DOJ Announces New Healthcare Fraud Self-Disclosure Policy: What Physicians and Healthcare Companies Need to Know

October 18, 2026

On October 15, 2026, the U.S. Department of Justice’s National Fraud Enforcement Division (NFED) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) announced a new joint policy governing voluntary self-disclosure of potential criminal healthcare misconduct.

The policy represents an important change in how healthcare companies may report suspected criminal violations involving federal healthcare programs.

Under the new framework, companies seeking the benefits of both DOJ’s Corporate Enforcement Policy and HHS-OIG’s Self-Disclosure Protocol generally need to make only one disclosure—to the Health Care Fraud Section of DOJ’s National Fraud Enforcement Division.

Previously, healthcare organizations confronting potential criminal, civil, and administrative exposure faced difficult decisions about whether to disclose suspected misconduct to DOJ, HHS-OIG, or both.

The new policy is intended to simplify that process.

But for physicians, medical practice owners, laboratory executives, healthcare administrators, and other professionals, the announcement raises a more consequential question:

Does voluntarily disclosing suspected healthcare fraud protect the company, or could it expose individual physicians and executives to federal criminal prosecution?

The answer requires careful consideration before any disclosure is made. Contact us to understand the ramifications.

What Changed Under DOJ’s October 15, 2026 Healthcare Fraud Policy?

The new policy establishes a streamlined reporting process for companies that discover potential criminal healthcare fraud affecting federal healthcare programs.

According to DOJ’s announcement, a company that voluntarily self-discloses qualifying criminal conduct to NFED’s Health Care Fraud Section will receive the benefits of HHS-OIG’s Self-Disclosure Protocol without having to make a separate submission through HHS-OIG’s reporting portal.

The agencies also clarified an important distinction: HHS-OIG’s protocol addresses conduct potentially violating civil or administrative law, while potentially criminal healthcare misconduct should be disclosed to DOJ.

A company that reports potentially criminal conduct only to HHS-OIG generally will not qualify for a DOJ declination based on that disclosure alone.

In other words, the agency receiving the disclosure matters.

The policy does not eliminate the substantive requirements of DOJ’s Corporate Enforcement Policy. Companies must still satisfy applicable conditions to receive the benefits of voluntary disclosure, including cooperation and appropriate remediation.

Nor does the new policy provide blanket immunity from criminal prosecution.

Why Is DOJ Encouraging Healthcare Companies to Self-Disclose?

Federal healthcare investigations frequently involve overlapping criminal, civil, and administrative statutes.

For example, a medical practice may discover billing irregularities involving Medicare or Medicaid. A laboratory may identify potentially improper financial relationships with referring physicians. A healthcare company may uncover evidence that services were billed under the credentials of an excluded provider.

Depending on the facts, these circumstances may implicate:

• The federal Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b).
• The federal healthcare fraud statute, 18 U.S.C. § 1347.
• The False Claims Act, 31 U.S.C. §§ 3729–3733.
• Federal wire fraud or conspiracy statutes.
• Medicare and Medicaid administrative regulations.
• Federal exclusion and civil monetary penalty authorities.

The same underlying conduct may potentially trigger multiple enforcement mechanisms.

DOJ’s new policy is intended to remove uncertainty about where companies should report potentially criminal healthcare misconduct.

The government also has a practical incentive to encourage self-disclosure: companies that conduct internal investigations may identify witnesses, financial records, electronic communications, and other evidence that federal investigators have not yet obtained.

For healthcare organizations, however, that creates a significant strategic consideration.

A disclosure that benefits the corporation may also provide federal prosecutors with evidence concerning the conduct of individual employees, physicians, officers, or executives.

Does Voluntary Self-Disclosure Mean DOJ Will Decline Criminal Prosecution?

Not automatically.

DOJ’s Corporate Enforcement Policy provides a framework under which qualifying companies may receive favorable treatment, potentially including a declination of criminal prosecution.

But a declination is not an unconditional guarantee simply because a company reports suspected wrongdoing.

Eligibility and the ultimate resolution depend on the requirements of the applicable policy, including the timing and voluntariness of the disclosure, the company’s cooperation, remediation, and other relevant circumstances.

The distinction between corporate and individual criminal liability is particularly important.

A company may seek to resolve its own criminal exposure through voluntary disclosure and cooperation while federal prosecutors separately investigate whether particular individuals committed criminal offenses.

A corporate resolution does not necessarily resolve the criminal exposure of the individuals involved.

For physicians and healthcare executives, this distinction should be evaluated before participating in an internal investigation or providing statements concerning suspected misconduct.

Can a Healthcare Company’s Self-Disclosure Lead to Criminal Charges Against Its Physicians or Executives?

Potentially, yes.

Consider a medical practice that discovers questionable Medicare billing practices during an internal compliance review.

The company may determine that it should investigate whether claims were submitted for medically unnecessary services, whether billing codes were improperly used, or whether financial arrangements violated federal law.

As part of that investigation, the company may review emails, billing records, financial transactions, and communications involving physicians or administrators.

If the company subsequently makes a voluntary disclosure to DOJ, information developed during its investigation may become relevant to a federal criminal investigation of individual employees or executives.

The company’s interests and the individual’s interests may not be identical.

A company may seek to demonstrate that misconduct was limited to certain individuals, that senior management was unaware of the conduct, or that the organization has implemented appropriate corrective measures.

An individual physician or executive may dispute those conclusions.

For example, a physician accused of participating in improper billing may contend that coding decisions were made by administrative personnel, that services were medically necessary, or that the physician lacked knowledge of the alleged misconduct.

These issues can become especially complicated when the company is attempting to obtain cooperation credit from DOJ.

Physicians and executives should not assume that attorneys conducting a corporate internal investigation represent them personally. Seek independent legal advice.

What Is an Upjohn Warning, and Why Does It Matter?

When a healthcare company investigates potential misconduct, its attorneys may interview employees, physicians, officers, or executives.

Before conducting such an interview, corporate counsel may provide what is commonly known as an Upjohn warning.

The warning generally explains that the attorney represents the company rather than the individual employee, that the attorney-client privilege belongs to the company, and that the company may decide to disclose the substance of the interview to third parties, including the government.

This distinction is critical.

A physician who participates in an internal investigation may believe that communications with the company’s lawyers are confidential and protected for the physician’s benefit.

That assumption may be incorrect.

The company generally controls its own attorney-client privilege and may decide whether to waive it, subject to applicable law and the circumstances.

Where individual criminal exposure is possible, obtaining independent criminal defense counsel before participating in a substantive corporate interview may be essential.

Should a Physician or Healthcare Executive Cooperate with an Internal Investigation?

There is no universal answer.

Cooperation may be required under employment agreements, corporate policies, professional obligations, or other applicable arrangements.

At the same time, statements made during an internal investigation may have consequences if the matter is later referred to federal prosecutors.

An employee’s Fifth Amendment rights, contractual obligations, employment consequences, and potential criminal exposure require individualized analysis.

An attorney representing the individual can evaluate the scope of the interview, the identity of the investigating attorneys, the relevant documents, and whether separate representation or other protections are appropriate.

Refusing to participate without understanding the consequences can create problems. Participating without understanding the risks can also create problems.

The decision should be informed by the individual’s particular circumstances.

What Types of Healthcare Misconduct May Be Subject to the New Disclosure Policy?

The October 15 announcement specifically identifies several examples of conduct that may create overlapping criminal, civil, or administrative exposure.

Illegal Kickbacks and Referral Arrangements

A healthcare company may discover that payments to physicians, marketers, consultants, or referral sources potentially violate the federal Anti-Kickback Statute.

These arrangements can involve medical laboratories, pharmacies, durable medical equipment suppliers, physician practices, and other healthcare businesses.

Not every financial relationship involving referrals is illegal. The analysis depends on the applicable statute, regulatory protections, intent requirements, and specific facts.

Medically Unnecessary Services

A healthcare provider may identify allegations that Medicare or Medicaid was billed for services that were not medically necessary.

Such investigations may involve laboratory testing, genetic testing, diagnostic procedures, prescription medications, or other healthcare services.

Importantly, disagreements about medical necessity do not automatically establish criminal fraud.

Federal prosecutors must prove the elements of the applicable criminal offense, including the required mental state.

Excluded Providers

A healthcare organization may discover that claims were submitted in connection with services involving an individual excluded from participation in federal healthcare programs.

Depending on the circumstances, these matters may create administrative, civil, or criminal exposure.

The applicable consequences depend on the individual’s status, the nature of the services, the billing arrangements, and the knowledge and conduct of the parties involved.

Does the New Policy Replace HHS-OIG’s Existing Self-Disclosure Protocol?

No.

HHS-OIG continues to maintain its Self-Disclosure Protocol for qualifying matters involving potential civil or administrative violations.

The October 15 update clarifies how potentially criminal conduct should be handled and establishes a coordinated pathway for companies seeking the benefits of both agencies’ policies.

This distinction matters because healthcare organizations may discover conduct that implicates the False Claims Act, civil monetary penalties, exclusion authorities, or criminal statutes.

Determining whether suspected misconduct is potentially criminal, civil, administrative, or some combination of those categories requires careful legal analysis.

The new policy should not be interpreted as requiring every billing error or compliance concern to be reported as criminal fraud.

Nor should a company assume that a voluntary disclosure to one agency resolves every possible issue involving other regulators, payors, or enforcement authorities.

What Should Georgia Healthcare Companies Do Before Making a Voluntary Disclosure?

For healthcare companies considering voluntary self-disclosure, the most important decision may occur before contacting DOJ.

A company should evaluate the nature of the suspected misconduct, the available evidence, potential criminal exposure, and the requirements of the applicable disclosure policies.

Among the issues that may warrant legal review are:

1. Whether the conduct is potentially criminal. Billing mistakes, overpayments, regulatory violations, and intentional fraud are not interchangeable legal concepts.
2. Whether the company qualifies for voluntary disclosure benefits. Timing, prior government knowledge, cooperation requirements, and other policy conditions may affect eligibility.
3. Whether individual physicians or executives face separate exposure. The interests of the company and its personnel may diverge.
4. Whether an internal investigation should be conducted. The investigation’s scope, privilege protections, document preservation, and employee interviews require careful planning.
5. Whether other reporting or repayment obligations apply. The DOJ policy does not necessarily displace separate obligations under Medicare, Medicaid, the False Claims Act, or other applicable laws.
6. Whether disclosure could affect professional licensing or exclusion risks. Physicians and other licensed professionals may face consequences beyond the resolution of a corporate investigation.

A voluntary disclosure may offer meaningful benefits in an appropriate case. But the decision should not be made without understanding what information will be provided to the government and how that information could affect the organization and its personnel.

Frequently Asked Questions About DOJ’s New Healthcare Fraud Self-Disclosure Policy

Does the October 2026 policy require healthcare companies to report all suspected fraud to DOJ?

No. The policy establishes a pathway for companies seeking the benefits of voluntary self-disclosure. It does not, by itself, create a universal obligation to report every suspected violation. Separate reporting, repayment, or disclosure obligations may apply under other laws.

Can a healthcare company avoid criminal prosecution by voluntarily disclosing fraud?

Potentially, if it satisfies the applicable Corporate Enforcement Policy requirements. However, voluntary disclosure does not automatically guarantee a declination.

Does a corporate declination protect physicians and executives from prosecution?

Not necessarily. Corporate and individual criminal liability are distinct. Individual physicians, executives, or employees may still face investigation or prosecution.

Should a physician speak to company lawyers during an internal fraud investigation?

A physician facing potential individual criminal exposure should consider obtaining independent legal advice before participating in a substantive interview. Corporate counsel represents the organization, not necessarily the physician.

Does the new policy apply to Medicare and Medicaid fraud?

The policy concerns potentially criminal healthcare misconduct affecting federal healthcare programs, which may include Medicare and Medicaid-related matters.

Can a company still disclose civil healthcare violations to HHS-OIG?

Yes. HHS-OIG’s Self-Disclosure Protocol remains available for qualifying civil and administrative matters. Potentially criminal conduct should be evaluated under DOJ’s disclosure framework.

Facing a Federal Healthcare Fraud Investigation in Georgia? Contact Conaway & Strickler, PC

DOJ’s October 15, 2026 announcement reflects the federal government’s continuing emphasis on healthcare fraud enforcement and corporate cooperation.

For healthcare companies, the new policy may simplify the process of voluntarily reporting suspected criminal misconduct.

For physicians, practice owners, laboratory executives, and healthcare administrators, however, it also highlights the importance of understanding how corporate cooperation can affect individual criminal exposure.

The interests of a healthcare company and the individuals who work for it are not always the same.

Before participating in an internal investigation, responding to a federal subpoena, or making a voluntary disclosure concerning potential criminal healthcare conduct, it is important to understand the legal risks.

At Conaway & Strickler, PC, our Atlanta federal criminal defense attorneys represent physicians, healthcare professionals, executives, and businesses facing federal investigations and prosecutions involving healthcare fraud, Medicare and Medicaid billing, kickback allegations, and other white-collar criminal offenses.

If your medical practice, laboratory, or healthcare organization is considering a voluntary self-disclosure—or if you are a physician or executive whose conduct is being reviewed as part of a corporate investigation—contact Conaway & Strickler, PC to discuss your legal options.

Early, independent legal representation can be critical when a corporate compliance matter becomes a federal criminal investigation.

This article is provided for general informational purposes and does not constitute legal advice.