DOJ Fraud Division and HHS Sharpen Their Criminal Healthcare Fraud Tools

On October 15, 2026, the Department of Justice’s (DOJ’s) National Fraud Enforcement Division (the Division) and the Department of Health & Human Services (HHS) Office of Inspector General (HHS-OIG) issued a policy designed to simplify how companies self-report potential criminal healthcare fraud. As DOJ explained in its announcement, a single arrangement — such as paying kickbacks or billing for medically unnecessary services — can expose a company to criminal, civil, and administrative liability. As a result, companies weighing disclosure must decide where to submit it.

This policy clarifies that companies voluntarily self-disclosing potential criminal healthcare conduct to the Division can obtain the benefits of DOJ’s Corporate Enforcement Policy (the CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (the SDP) through a single disclosure. The policy is the latest development from the Division, which DOJ created in April 2026 and which houses DOJ’s Health Care Fraud Section. Taken together with HHS’s recent delegation of permissive exclusion authority to the Centers for Medicare & Medicaid Services (CMS) that is discussed below, these developments are significant for healthcare providers and suppliers, as well as manufacturers of pharmaceuticals and medical devices.

How the New Framework Operates

When a company self-reports potential criminal conduct that affects a federal healthcare program to the Division’s Health Care Fraud Section, the SDP benefits will attach automatically; the company does not need to make a separate submission through HHS-OIG’s online portal. Disclosures to the Division can be sent to corporate.enforcement@usdoj.gov.

HHS-OIG’s accompanying revisions to the SDP address the opposite scenario. The SDP is intended for potential civil and administrative violations, and the revised protocol clarifies that criminal matters should be disclosed to DOJ. Accordingly, a company that discloses only to HHS-OIG will not be treated as having voluntarily self-disclosed to DOJ, and that disclosure generally will not support a declination under the CEP. Companies that are considering disclosing conduct that implicates both civil and criminal liability should consider disclosing the conduct to the Division.

Knowing where to disclose, however, is only part of the calculus; companies must also consider timing. Earlier disclosures are generally more likely to receive meaningful credit, yet decisions around self-disclosure are difficult to make without sufficient facts in hand, including an understanding of the nature and scope of the conduct. Companies should work with counsel to develop the facts efficiently so they can make an informed disclosure decision without undue delay.

Benefits Under the CEP and SDP

The CEP

DOJ announced the CEP on March 10, 2026, describing it as its first department-wide corporate enforcement policy for criminal matters. The CEP addresses the benefits available to companies that voluntarily self-disclose, cooperate, and remediate potential criminal misconduct, using a three-part structure with diminishing benefits.

• Under Part I, a company that voluntarily self-discloses, fully cooperates, and timely and appropriately remediates will receive a declination if no aggravating circumstances are present, though it must still pay all disgorgement, forfeiture, and restitution.
• Under Part II, a company that does not qualify for a declination — because its self-report does not meet every voluntary self-disclosure requirement, or because aggravating circumstances are present — may still be eligible for a non-prosecution agreement with a term of less than three years, no independent compliance monitor, and a penalty reduction of 50% to 75%.
• Under Part III, prosecutors retain full discretion over the form of resolution, and penalty reductions are capped at 50%. For more information on the CEP, please see our prior Client Alert.

Companies should also note that none of the above scenarios ensure that a company will not be subject to a corporate integrity agreement. Under HHS-OIG's non-binding criteria, the decision whether to require integrity obligations turns on OIG's assessment of the future risk that a company poses to federal healthcare programs, informed by factors such as the nature and circumstances of the conduct, conduct during the government’s investigation, ameliorative efforts, and the company's history of compliance.U.S. Dep't of Health & Hum. Servs., Off. of Inspector Gen., Criteria for Implementing Section 1128(b)(7) Exclusion Authority (Apr. 18, 2016), https://oig.hhs.gov/documents/exclusions/11247/1128b7exclusion-criteria.pdf.

The SDP

Updated on October 15, 2026, the SDP offers several benefits to companies that disclose potential fraud in good faith and cooperate with HHS-OIG.U.S. Dep't of Health & Hum. Servs., Off. of Inspector Gen., Health Care Fraud Self-Disclosure Protocol 4 (Oct. 15, 2026), https://oig.hhs.gov/documents/self-disclosure-info/11951/hhs-oig-self-disclosure-protocol.pdf. First, HHS-OIG generally presumes it will not require an integrity agreement in exchange for releasing its permissive exclusion authority, and its practice is to resolve SDP matters through settlements without imposing integrity measures. Second, disclosing parties typically pay a lower damages multiplier than in government-initiated investigations, generally a minimum of 1.5 times single damages. Third, the obligation to report Medicare and Medicaid overpayments within 60 days is suspended once HHS-OIG acknowledges a timely submission to the SDP, and it remains suspended until the matter is resolved or the company leaves the SDP. These benefits depend on continued cooperation, and companies that do not cooperate in good faith may be removed from the SDP.

HHS Delegates Permissive Exclusion Authority to CMS

A related development may complicate the government’s efforts to streamline the SDP’s permissive exclusion-related benefits. On October 14, 2026, HHS delegated its permissive exclusion authority under Section 1128(b) of the Social Security Act to CMS, giving it authority to exclude individuals and entities from Medicare and Medicaid. HHS-OIG retains its mandatory exclusion authority. Because CMS has not historically been a party to HHS-OIG corporate integrity agreements or permissive exclusion releases, it is not yet clear whether a release obtained from HHS-OIG (including through the SDP) will also include a release from CMS, or how the two agencies will coordinate. Until CMS and HHS-OIG issue guidance, companies evaluating a disclosure or negotiating a resolution should consider seeking permissive exclusion releases that address the authority of both agencies.

Key Takeaways

• If contemplating a self-disclosure for criminal conduct, consider doing so through DOJ. Companies that have used the SDP for disclosures should consider recalibrating their approach. With the Division now the single point of contact for potential criminal healthcare conduct, a disclosure made only to HHS-OIG risks forfeiting eligibility for a declination, while a qualifying disclosure to DOJ carries the benefits of both programs.
• Revisit internal decision trees and evaluate potential disclosure promptly. Compliance and legal teams should update investigation and escalation procedures, including any playbooks that default to HHS-OIG’s SDP, to reflect the new framework. If companies identify potential misconduct, time is of the essence and companies would be wise, in consultation with counsel, to promptly assess the facts and determine whether a disclosure is warranted.
• Parallel exposure remains. While this policy clarifies where self-disclosures of certain conduct can be made, it does not eliminate the potential for criminal, civil, and administrative consequences arising from the same conduct. Companies should be clear-eyed about what liability will and will not be resolved by making a self-disclosure.
• Account for CMS’s new permissive exclusion authority. Companies should watch for forthcoming guidance regarding how CMS and HHS-OIG intend to share permissive exclusion authority. In pending matters, they should also revisit settlement strategies to account for the reality that CMS now holds concurrent permissive exclusion authority.

Latham & Watkins will continue to monitor the Division’s healthcare enforcement activity and provide updates as this policy develops.