DOJ Revises Self-Disclosure and Whistleblower Policies, Streamlining Health Care Fraud Reporting and Incentivizing Whistleblowers

In a series of announcements over the past two weeks, the Department of Justice has made important changes to self-reporting and whistleblower policies.

First, on October 15, 2026, the U.S. Department of Justice’s National Fraud Enforcement Division (Fraud Division) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) issued a policy clarifying when companies should voluntarily self-disclose potentially criminal health care fraud (Policy).  Under the Policy, a company that self-discloses to the Fraud Division’s Health Care Fraud Section in accordance with DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) will automatically receive the benefits of HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP), without having to make a separate submission to HHS-OIG. A disclosure made only to HHS-OIG generally will not qualify as a voluntary self-disclosure under the CEP.

Second, on October 20, 2026, DOJ and the Fraud Division announced the Fraud Whistleblower Incentive Program (WHIP), which will pay individual tipsters $10,000 to $30,000 for information leading to criminal charges, an up-front award paid well before final resolution of a matter. 

Finally, on October 22, 2026, DOJ’s Civil Division and HHS launched a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (FCA SDPP), which offers companies that self-disclose potential civil False Claims Act (FCA) violations a coordinated civil release in exchange for repayment at a 1.25–1.6 multiplier.

I. The Coordination Policy

Under the Department of Justice’s Corporate Enforcement Program, a company that voluntarily self-discloses misconduct, fully cooperates, and timely and appropriately remediates will generally receive a declination absent aggravating circumstances.[1] On October 15, 2026, the Fraud Division and HHS-OIG built on that framework by setting forth a new single-door disclosure process for companies seeking to self-disclose potentially criminal health care fraud. Under the new Policy, a company is required to make only one disclosure to the Fraud Division’s Health Care Fraud Section to obtain the benefits of both the CEP and HHS-OIG’s SDP.[2] HHS-OIG’s SDP remains available for purely civil or administrative violations.[3] 

II. The Fraud Whistleblower Incentive Program

On October 20, 2026, DOJ announced WHIP, the first-ever whistleblower rewards program that pays an up-front award for tips leading to criminal charges.[4]  WHIP will pay whistleblowers an award of $10,000 to $30,000 for information leading to criminal charges in covered subject areas, which include federal health care crimes and fraud on government benefits administered by the Departments of Agriculture, Labor, Health and Human Services, Housing and Urban Development, Education, Veterans Affairs, and War, and the Small Business Administration.[5] 

Unlike most existing government whistleblower programs, which issue awards only after final resolution of a criminal matter, WHIP rewards whistleblowers at a much earlier stage of prosecution, with awards made in DOJ’s sole discretion following the filing of criminal charges.[6] DOJ has explained that these early-stage rewards are intended to encourage prompt disclosure by giving whistleblowers more certainty about the amount and timing of a payment.[7]  WHIP participants also remain eligible for potentially larger awards through other programs, including the Criminal Division’s Corporate Whistleblower Awards Pilot Program, should their tips ultimately lead to large financial penalties or forfeiture.[8]

III. The Healthcare False Claims Act Self-Disclosure Pilot Program

On October 22, 2026, DOJ’s Civil Division and HHS launched the FCA SDPP to offer a clear and predictable pathway for companies to obtain a coordinated resolution of civil liability under the federal FCA and certain HHS administrative authorities.[9] 

The pilot is open to health care providers, suppliers, manufacturers, payors, and related entities that furnish, arrange for, manufacture, distribute, insure, administer, or bill for items or services paid for, directly or indirectly, by HHS federal health care programs.[10] The submission must disclose a potential FCA violation previously unknown to the federal government; if the government was already aware of the conduct, the company may still receive self-disclosure and cooperation credit, but it will not be eligible for a resolution under the pilot.[11] 

A disclosing company will receive a coordinated civil release with no factual admissions, including a release from the Civil Division under the FCA for the disclosed conduct.[12] HHS-OIG will not require a Corporate Integrity Agreement, and CMS will not impose civil monetary penalties or seek revocation.[13]  The company also need not separately disclose the same conduct through other civil self-disclosure programs, such as the CMS Self-Referral Disclosure Protocol.[14] The financial repayment will be subject to a 1.25–1.6 times multiplier, and the multiplier will vary based on factors such as the timeliness of the disclosure, the duration and scope of the misconduct, the involvement of senior leadership, the financial benefit to the company, and whether the company has successor liability for the misconduct but promptly remediated.[15] For Anti-Kickback Statute claims, the government will forego damages based on claim-paid amounts and instead calculate the repayment based on the amount of remuneration, the revenue derived from the disclosed conduct, and the absence of aggravating factors such as patient harm.[16] The FCA SDPP includes sample repayment calculations that companies should consult to assess potential exposure.[17]

The FCA SDPP is available only for conduct that potentially violates civil laws; a company seeking to self-disclose potential criminal health care conduct must disclose it to the Fraud Division under the new single-door Policy.[18] In practice, that line may be difficult to draw.  Conduct such as a potential violation of the Anti-Kickback Statute can give rise to both criminal liability and FCA liability, and a company may not know early in an investigation whether the government will view the conduct as criminal. This can require companies early on in the process to decide not only whether to self-disclose but where to self-disclose and if they should be disclosing to multiple authorities.

IV. Key Takeaways

• Companies that identify potentially criminal health care fraud now have a single point of entry. A qualifying disclosure to the Fraud Division’s Health Care Fraud Section secures both CEP and SDP benefits, eliminating the need to navigate parallel submissions.
• Disclosure sequencing matters. Companies that self-report potentially criminal conduct only to HHS-OIG risk forfeiting eligibility for a CEP declination. Where there is a realistic prospect of criminal exposure, companies should consider disclosing to the Fraud Division first.
• The HHS-OIG SDP remains the appropriate channel for conduct implicating only civil or administrative liability under HHS-OIG’s civil monetary penalty authorities. Companies should therefore carefully assess, at the outset of any internal investigation, whether conduct may rise to the level of a criminal violation.
• The Policy does not change the substantive requirements of either program. A disclosure must still satisfy each element of the CEP’s voluntary self-disclosure definition, and companies will still need to cooperate fully and remediate to obtain the Policy’s benefits.
• WHIP compresses the timeline for corporate self-disclosure. Because tipsters can now receive cash as soon as charges are filed, employees and other insiders have a more immediate incentive to report directly to DOJ. The CEP’s benefits depend on a disclosure being voluntary and made before the government learns of the misconduct from another source, so companies should expect less time to investigate before deciding whether to self-report—particularly in the hospice, home health, and other health care areas WHIP prioritizes.
• The FCA SDPP window is short. Submissions close on April 22, 2027, and the conduct must be previously unknown to the government. Companies with potential FCA exposure should evaluate eligibility promptly, particularly given the heightened incentives for whistleblowers to report first.
• The Policy, WHIP, and the FCA SDPP reflect DOJ’s continued emphasis on incentivizing self-reporting in the health care fraud space. As Assistant Attorney General Colin M. McDonald stated, “If a company comes forward, cooperates fully, and remedies the misconduct, the benefits are clear and predictable. If a company conceals what it knows, it should expect a very different conversation.”[19]

[1] U.S. Dep’t of Justice, Nat’l Fraud Enforcement Div., “National Fraud Enforcement Division and HHS-OIG Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters” § II.A (Oct. 15, 2026).

[2] Id.

[3] Id. § I; U.S. Dep’t of Health & Human Servs., Office of Inspector General, “Health Care Fraud Self-Disclosure Protocol” § 2.B (updated Oct. 15, 2026).

[4] Press Release, U.S. Dep’t of Justice, “Justice Department Announces Innovative Whistleblower Rewards Program to Combat Fraud” (Oct. 20, 2026), https://www.justice.gov/opa/pr/justice-department-announces-innovative-whistleblower-rewards-program-combat-fraud.

[5] Id.

[6] Id.

[7] Id.

[8] Id.

[9] U.S. Dep’t of Justice & U.S. Dep’t of Health & Human Servs., “Department of Justice and Department of Health and Human Services Healthcare Self-Disclosure Pilot Program” § I (Oct. 22, 2026) (hereinafter “FCA SDPP Protocol”); Press Release, U.S. Dep’t of Justice, “Justice Department’s Civil Division and the Department of Health & Human Services Announce Anti-Fraud Healthcare Self-Disclosure Pilot Program” (Oct. 22, 2026), https://www.justice.gov/opa/pr/justice-departments-civil-division-and-department-health-human-services-announce-anti-fraud (hereinafter “FCA SDPP Press Release”).

[10] FCA SDPP Protocol, supra note 9, § II.

[11] Id.

[12] Id. § III.

[13] Id.

[14] Id.

[15] Id.

[16] Id.

[17] Id.

[18] Id. § I n.1; FCA SDPP Press Release, supra note 9.

[19] Press Release, U.S. Dep’t of Justice, “National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud” (Oct. 15, 2026), https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self.