission still has value – consistent with the CEP, disclosures to a federal regulatory agency, state or local government, or civil enforcement agency may still count toward cooperation and remediation credit. The Policy also preserves any credit available under the CEP, the Principles of Federal Prosecution of Business Organizations (JM § 9-28.000), and the U.S. Sentencing Guidelines. But a company that discloses potentially criminal conduct only to HHS-OIG should expect, at best, a Part II or Part III outcome under the CEP, rather than a declination. Nor does the Policy address FCA exposure, which often accompanies criminal healthcare conduct and must be managed on a separate track.

Foster at the STAT Summit: "Who Do You Call?"

In his October 15 presentation, DAAG Foster described the Policy as a one-stop shop for healthcare self-disclosures, consolidating under DOJ's Health Care Fraud Section a process that previously ran separately through HHS. As Foster put it, companies should not have to ask: "What do you do? Who do you call?"

Foster's other remarks, as reported by STAT, signal how DOJ intends to use the Policy:

• Remediation will be rewarded. Foster said that when a compliance failure occurs, what DOJ most wants to hear about is the company's effort to fix it, and that the Department intends to reward that effort.
• AI and analytics will generate cases. DOJ is applying data analytics and AI to detect conduct such as billing for unneeded services, fabricated patient records, and health technology companies adding redundant diagnoses. Investigators also monitor social media and news reports to identify potential misconduct.
• Whistleblowers will be incentivized. The Division is designing programs to encourage reporting, consistent with the October 1 directive, which expressly contemplates whistleblowers who participated in the misconduct.
  AAG McDonald described the alternative in DOJ's announcement of the Policy: "If a company conceals what it knows, it should expect a very different conversation."

What Companies Should Do Now

1. Know your data. It shows where your risk lies. Take a comprehensive, 360-degree view of the company: not only billing outliers, diagnosis-coding patterns, and referral relationships, but also customer and patient complaints, employee hotline tips, negative audit findings, and items flagged in risk assessments. Companies should aim to identify what the government is likely to see before the government does.
2. Screen every issue for criminal exposure early. Before choosing a disclosure route, assess whether the conduct could support a criminal theory. If it could, the Health Care Fraud Section is now the right first call, so update protocols that default to HHS-OIG and revisit any pending SDP submissions.
3. Move quickly. CEP credit requires disclosure reasonably promptly and before a government investigation is imminent. With DOJ mining data directly, that window may close sooner than internal timelines assume.
4. Plan for the civil track. The Policy does not resolve FCA exposure. Coordinate criminal disclosure strategy with counsel and anticipate parallel Civil Division or qui tam activity.
5. Strengthen internal reporting. With new whistleblower incentives, including for culpable participants, employees who see a problem need a credible internal channel and a prompt response.
6. Document remediation. Foster's remarks make clear that remediation efforts will be weighed heavily. Root-cause analysis, discipline, and control enhancements should be documented as they happen.

For more information, please contact: 

Christina A. Clark, cclark@milchev.com, 202-626-5909

Joshua Drew, jdrew@milchev.com, 202-626-5811

Kevin Lowell, klowell@milchev.com, 202-626-5837

Bradley E. Markano, bmarkano@milchev.com, 202-626-6061

Mena Sawyer, msawyer@milchev.com, 202-626-6078

The information contained in this communication is not intended as legal advice or as an opinion on specific facts. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. For more information, please contact one of the senders or your existing Miller & Chevalier lawyer contact. The invitation to contact the firm and its lawyers is not to be construed as a solicitation for legal work. Any new lawyer-client relationship will be confirmed in writing.

This, and related communications, are protected by copyright laws and treaties. You may make a single copy for personal use. You may make copies for others, but not for commercial purposes. If you give a copy to anyone else, it must be in its original, unmodified form, and must include all attributions of authorship, copyright notices, and republication notices. Except as described above, it is unlawful to copy, republish, redistribute, and/or alter this presentation without prior written consent of the copyright holder.