Voluntary Self-Disclosure to OIG or CMS: When It Makes Sense and the Audit Work to Do First

Every healthcare organization eventually finds a problem. An internal audit uncovers a coding pattern, a contract with a referral source turns out to be noncompliant, an employee is discovered on an exclusion list, or a review shows that services were billed without adequate documentation. When that happens, leaders face an important decision: should the matter be handled as a routine overpayment refund, or should it be voluntarily disclosed to the government through a formal self-disclosure program?

In 2026, the options for voluntary self-disclosure have expanded. In addition to the long-standing HHS Office of Inspector General (OIG) Health Care Fraud Self-Disclosure Protocol and the CMS Voluntary Self-Referral Disclosure Protocol, the Department of Justice (DOJ) and HHS announced two new approaches. In October 2026, DOJ's National Fraud Enforcement Division and HHS-OIG issued a policy coordinating the voluntary self-disclosure of potentially criminal health care conduct. Also in October 2026, DOJ's Civil Division and HHS announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program, accepting disclosures through April 22, 2027.

This article explains the main self-disclosure options, when each may make sense, the benefits and trade-offs, and, most importantly, the audit and investigation work organizations should complete before deciding to disclose. It is educational and not legal advice. Self-disclosure decisions have significant legal consequences and should always be made with experienced legal counsel.

Why Self-Disclosure Matters

Federal law requires providers to report and return identified overpayments. Under Section 1128J(d) of the Social Security Act and CMS's regulation at 42 CFR 401.305, overpayments must be reported and returned within 60 days of identification, subject to certain suspensions, and overpayments retained after the deadline become obligations under the False Claims Act.

Many overpayments result from simple billing errors and can be refunded through the Medicare Administrative Contractor (MAC). But when the underlying conduct may violate the Anti-Kickback Statute, the physician self-referral law, the False Claims Act, or other laws, a simple refund may not resolve the organization's potential liability. In those situations, formal self-disclosure programs can offer benefits such as reduced multipliers, releases from certain liability, and a presumption against corporate integrity agreements.

DOJ has emphasized that it rewards self-disclosure, cooperation, and remediation. In announcing fiscal year 2025 False Claims Act results, DOJ stated that several settlements reflected credit for such measures, in the form of reduced penalties or damages multiples.

The Main Self-Disclosure Pathways in 2026

1. Routine Overpayment Refunds Through the MAC

For billing errors that do not involve potential fraud or other legal violations, providers generally report and return overpayments through their MAC's voluntary refund process, using the contractor's forms and instructions. This approach is appropriate for many audit findings, such as isolated coding errors or documentation deficiencies that do not suggest knowing misconduct.

2. OIG Health Care Fraud Self-Disclosure Protocol

The OIG Health Care Fraud Self-Disclosure Protocol (SDP) is available to resolve matters that, in the disclosing party's reasonable assessment, potentially violate federal criminal, civil, or administrative laws for which civil monetary penalties are authorized. OIG states that all healthcare providers, suppliers, and other individuals or entities subject to OIG's civil monetary penalty authorities are eligible.

Key features, based on OIG's protocol and related guidance, include:

• Not for simple overpayments. OIG has long explained that disclosures characterized as mere billing errors or overpayments are not appropriate for the SDP and should be handled through normal refund processes.

• Not for Stark-only matters. If an arrangement raises a potential violation of only the physician self-referral law, it should be disclosed to CMS under the SRDP.

• Internal investigation. The disclosing party is expected to conduct an internal investigation and report findings. If the investigation is not complete at submission, the party must certify that it will complete it within 90 days of the initial submission.

• Ending the conduct. OIG states that before disclosure, the conduct should have ended, or in the case of an improper kickback arrangement, corrective action will be taken and the arrangement terminated within 90 days of submission.

• Lower multiplier. OIG's general practice is to require a minimum multiplier of 1.5 times single damages, applied to the amount paid by federal health care programs, although OIG may require a higher multiplier based on the facts.

• Minimum settlement amounts. Under the 2021 update, OIG requires a minimum settlement of $100,000 for kickback-related submissions and $20,000 for other matters.

• Presumption against integrity agreements. OIG reported that between 2016 and 2020 it resolved 330 SDP cases through settlements and released the disclosing parties from permissive exclusion without requiring integrity measures in all of them.

• Lookback. OIG expects disclosing parties to disclose with a good-faith willingness to resolve all liability within the six-year statute of limitations under the Civil Monetary Penalties Law.

• Overpayment deadline. Under 42 CFR 401.305, the 60-day overpayment deadline is suspended when OIG acknowledges receipt of a submission.

• Criminal matters. In October 2026, HHS-OIG updated the SDP to clarify that potentially criminal health care matters should be disclosed to DOJ.

3. CMS Voluntary Self-Referral Disclosure Protocol

The CMS Voluntary Self-Referral Disclosure Protocol (SRDP), established under Section 6409 of the Affordable Care Act, allows providers of services and suppliers to disclose actual or potential violations of the physician self-referral law.

Key features include:

• Stark-only conduct. The SRDP is for physician self-referral law issues. CMS has stated that parties should not disclose the same conduct under both the SRDP and the OIG SDP, and that when conduct implicates both the physician self-referral law and the Anti-Kickback Statute, parties should consult the SRDP's guidance on coordination with OIG and DOJ.

• Required forms. Disclosures use the SRDP Disclosure Form, Physician Information Forms, and a Financial Analysis Worksheet. CMS announced that OMB approved revised forms on July 17, 2026, and that the updated forms must be used for disclosures submitted on or after November 1, 2026.

• Legal and financial analysis. Disclosing parties must explain how the arrangement failed to satisfy an applicable exception and provide a financial analysis of amounts potentially due, limited to the six-year lookback period under 42 CFR 401.305(f).

• Reduction factors. CMS may reduce amounts owed based on factors including the nature and extent of the improper practice, the timeliness of the disclosure, and the party's cooperation. CMS is not obligated to reduce amounts owed.

• Overpayment deadline. CMS has explained that the obligation to return the overpayment within 60 days is suspended once the provider submits a disclosure and receives confirmation from CMS.

4. DOJ-HHS Healthcare False Claims Act Self-Disclosure Pilot Program

On October 22, 2026, HHS and DOJ's Civil Division announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program. According to HHS and the program protocol:

• Eligibility. The program is open to providers, suppliers, manufacturers, payors, and related entities that furnish, bill for, or otherwise handle items or services paid directly or indirectly by HHS federal health care programs. The disclosed conduct must be a potential False Claims Act violation previously unknown to the federal government.

• Deadline. Disclosures must be submitted by April 22, 2027. HHS stated that late or incomplete submissions will not be reviewed.

• Required contents. Disclosures must include all relevant details about the potential violations, documents showing the full nature of the conduct, a description of remedial steps, financial information for calculating repayment, a certification of truthfulness and completeness, and a designated point of contact.

• Repayment. Repayment is calculated by applying a multiplier of 1.25 to 1.6 to a Base Self-Disclosure Repayment. The multiplier depends on factors such as timeliness, duration and scope of the misconduct, senior leadership involvement, financial benefit to the company, and whether the company has successor liability but promptly remediated. For Anti-Kickback Statute matters, the protocol states that the government will consider factors such as the remuneration and revenue derived from the conduct rather than claim-paid amounts.

• Benefits. Disclosing companies receive a DOJ release for the disclosed potential False Claims Act violations without factual admissions, HHS-OIG will not require a corporate integrity agreement as part of resolving its exclusion authorities, and CMS will not impose civil monetary penalties or seek revocation.

• No duplicate disclosures. Parties need not separately disclose the same conduct to the OIG SDP or the CMS SRDP.

• Civil only. The pilot covers civil liability only. Potential criminal conduct must be disclosed to DOJ's National Fraud Enforcement Division.

Because the program protocol lists the submission email address in slightly different forms, organizations should confirm the correct address with DOJ or through counsel before submitting.

5. Voluntary Self-Disclosure of Potentially Criminal Conduct to DOJ

On October 15, 2026, DOJ's National Fraud Enforcement Division and HHS-OIG announced a policy under which a company that voluntarily self-discloses potentially criminal conduct affecting a federal health care program to the Fraud Division's Health Care Fraud Section receives the benefits of both DOJ's Corporate Enforcement Policy and the OIG SDP, without a separate submission to OIG. DOJ gave examples of covered conduct, including illegal kickbacks, schemes to bill Medicare for medically unnecessary services, and schemes to conceal an excluded provider.

DOJ stated that a company that discloses only to HHS-OIG generally will not have made a voluntary self-disclosure to the Department and generally will not qualify for a declination on that basis. DOJ also stated that companies that come forward, cooperate fully, and remediate can expect clear and predictable benefits, while those that conceal misconduct should expect a very different outcome.

When Does Self-Disclosure Make Sense?

There is no single answer, and every situation requires legal analysis. However, the following considerations often guide the decision.

Self-Disclosure May Make Sense When:

• The conduct potentially violates the Anti-Kickback Statute, physician self-referral law, False Claims Act, or other laws, rather than reflecting simple billing errors.

• The organization employed or contracted with an excluded individual whose services were billed to federal programs.

• The conduct involved knowing or reckless behavior by employees or leaders.

• There is a meaningful risk that the government will learn of the conduct from another source, such as a whistleblower, data analytics, or a related investigation.

• The organization wants certainty, a release from certain liability, and protection from a corporate integrity agreement.

• The amounts involved are significant enough that the benefits of a reduced multiplier and a release outweigh the costs of disclosure.

A Routine Refund May Be Appropriate When:

• The issue reflects isolated billing or documentation errors without indications of knowing misconduct.

• There are no indications of kickbacks, self-referral violations, or other legal violations.

• The overpayment can be accurately quantified and returned through the MAC.

Factors That Weigh on Timing

• Government awareness. Some programs, such as the DOJ-HHS pilot, require that the conduct be previously unknown to the government. Once the government has begun investigating, disclosure benefits may be reduced.

• The 60-day overpayment rule. Organizations must manage the overpayment deadline, including suspensions available under 42 CFR 401.305 for timely, good-faith investigations and for acknowledged submissions to the SDP or SRDP.

• Whistleblower risk. DOJ reported a record 1,297 qui tam lawsuits in fiscal year 2025. Employees who know about an issue may report it if it is not addressed.

• Pilot deadline. The DOJ-HHS pilot accepts disclosures only through April 22, 2027.

The Audit Work to Do Before Disclosing

A self-disclosure is only as good as the investigation behind it. Government programs expect disclosing parties to understand the conduct, quantify the impact, and demonstrate corrective action. Incomplete or inaccurate disclosures can undermine credibility and lead to removal from a program. The following steps are typically completed, or at least well underway, before a disclosure is submitted.

Step 1: Engage Counsel and Establish Privilege

Begin the investigation under the direction of experienced legal counsel. This helps protect privileged communications and work product while the organization evaluates its options.

Step 2: Preserve Records

Issue a legal hold to preserve relevant medical records, billing data, contracts, emails, and other documents. Do not alter or create records.

Step 3: Define the Scope of the Investigation

Determine:

• What conduct is at issue.

• Which services, providers, locations, and payers are affected.

• The time period, considering the six-year lookback used in the overpayment rule and the SDP.

• Who was involved and who knew about the conduct.

Step 4: Stop the Conduct and Begin Corrective Action

OIG expects the conduct to have ended before disclosure, or, for kickback arrangements, to be terminated within 90 days of submission. Stopping the conduct also limits further exposure. Begin corrective actions, such as terminating or restructuring arrangements, retraining staff, updating policies, and implementing system controls.

Step 5: Conduct a Legal Analysis

Analyze which laws may be implicated, including the Anti-Kickback Statute, the physician self-referral law, the False Claims Act, the Civil Monetary Penalties Law, and exclusion rules. For physician self-referral issues, identify which exception elements were and were not met, as required by the SRDP. The legal analysis determines which disclosure pathway is appropriate.

Step 6: Quantify the Financial Impact

Quantification is often the most demanding part of the work.

• For claims-based issues, determine the affected claims and amounts paid by federal health care programs, using claim-by-claim review or statistically valid sampling and extrapolation, documented in detail.

• For kickback matters, the OIG SDP generally uses a remuneration-based methodology, and the DOJ-HHS pilot considers remuneration and revenue derived from the conduct.

• For physician self-referral matters, complete the SRDP Financial Analysis Worksheet based on the six-year lookback period.

• For excluded individuals, identify the items and services furnished, ordered, or prescribed by the excluded person during the exclusion period.

Consider engaging a qualified statistician for sampling and extrapolation.

Step 7: Document the Facts

Prepare a clear, accurate factual narrative supported by documents. Government programs require descriptions of the conduct, how it was discovered, the individuals involved, the time period, and corrective actions. Every statement in a disclosure must be truthful, and many programs require a certification of truthfulness and completeness.

Step 8: Check for Government Inquiries

Determine whether the organization is aware of any current government inquiry, audit, or investigation related to the conduct. The OIG SDP requires a statement about knowledge of pending inquiries, and the DOJ-HHS pilot requires that the conduct be previously unknown to the government.

Step 9: Evaluate Financial Capacity

Consider whether the organization can pay the likely settlement amount. The OIG SDP has a process for parties that assert an inability to pay, which requires extensive financial information.

Step 10: Choose the Pathway and Prepare the Submission

With counsel, choose the appropriate pathway based on the nature of the conduct, the laws implicated, the availability of each program, and timing. Prepare the submission according to the program's specific requirements and forms.

Comparing the Options at a Glance

The following summary compares the main pathways:

• Simple billing errors without indications of legal violations generally go through the MAC's voluntary refund process.

• Conduct that potentially violates laws subject to OIG's civil monetary penalty authorities, such as kickbacks or employment of excluded individuals, has traditionally been disclosed through the OIG SDP, with a general minimum multiplier of 1.5 and minimum settlement amounts.

• Conduct that potentially violates only the physician self-referral law is disclosed to CMS through the SRDP, where CMS may reduce amounts owed.

• Potential civil False Claims Act violations previously unknown to the government may be disclosed through the DOJ-HHS pilot program through April 22, 2027, with a multiplier of 1.25 to 1.6 and coordinated releases.

• Potentially criminal conduct should be disclosed to DOJ's National Fraud Enforcement Division under the October 2026 joint policy.

Common Mistakes to Avoid

• Disclosing before understanding the facts. Incomplete investigations can lead to inaccurate disclosures and loss of credibility.

• Using the wrong pathway. Sending Stark-only matters to OIG, simple overpayments to the SDP, or criminal matters only to OIG can delay resolution or reduce benefits.

• Disclosing the same conduct to multiple programs without coordination. CMS has cautioned against disclosing the same conduct under both the SRDP and the SDP, and the DOJ-HHS pilot states that duplicate disclosures are unnecessary.

• Waiting too long. Delay can allow the government to learn of the conduct from another source, reduce disclosure benefits, and complicate overpayment deadlines.

• Failing to stop the conduct. Continuing the conduct after discovery undermines good faith and increases exposure.

• Weak quantification. Unsupported estimates can lead to disputes and delays.

• Overlooking individuals. The interests of the organization and individual employees or executives may differ, and individuals may need separate counsel.

• Ignoring state Medicaid. Disclosures may need to address Medicaid overpayments and state requirements.

Building Self-Disclosure Readiness Into Your Compliance Program

Organizations that have strong compliance programs are better positioned to identify issues early and make disclosure decisions quickly. HHS-OIG's General Compliance Program Guidance identifies responding to detected offenses and developing corrective action initiatives as one of the seven elements of an effective compliance program. Practical steps include:

• Adopting a written policy on overpayments and self-disclosure decision-making.

• Establishing a process for escalating potential legal violations to counsel promptly.

• Maintaining relationships with qualified counsel, auditors, and statisticians.

• Training leadership on disclosure options and timing.

• Documenting every disclosure decision and its rationale.

Frequently Asked Questions

Is self-disclosure mandatory?

Reporting and returning identified overpayments is required. Formal self-disclosure through programs such as the OIG SDP, CMS SRDP, DOJ-HHS pilot, or DOJ criminal disclosure policy is voluntary, but may be strongly advisable when conduct potentially violates federal law.

Can I use the OIG SDP for a simple billing error?

No. OIG has stated that matters characterized as mere billing errors or overpayments are not appropriate for the SDP and should be handled through normal refund processes.

Where do I disclose a physician self-referral issue?

Conduct that potentially violates only the physician self-referral law is disclosed to CMS through the SRDP. If the conduct also implicates the Anti-Kickback Statute, consult counsel about coordination with OIG and DOJ.

What is the DOJ-HHS pilot program, and how long is it available?

It is a six-month civil False Claims Act self-disclosure pilot announced in October 2026, accepting submissions through April 22, 2027, with a repayment multiplier of 1.25 to 1.6 and coordinated releases from DOJ, OIG, and CMS for eligible disclosures.

Does self-disclosure pause the 60-day overpayment deadline?

Under 42 CFR 401.305, the deadline is suspended when OIG acknowledges receipt of an SDP submission or CMS acknowledges receipt of an SRDP submission, as applicable. Organizations should confirm how deadlines apply to their situation with counsel.

Conclusion

Voluntary self-disclosure can be a valuable way to resolve potential legal violations with reduced financial exposure, greater certainty, and protection from corporate integrity agreements. In 2026, providers have more options than ever, including the OIG SDP, the CMS SRDP, the time-limited DOJ-HHS Healthcare False Claims Act Self-Disclosure Pilot Program, and the DOJ-OIG policy for potentially criminal conduct.

The key to a successful disclosure is the work done beforehand: engaging counsel, preserving records, defining scope, stopping the conduct, analyzing the law, quantifying the impact accurately, documenting the facts, and choosing the right pathway at the right time. Organizations that build these capabilities into their compliance programs can respond to problems quickly and credibly.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance, internal audits, and self-disclosure readiness. We help providers conduct privileged internal reviews in coordination with legal counsel, define investigation scope, perform claims audits and sampling, quantify potential overpayments, document corrective actions, and prepare the factual and financial materials needed for self-disclosure submissions. If your organization is considering whether to self-disclose, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. OIG's Health Care Fraud Self-Disclosure Protocol (2021). https://www.oig.hhs.gov/documents/self-disclosure-info/1006/Self-Disclosure-Protocol-2021.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure Process. https://oig.hhs.gov/documents/featured-topics/11833/Health_Care_Fraud_Self-Disclosure_Process.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure. https://oig.hhs.gov/compliance/self-disclosure-info/

• U.S. Department of Health and Human Services, Office of Inspector General. Open Letter to Health Care Providers (April 15, 2008). https://oig.hhs.gov/documents/open-letters/826/OpenLetter4-15-08.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Corporate Integrity Agreement FAQs. https://oig.hhs.gov/faqs/corporate-integrity-agreement-faq/

• U.S. Department of Health and Human Services. Department of Health and Human Services and the Justice Department's Civil Division Announce Anti-Fraud Healthcare Self-Disclosure Pilot Program (October 22, 2026). https://www.hhs.gov/press-room/hhs-doj-launch-healthcare-false-claims-act-self-disclosure-pilot.html

• U.S. Department of Justice and U.S. Department of Health and Human Services. Healthcare Self-Disclosure Pilot Program Protocol. https://www.hhs.gov/sites/default/files/doj-hhs-fca-1.pdf

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud (October 15, 2026). https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self

• U.S. Department of Justice, Office of Public Affairs. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025

• Centers for Medicare & Medicaid Services. CMS Voluntary Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/fraud-and-abuse/physicianselfreferral/downloads/cms-voluntary-self-referral-disclosure-protocol-original.pdf

• Centers for Medicare & Medicaid Services. Physician Self-Referral: Spotlight (SRDP Update). https://www.cms.gov/medicare/regulations-guidance/physician-self-referral/spotlight

• Centers for Medicare & Medicaid Services. FAQs: CMS Voluntary Self-Referral Disclosure Protocol. https://www.cms.gov/Medicare/Fraud-and-Abuse/PhysicianSelfReferral/Downloads/FAQs-CMS-Voluntary-Self-Referral-Disclosure-Protocol.pdf

• Centers for Medicare & Medicaid Services. Report to the Congress: Implementation of the Medicare Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/fraud-and-abuse/physicianselfreferral/downloads/cms-srdp-report-to-congress.pdf

• Centers for Medicare & Medicaid Services. Section 6409 of the Affordable Care Act, Medicare Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/fraud-and-abuse/physicianselfreferral/downloads/6409_of_the_aca.pdf

• Centers for Medicare & Medicaid Services. Physician Self-Referral. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• U.S. Social Security Administration. Social Security Act, Section 1128J, Medicare and Medicaid Program Integrity Provisions. https://www.ssa.gov/OP_Home/ssact/title11/1128J.htm

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/