DOJ Launches Criminal and Civil Self-Disclosure Programs Relevant to Healthcare and Life Sciences Companies

This administration has made antifraud enforcement, particularly in the healthcare industry, its top priority. The U.S. Department of Justice (DOJ) has announced a series of initiatives to identify new targets for enforcement action, including partnering with the Department of Health and Human Services (HHS) through the DOJ-HHS False Claims Act (FCA) Working Group, working with data miners through its Fraud Oversight through Careful Use of Statistics (FOCUS) initiative, and, most recently, by announcing a new whistleblower rewards program and two self-disclosure programs for healthcare companies. Across these programs, DOJ has enhanced its ability to detect potential fraud and offered the industry a path and incentives to get ahead of potential enforcement actions.

The Detection Push

The self-disclosure programs arrive against a backdrop of expanding detection, and data is the common thread. On the civil side, the DOJ-HHS FCA Working Group, renewed in 2025, targets areas such as Medicare Advantage, drug and device pricing, kickbacks, barriers to patient access, and manipulation of electronic health records among its priorities, and it is using enhanced data analytics to find new cases.

Data is reshaping the whistleblower side as well. DOJ has said that as many as 50% of all qui tam filings, roughly 1,300 in 2025, are driven not by insiders but by entities mining public data sets. Through its FOCUS initiative, DOJ is seeking to facilitate higher-quality cases from these data miners by inviting them to meet with the Civil Fraud Section and explain how they validate their findings. On the criminal side, DOJ’s National Fraud Enforcement Division (NFED) is likewise expanding its data analytics capabilities. The Health Care Fraud Data Fusion Center brings together experts from the Health Care Fraud Unit’s Data Analytics Team, the HHS Office of Inspector General, the FBI, and other agencies to help identify potential fraud earlier through data analytics.

DOJ is not relying just on data mining to generate new leads for enforcement action. On October 20, NFED launched the Fraud Whistleblower Incentive Program (WHIP), which pays $10,000 to $30,000 for tips that lead to the filing of criminal charges, with payment at charging rather than final resolution. Anyone may submit a tip, and healthcare is a stated priority, with hospice, home health, daycare, and special services fraud singled out.

The result is an increased likelihood that DOJ will identify potential fraud, waste, and abuse in the healthcare industry either directly or through whistleblowers. It is against that backdrop that DOJ issued two self-disclosure programs aimed at the healthcare industry over a one-week period. The first, announced October 15, addresses potential criminal conduct and directs companies to NFED. The second, announced October 22, addresses civil FCA liability and offers a defined path to resolution along with significant incentives.

The NFED Disclosure Program

On October 15, NFED and the HHS Office of Inspector General (HHS-OIG) announced a joint policy directing companies that wish to self-disclose potential criminal healthcare matters to NFED’s Health Care Fraud Section. A company that makes a qualifying voluntary disclosure — one made in good faith, of conduct DOJ did not already know about, before an investigation or disclosure is imminent, and reasonably promptly — receives credit under both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Self-Disclosure Protocol. That means the potential for a declination, a faster resolution of civil monetary penalties at a lower multiplier, and no corporate integrity agreement. A disclosure made only to HHS-OIG does not qualify, and HHS-OIG is revising its own Self-Disclosure Protocol to make clear it cannot be used for criminal violations.

The NFED disclosure program removes uncertainty about where to report potentially criminal conduct. It does not, however, address FCA liability, the enforcement tool DOJ uses to extract billions of dollars from the healthcare industry each year. That is a notable gap; as the program itself acknowledges, a single set of facts can give rise to overlapping criminal, civil, and administrative liability. On its own, it leaves healthcare companies that have identified an issue that could lead to both criminal and civil FCA liability and that have made a decision to self-disclose with no clear guidance on how best to address the issue with DOJ and cauterize the exposure.

The FCA Self-Disclosure Pilot Program

On October 22, DOJ’s Civil Division and HHS filled that gap, announcing a six-month Healthcare FCA Self-Disclosure Pilot Program (the FCA SDPP), with submissions due by April 22, 2027. Providers, suppliers, manufacturers, payors, and related entities that disclose conduct previously unknown to the government receive a coordinated civil release with no factual admissions. The release covers federal FCA liability and specified HHS administrative authorities, including Medicare enrollment revocation and permissive exclusion. HHS-OIG will not require a corporate integrity agreement, and the Centers for Medicare & Medicaid Services will not impose civil monetary penalties.

The central incentive is a defined repayment range: 1.25 to 1.6 times a base repayment, which is best thought of as a single damages calculation. This is a reduction from the 3x multiplier provided in the FCA and from the 2x multiplier commonly applied in negotiated resolutions of FCA liability. Where a company falls in the 1.25-to-1.6 range for self-disclosures turns on factors such as how early it came forward, the duration and breadth of the conduct, senior-leader involvement, and what the company gained. However, the biggest driver of FCA liability is the method for calculating single damages, not the multiplier.

The FCA SDPP has particularly notable implications for FCA cases premised on Anti-Kickback Statute (AKS) violations, which continue to drive the majority of FCA enforcement actions. The AKS is a criminal statute, but claims resulting from AKS violations give rise to FCA liability.  In those cases the government typically seeks the full amount of the reimbursements paid for the claims at issue. Under the FCA SDPP, DOJ offers instead to value single damages by the remuneration paid — that is, the value of the kickbacks — or the revenue derived from the conduct, subject to adjustment for aggravating factors such as patient harm. That meaningfully reduces exposure below what a company would face if DOJ identifies the conduct and demands a settlement or if the claims are litigated. This makes the FCA SDPP especially attractive for companies that identify potential AKS issues.

Where the Programs Meet

Read together, the two self-disclosure programs raise three issues that companies should evaluate at the outset.

Criminal versus civil. The programs run through different doors, and neither covers the other’s ground: NFED’s policy addresses criminal exposure, and the FCA SDPP addresses civil FCA exposure only. A company that discloses conduct under NFED’s policy need not also submit a disclosure to the FCA SDPP to obtain the benefits offered under that program, although DOJ may request supplemental information if the company also wants a civil release. However, the published materials do not address how DOJ will treat a disclosure under the FCA SDPP describing conduct that prosecutors may regard as giving rise to criminal liability. For example, with respect to disclosure of conduct that implicates the FCA and AKS, there is no bright line between what might be the hook for civil FCA liability and what might be the hook for criminal AKS liability. And that determination often turns on aggravating factors, intent, and other circumstances that may be incompletely known early in an internal review. As a result, the choice of where to disclose, and in what order, is a pivotal decision best guided by counsel experienced in dealing with both the Health Care Fraud Section and Civil Frauds.

The clock. Both programs require conduct unknown to the government, and WHIP, FOCUS, and the DOJ-HHS FCA Working Group’s and NFED’s data analytics each raise the chance that DOJ learns of issues first. WHIP is a particular concern because anyone may submit a tip, including patients, lower-level employees, and competitors who may never raise a concern internally and who might not otherwise have had the inclination or ability to connect with a whistleblower lawyer and file a qui tam suit. Under the CEP, a company that self-reports within 120 days of receiving an internal whistleblower report may still qualify for a declination, even if the whistleblower has already gone to DOJ. But that protection depends on the report’s reaching the company. A tip through WHIP that bypasses internal channels may foreclose that safe harbor, which puts a premium on identifying issues before an outsider does. At the same time, the FCA SDPP is effective for only six months, and there is no guarantee it will be extended. Thus, companies may not have the luxury of time or the development of a complete investigative record before they need to make a self-disclosure decision.

Residual exposure. Neither program resolves every form of exposure. The NFED disclosure program offers no civil release, and its benefits are available only if the disclosure is made to NFED and satisfies each CEP requirement for a voluntary self-disclosure. A disclosure made only to HHS-OIG will not qualify. The FCA SDPP offers a release of the government’s claims under the federal FCA and specified HHS authorities only. State-law exposure, other agencies, and any pending or sealed qui tam requires separate assessment, and a disclosure may have consequences in each.

The Bottom Line

With DOJ’s most recent initiatives, and against the backdrop of the heightened enforcement environment, healthcare companies that identify potential misconduct need to seriously weigh self-disclosure and do so promptly. But the programs are new, the lines between them are untested, and a misstep in forum or sequencing can forfeit benefits or create exposure.

To prepare, companies should confirm that internal reports are escalated promptly, assess their own data as a data miner or DOJ would, and decide early whether an issue implicates criminal exposure, civil exposure, or both. Selecting counsel with experience and relationships in both NFED and Civil Frauds to guide that decision is as important as the decision itself.