For years, a healthcare company that discovered possible wrongdoing faced two questions at once: should we tell the government, and which part of the government should hear it first? On October 15, 2026, the Justice Department’s National Fraud Enforcement Division and the Department of Health and Human Services Office of Inspector General answered the second question with a joint Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters. The answer is the Fraud Division’s Health Care Fraud Section. The Policy deserves careful attention from every provider, life sciences company, and health technology business, because it changes not just where a disclosure goes but what a disclosure to the wrong place is worth.

The Problem the Policy Addresses

One bad set of facts in healthcare can create three kinds of exposure. A kickback arrangement, a pattern of billing for services that were not needed, or a relationship with an excluded individual may carry criminal liability, civil liability under the False Claims Act, and administrative consequences such as civil monetary penalties or exclusion from federal programs. Different agencies own different pieces. DOJ runs criminal cases and civil fraud litigation. HHS-OIG has its own civil monetary penalty and exclusion authorities and, for many years, offered a Self-Disclosure Protocol that companies used as the standard path for billing and kickback problems.

That arrangement left companies guessing. If you disclosed to the Inspector General, did DOJ’s criminal prosecutors treat it as a voluntary self-disclosure under their Corporate Enforcement and Voluntary Self-Disclosure Policy? The October 15 Policy resolves the uncertainty, and the resolution is not what many compliance programs assumed.

What Changes

Under the Policy, a company that voluntarily discloses potentially criminal conduct affecting a federal healthcare program to the Health Care Fraud Section is treated as having made a qualifying submission under both DOJ’s corporate enforcement framework and HHS-OIG’s protocol. There is no second filing through the Inspector General’s portal. Disclosures go to a dedicated Fraud Division email address for corporate enforcement.

The benefits track the two programs. On the DOJ side, a company that self-reports, cooperates fully, and remediates in a timely manner is, absent aggravating circumstances, entitled to a declination under Part I of the corporate enforcement policy. On the HHS-OIG side, the protocol typically offers a faster resolution of civil monetary penalty exposure, a reduced damages multiplier, and a release of the agency’s permissive exclusion authority, generally without a corporate integrity agreement.

Those benefits are available only if the disclosure meets every requirement for a voluntary self-disclosure. It must be made in good faith, concern conduct DOJ did not already know about, not be legally required, come before an investigation or public disclosure is imminent, and be made reasonably promptly after the company learns of the problem. Meeting the label is not enough; meeting the criteria is.

HHS-OIG revised its own protocol the same day. The updated document confirms that the protocol is for conduct that may violate civil or administrative law, while potentially criminal matters belong with DOJ.

The Part That Will Catch Companies Off Guard

The most consequential sentence in the Policy is a negative one. A submission made only to HHS-OIG under its protocol will generally not count as a voluntary self-disclosure for purposes of DOJ’s corporate enforcement policy, and therefore will generally not support a Part I declination.

Consider what that means for a company whose standing practice is to route billing and arrangement problems to the Inspector General. If the facts include a plausible criminal theory, that route may now cost the company the one outcome, a presumptive declination, that makes self-disclosure worth the risk. A disclosure to HHS-OIG still has value. Disclosures to civil enforcement and regulatory agencies can still earn cooperation and remediation credit, and the Policy preserves credit available under the Justice Manual’s principles for prosecuting business organizations and the Sentencing Guidelines. But a company that goes only to the Inspector General should expect a lesser resolution under the corporate enforcement policy than a declination.

Two further limits are worth stating. The Policy does not address False Claims Act exposure, which frequently accompanies criminal healthcare conduct and runs on its own track through DOJ’s Civil Division and, often, through a relator’s lawsuit. And nothing in the Policy removes the need to decide whether to disclose at all.

Why Now: The Government Is Finding Fraud Without You

The timing is not an accident. Two weeks earlier, on October 1, Assistant Attorney General Colin McDonald issued a directive making healthcare fraud, including Food, Drug, and Cosmetic Act violations, the first priority for the Fraud Division’s corporate investigations, with FDA-regulated life sciences companies squarely in view. The same directive instructed the Division to build whistleblower incentive programs that reach even people who took part in the misconduct.

Deputy Assistant Attorney General Jacob Foster, who oversees the Health Care Fraud Section, presented the Policy at the STAT Summit in Boston the day it was released. His message, as reported, was that the Department is using artificial intelligence, whistleblowers, and its own data to detect fraud. The examples he gave included billing for services that were not needed, falsified patient records, and technology companies adding redundant diagnoses. He also said investigators watch social media and news coverage for signs of misconduct. And he said that when something goes wrong, the thing prosecutors most want to hear about is what the company did to fix it, and that the Department intends to reward that.

Boston is a fitting stage. The New England Health Care Fraud Strike Force expanded there in September 2025, and in March 2026 it secured its first corporate resolution, a deferred prosecution agreement with ExThera Medical for failing to report adverse events to the FDA, including two patient deaths. ExThera had not self-disclosed. That contrast is the Policy in miniature: the same facts, resolved through enforcement rather than disclosure.

Assistant Attorney General McDonald put the choice in a sentence: a company that hides what it knows should expect a very different conversation. The practical consequence is that the old assumption, that the government will find out only if we tell it, is weaker than it has ever been. DOJ can now arrive at the facts before the company’s own compliance function does.

How to Decide Whether to Disclose

The Policy makes the route clearer. It does not make the decision easier. Whether to self-disclose is a judgment that depends on the nature of the business, its relationships with patients, payors, and partners, its reputation, and its strategy. It depends on the scope of potential liability, how thoroughly the company has already fixed the problem, the likelihood the government learns of it without help, and collateral risks such as program exclusion and False Claims Act liability. Those factors have to be weighed with counsel, deliberately, and usually quickly.

What Compliance Teams Should Do Now

Start with your own data, and look wider than billing. Outliers in claims, diagnosis coding patterns, and referral relationships matter. So do patient and customer complaints, hotline reports, audit findings, and risks flagged in your risk assessments. The goal is to see what an analytics team at DOJ would see before they do.

Build criminal screening into intake. When an issue surfaces, ask early whether the facts could support a criminal theory. If they could, the Health Care Fraud Section is the first call, so revise any protocol that sends such matters to the Inspector General by default, and review any pending protocol submissions.

Respect the clock. Credit requires disclosure reasonably promptly and before an investigation is imminent. If DOJ is mining data, that window can close faster than a typical internal investigation runs.

Plan for the civil side. Expect that criminal disclosure strategy must be coordinated with False Claims Act defense and with the possibility of a qui tam filing.

Fix the internal channel. With whistleblower incentives reaching culpable insiders, an employee who sees a problem has more reason than ever to go outside. A credible internal reporting process and a fast, documented response is the best competition for that decision.

Document remediation as you go. Root cause analysis, discipline, and control changes should be recorded when they happen. If the Department intends to reward remediation, you will need the paper to show it.

The Bottom Line

The Policy is a rare thing: a government announcement that simplifies a process and raises the stakes at the same time. Simplification is the single entry point. The higher stakes are that a disclosure sent to the familiar address may not earn the credit the company expects, and that the government is increasingly able to find the problem itself. Healthcare and life sciences companies should review their disclosure protocols this month, make sure the right people know the new route, and treat early assessment of risk as the step that preserves every option that follows.