On October 15, 2026, the Department of Justice and the Department of Health and Human Services Office of Inspector General established a joint framework laying out a unified channel through which companies could come forward with potential criminal health care violations on a voluntary basis. Filings that meet the threshold for the DOJ's National Fraud Enforcement Division stand to draw on protections offered through both agencies' separate disclosure frameworks.
A directive issued on October 1 established health care fraud as an enforcement priority and set out a formal structure for coordinating corporate investigations, steps that preceded the October 15 announcement. Taken together, the two developments bear on how misconduct is disclosed by corporations and how prosecutors weigh decisions in cases involving them.
Firms that choose to disclose criminal wrongdoing affecting a federal health care programme directly to the Fraud Division's Health Care Fraud Section can access HHS-OIG Self-Disclosure Protocol benefits without filing a separate submission through the OIG portal. Under this framework, a fraudulent payment arrangement or deceptive billing practice can draw criminal prosecution, civil liability, and administrative penalties simultaneously.
A revision to the HHS-OIG protocol established that any criminal conduct uncovered is to be forwarded to the DOJ for handling. The Justice Department has indicated that routing a disclosure exclusively through HHS-OIG does not meet the department's standard for voluntary self-disclosure and, as a result, does not provide a company with grounds to seek a declination on that basis. Organisations pursuing eligibility under both schemes are directed to bring any potentially criminal activity to the Fraud Division's attention before approaching other channels.
The October 1 policy directive sets out enforcement priorities within the health care sector, covering areas such as fraudulent billing practices, the unlawful distribution of controlled substances, and breaches of Food, Drug, and Cosmetic Act requirements. When weighing charging decisions, prosecutors are directed to place considerable emphasis on factors including the degree of management involvement, any efforts to conceal wrongdoing, and the extent of harm caused to programmes drawing on public funds.
Among the benchmarks enumerated in the framework, conduct is required to span a minimum of three years, touch at least three separate federal districts, or involve a financial trail with no fewer than 25 victims or losses totalling $25 million or more. The framework specifies that those considerations do not represent a closed or complete set.
Under the new directive, the Department of Justice's Corporate Enforcement and Voluntary Self-Disclosure Policy carries forward with its established standards left intact. Oversight of compliance with corporate resolutions will fall under the mandate of the Corporate Enforcement Section, which is also set to play an active role at every stage of Fraud Division corporate investigations.
A legal analysis directed at businesses operating in designated priority sectors has outlined recommendations to examine internal compliance frameworks, whistleblower pathways, and the procedures governing how concerns are escalated. Those recommendations draw the attention of managed care stakeholders to the internal pathways through which potential wrongdoing reaches compliance and legal teams, and to how organisations weigh their disclosure obligations. The analysis also outlines a governance framework that consolidates oversight authority into a single body.
The legal analysis further identified fraud-detection protocols and prompt action when irregularities surface as pressing responsibilities for health plans and managed care organisations in this regulatory environment.
