Found Possible Billing Fraud? DOJ, Not HHS-OIG, Now Takes the Disclosure

The Justice Department and HHS-OIG changed where a provider goes when it finds possibly criminal conduct in its own billing. A joint policy signed October 15, 2026 says a company should make "its initial disclosure of potentially criminal conduct" to DOJ's Health Care Fraud Section, in the new National Fraud Enforcement Division. The same day, OIG updated its Self-Disclosure Protocol to say it "is not available for disclosure of Federal crimes."

Why the door matters

The policy says "a disclosure made only to HHS-OIG under its SDP generally does not qualify as a voluntary self-disclosure to the Fraud Division." That qualification is what DOJ's Corporate Enforcement Policy uses to decide whether to decline prosecution of the company. Going to DOJ first gets both: "A company is required to make only one disclosure to the Health Care Fraud Section to obtain the benefits of both." DOJ forwards a copy to OIG, and "No duplicate submission through the HHS-OIG SDP web portal is required."

It applies to conduct involving any federal health care program under 42 U.S.C. § 1320a-7b(f), which includes Medicaid. The policy's own examples of conduct that triggers several remedies at once include "a scheme to bill for medically unnecessary services" and "a scheme involving an excluded person."

Three tiers, three doors

• Possibly criminal: DOJ's Health Care Fraud Section first.
• Civil monetary penalty exposure, not criminal: OIG's protocol still applies. The minimum settlement is "1.5 times the single damages," with a $20,000 minimum ($100,000 for kickback matters). The internal investigation and damages estimate are due 90 days from the initial submission.
• Billing mistakes only: OIG's protocol isn't available for a matter "exclusively involving overpayments or errors." Those go to "the payor's voluntary refund process," under the usual 60-day report-and-return clock.

DOJ's Fraud Division issued a directive on October 1, and Sidley's analysis reads it as naming health care fraud the division's top priority. That's the context for the change.

The limits

Neither document defines "potentially criminal." That's the call that decides which door you use, and it belongs to counsel. As Sidley notes, the policy "makes no mention of cooperation with the Civil Division," so a DOJ criminal disclosure doesn't settle False Claims Act exposure. Neither document addresses state Medicaid Fraud Control Units or state Medicaid self-disclosure programs. For a Medicaid-only ABA practice, those may still be the first call. OIG's protocol benefits also exclude mandatory exclusion.

What you must know or do

• Owners and compliance leads: open your compliance plan's section on what happens when an audit finds a problem. If it says "self-disclose to OIG," rewrite it as a three-way triage: billing error goes to the payer refund, CMP-only exposure to the OIG protocol, potentially criminal conduct to counsel and then DOJ.
• Owners: name the healthcare attorney you would call before you need one. Under this policy, which agency you contact first determines what credit you can get, so the first call matters.
• Clinical directors: if an internal review finds sessions billed that didn't happen, or work by someone excluded or not enrolled, escalate to the owner and counsel before anyone decides how to fix it. That's the kind of conduct the policy's own examples describe, and the fix chosen decides which of the three doors applies.