One of the hardest questions that healthcare organizations that uncover a potential False Claims Act (FCA) problem have is whether to self-disclose an issue and at what cost. On October 22, 2026, the U.S. Department of Justice (DOJ) Civil Division and the U.S. Department of Health and Human Services (HHS) offered a more concrete answer, at least for a limited time, by launching the Healthcare False Claims Act Self-Disclosure Pilot Program (the FCA SDPP or Pilot).
The published FCA SDPP Protocol (the Protocol) allows a healthcare organization to obtain a coordinated resolution of civil liability for a potential FCA violation, predicated on conduct the government does not already know about, with a defined repayment. The Protocol is unique in that it will not require factual admissions or a Corporate Integrity Agreement (CIA).
Submissions to the Pilot are due by April 22, 2027. For leadership, compliance, and in-house legal teams, the window is short enough that the decision whether to use the Protocol should begin now.
Background
The FCA remains the government’s principal civil tool for recovering funds paid on false or improper claims, and healthcare is its primary focus. In fiscal year 2025, DOJ recovered more than $5.7 billion from the healthcare industry, more than 83% of all FCA recoveries. Defendants face treble damages plus per-claim penalties, and resolutions with DOJ and HHS have traditionally carried the risk of a multi-year CIA with independent review, reporting, and certification obligations.
The Pilot is the civil counterpart to the Policy on Coordination of Voluntary Self-Disclosure in Health Care Fraud Matters (the Coordination Policy), which the DOJ’s National Fraud Enforcement Division (the Fraud Division) and HHS Office of Inspector General (HHS-OIG) announced on October 15, 2026. The Coordination Policy routes self-disclosures of potential criminal healthcare conduct to DOJ’s Fraud Division, while clarifying that qualifying disclosures will still be afforded the benefits of HHS-OIG’s Self-Disclosure Protocol. An organization that has already made a qualifying criminal disclosure need not file a duplicative civil submission.
How the Pilot Works
The Pilot is open to providers, suppliers, manufacturers, payors, and related entities paid directly or indirectly by HHS federal healthcare programs. The disclosed conduct must be a potential FCA violation previously unknown to the federal government. Conduct the government already knows about may still earn cooperation credit, just not a FCA SDPP resolution.
A qualifying submission must fully describe the conduct and the legal requirements at issue, attach supporting documents, describe remedial measures, provide financial information sufficient for DOJ to calculate a “Base Self-Disclosure Repayment,” and include a certification by an authorized representative that the submission is truthful and complete. Late or partial submissions will not be reviewed.
The benefits of self-disclosure under the Protocol are clear. A disclosing entity would receive a DOJ civil release under the federal FCA for the disclosed conduct, with no factual admissions. HHS-OIG will not require a CIA, CMS will not impose civil monetary penalties or seek Medicare enrollment revocation, and the organization need not separately disclose the same conduct through other HHS self-disclosure programs (such as the HHS-OIG Health Care Fraud Self-Disclosure Protocol or the CMS Self-Referral Disclosure Protocol). The financial repayment terms are 1.25 to 1.6 times the “Base Self-Disclosure Repayment,” with placement within that range depending on the timeliness of the disclosure, the duration and scope of the conduct, senior leadership involvement, the financial benefit to the organization, and whether the organization promptly remediated conduct it inherited through an acquisition.
The Clock Is Set by Insiders, Not Just the Government
Although the “previously unknown conduct” requirement reads like a technical eligibility rule, it is in practice a deadline that a company’s own personnel may control.
Whistleblowers are now the dominant source of FCA enforcement. In fiscal year 2025, they filed a record 1,297 new FCA suits, and whistleblower-initiated cases produced more than 77% of all recoveries. In September 2026, the Eleventh Circuit upheld the constitutionality of the FCA’s whistleblower provisions, leaving that incentive fully intact for the time being. Because whistleblower complaints are filed under seal, an organization may not learn that the government already knows of the conduct until it is too late to qualify for this Protocol. DOJ made the connection explicit, warning that the Civil Division, “in partnership with whistleblowers, will root out the fraud.”
Because whistleblowers and regulators work closely together, healthcare organizations should treat internal compliance reports differently while the Protocol remains open. Not only is a hotline complaint, a pointed email from a billing manager, or an exit interview that raises compliance concerns an investigation trigger, it may signal that the same individual is also in contact with the government at a time when the cost of disclosure can be quantified in a way it previously could not. If the government is already aware of the alleged conduct, disclosure under the FCA SDPP is likely unavailable. Akin to a race to the courthouse, at least for the next several months, healthcare companies will face heightened whistleblower risk as they work to get ahead of potential qui tam filings.
For now, organizations considering the FCA SDPP should treat internal compliance reports as the start of a far more imminent disclosure decision, with counsel involved early and the investigation scoped from the outset to support a potential submission.
Kickback Matters May See the Largest Benefit
The Pilot’s most significant financial feature is its treatment of FCA cases based on the Anti-Kickback Statute (AKS). In those cases, the government ordinarily measures damages by the full value of the tainted claims, a figure that can be many multiples of the remuneration itself. For the limited purposes of the FCA SDPP, the government has stated it will “forego damages based on the claim-paid amounts” and will instead calculate repayment based on the amount of the remuneration, the revenue derived from the conduct, and the absence of aggravating factors such as patient harm.
While the FCA SDPP protocol does not specify how DOJ will weigh remuneration against revenue, the difference can be substantial. Organizations with AKS exposure, including acquirers that discover legacy arrangements after closing, should engage with these compliance issues on a tighter timeline than they may have previously.
The Pilot’s applicability to Stark violations is much less certain. Because the Stark law imposes strict liability while the FCA has an intent element, a Stark violation does not necessarily give rise to FCA liability. Conduct that may violate the Stark law but not the AKS therefore fits within the Pilot only if it also creates FCA exposure. The Pilot’s guidance states that participants need not make separate disclosures under the CMS Self-Referral Disclosure Protocol (SRDP), the traditional Stark disclosure mechanism, but it does not say how the Pilot will treat a Stark-based submission. Providers with self-referral issues should not assume the Pilot covers that conduct but should first assess whether the FCA is implicated.
Wound Care and Skin Substitutes
Few corners of healthcare face more acute FCA pressure than wound care. As we’ve previously discussed, DOJ announced a national focus on wound care and skin substitutes in June 2025, and beginning in calendar year 2026, CMS began paying for skin substitutes under the Physician Fee Schedule as incident-to supplies, a change expected to cut Medicare spending on these products by nearly 90%. Subpoena activity in the space has drawn growing industry attention.
That combination makes wound care a natural candidate for the Pilot. The sector’s typical issues, such as documentation, medical necessity, and application frequency, are the type of billing problems the protocol contemplates resolving through claims sampling and extrapolation. Product arrangements among manufacturers, distributors, and treating providers may also raise AKS questions where the Pilot’s remuneration-based measure could substantially reduce exposure. And because enforcement activity in the sector is already elevated, the window to disclose conduct the government does not yet know about may be closing faster here than elsewhere. Wound care operators, skin substitute manufacturers, and investors in the space should consider an expedited review of billing and product arrangements.
Limits to Weigh Before Self-Disclosure
While the Pilot offers defined terms, it should not be misconstrued as a safe harbor. A disclosure cannot be withdrawn once made. And the protocol does not address what happens if the company and DOJ cannot agree on the scope of the conduct or the repayment amount. The FCA SDPP covers civil liability only, and conduct with potential criminal exposure, which can include AKS matters, must be addressed through DOJ’s Fraud Division under the Coordination Policy. Because the required certification places responsibility on the signatory, organizations should decide deliberately who certifies and what diligence supports the certification. Finally, the release extends to federal FCA liability and specified HHS authorities, not to state law claims.
Questions for Leadership and Compliance Teams
Organizations should consider several questions as soon as possible:
- Has the organization received any internal complaint, hotline report, or audit finding involving billing practices or payments to referral sources that has not been fully resolved?
- Could any of that conduct carry criminal exposure, which would change where a disclosure must be made?
- Can the organization quantify the issue through claims sampling or payment and revenue records?
- Has the organization recently completed an acquisition whose legacy practices have not been fully reviewed, given that prompt remediation of inherited conduct reduces the multiplier?
- And can the investigation, documentation, and certification realistically be completed before April 22, 2027?
Looking Ahead
Read together with the October 15 Coordination Policy, the Pilot sends a consistent message: organizations that come forward early will have more clarity on the terms of their resolution, and those that wait for the government or a whistleblower to find them will not. Whether the government extends the Pilot or makes it permanent may depend on how many organizations act between now and April 2027. Regardless, organizations with potential exposure should not plan around an extension.
Akerman’s healthcare attorneys will continue to monitor the Pilot’s implementation and are prepared to advise organizations on FCA exposure, internal investigations, and self-disclosure strategy.