DOJ and HHS-OIG rewired healthcare fraud self-disclosure this week. Disclosing only to OIG no longer protects you from DOJ.

In the span of eight days, the Department of Justice and HHS fundamentally changed how healthcare providers — including home health agencies — should think about voluntary self-disclosure of compliance problems. The two announcements, October 15 and October 22, 2026, did not get the press attention they deserve because they landed quietly between enforcement actions. Together they set new ground rules for an enforcement environment that DOJ's August 13 priority memo already established will only intensify.

October 15: One disclosure to DOJ now covers both agencies — and OIG-only no longer qualifies

On October 15, DOJ's National Fraud Enforcement Division (NFED) and HHS-OIG announced a joint coordinated self-disclosure policy for criminal health care fraud. The structure: a single voluntary disclosure to the Fraud Division's Health Care Fraud Section now earns the benefits of both DOJ's Corporate Enforcement Policy and HHS-OIG's Self-Disclosure Protocol (SDP). One disclosure, one point of contact, both agencies covered.

The change that matters operationally is on the other side of that equation. A disclosure made only to HHS-OIG generally will not be considered a voluntary self-disclosure to DOJ and generally does not qualify for a declination on that basis. HHS-OIG simultaneously updated its SDP to clarify that potentially criminal conduct should be disclosed to DOJ, not OIG.

This reverses the traditional compliance posture many agencies and their counsel have used. For years, an agency that discovered a potential billing problem — overpayments, unsupported claims, documentation gaps — could start with OIG's civil Self-Disclosure Protocol, resolve the civil exposure, and potentially stay clear of the criminal track. Under the new policy, that path no longer provides the same protection. Criminal exposure goes to DOJ first. Disclosing to OIG alone does not neutralize the criminal risk.

The practical consequence: if a home health agency discovers a billing pattern that could support a criminal False Claims Act theory — aide billing anomalies that resemble the Philadelphia and Minnesota cases, face-to-face documentation gaps on a scale that looks willful, or referral-source payments that didn't fit a recognized safe harbor — the new policy changes who you call first and what you say.

October 22: Six-month FCA pilot with a fixed repayment multiplier

One week later, DOJ's Civil Division and HHS announced a separate six-month Healthcare False Claims Act Self-Disclosure Pilot Program. The target is different: civil FCA exposure the government does not yet know about, rather than conduct already under investigation. The mechanism is also different: a fixed repayment multiplier for companies that proactively disclose FCA violations before the government identifies them.

A fixed multiplier matters for a specific reason. Standard FCA liability is treble damages plus per-claim civil monetary penalties. Under the FCA's self-disclosure provision at 31 U.S.C. § 3729(a)(2), agencies that self-report can reduce exposure to double damages — but negotiated resolution still leaves multiplier uncertainty. A pilot that offers a defined, published multiplier converts a contingent liability into a calculable number. For a compliance team sitting on a discovered billing error they don't yet know how to size, that predictability changes the decision calculus on whether to disclose.

The pilot runs six months from its October 22 announcement — through approximately April 22, 2027.

Why this lands differently for home health than for hospital systems

Large hospital systems have dedicated compliance officers, outside healthcare fraud counsel on retainer, and compliance programs that run constant internal monitoring. When new self-disclosure guidance lands, they review it with their legal team within days.

Mid-market home health agencies typically do not have that infrastructure. A DON running a 75-patient census with three office staff and a billing contractor is not reviewing DOJ press releases. The practical effect is that these two announcements change the risk landscape for a population of providers who are unlikely to see them before they become operationally relevant.

The enforcement context makes that exposure more acute. The NFED's August 13 priority memo named home health and hospice explicitly. The Data Fusion Center is running outlier queries against the full national claims dataset. The Northeast Strike Force expanded to Pennsylvania in August. Enforcement infrastructure is not looking for the next Philadelphia — it is running routine analytics, and the agencies it flags with billing anomalies will receive inquiries before their compliance team identifies the same issue internally.

An agency that discovers its own billing problem and discloses it — under the new framework, to DOJ, with the FCA pilot's multiplier if applicable — is in a structurally different position than an agency whose problem is identified through a program integrity query. Under the Corporate Enforcement Policy, timely self-report, cooperation, and remediation can result in a declination. An agency waiting to be found has forfeited that option.

What your agency should do

1. If you have any open compliance issues that could carry criminal exposure, talk to healthcare fraud counsel before the end of this week. The October 15 policy is already in effect. The question is not whether the new framework applies — it is whether your agency has any undisclosed issues that the new framework now governs. Your compliance counsel can assess that against the policy terms. Do not self-assess the criminal vs. civil line without a lawyer.
2. If you have an identified billing error you haven't yet addressed, evaluate the FCA pilot before April 22, 2027. The six-month window is not a deadline for panic — it is an opportunity for agencies that have done the internal work to identify a problem and quantify it to resolve civil FCA exposure at a known multiplier. That opportunity closes April 22. Issues identified after the pilot closes revert to standard FCA exposure.
3. Run your billing data through the same cross-references the enforcement infrastructure is running. Aide hours that sum above 24 in a calendar day. Service dates during a known facility admission. Visit frequency outliers against HIPPS group. These are the arithmetic patterns that surfaced the August 4 Philadelphia charges without a tip. An internal audit that finds nothing is worth as much as one that finds something — it tells you the inquiry, if one arrives, has nothing to find.
4. Confirm your existing compliance program documents what it monitors and when. Both the DOJ Corporate Enforcement Policy and the FCA self-disclosure framework give credit for effective compliance programs. A well-documented compliance function — policies, OIG/SAM exclusion screening, audit schedule, corrective action records — is the evidence base that distinguishes a self-disclosing compliant agency from a defendant arguing it wasn't willful.

What we built for this

Carelytic's compliance hub includes monthly OIG LEIE and SAM.gov exclusion screening on every employee — an excluded provider on the roster is a per-claim False Claims Act exposure regardless of whether the billing was otherwise correct. The billing pipeline cross-references claim dates against HETS eligibility status and flags service dates during facility admissions before the claim enters the transmission queue. The EVV module ties GPS check-in data to every aide visit before billing so overlapping-hour anomalies surface in the exception report rather than the claims dataset. Every access and modification carries an immutable audit trail. The compliance hub keeps corrective action plans, policy attestations, and audit records in one place — the documentation base that matters when a self-disclosure or a program integrity inquiry requires you to demonstrate what your compliance program actually monitored.