The DOJ’s new self-disclosure pilot gives healthcare companies a real reason to come forward on False Claims Act exposure — a lower repayment multiple, a coordinated release, no corporate integrity agreement. But whistleblowers still reach the government first, and the pilot is closed to anything it already knows about. Three experts tell CCI the offer helps only companies whose compliance programs can surface their own problems in time.
The DOJ’s new healthcare self-disclosure pilot is a bet on carrots. Through April 22, 2027, companies that come forward with potential False Claims Act (FCA) violations the government doesn’t already know about can resolve them for 1.25 to 1.6 times a base repayment, with a coordinated release from the DOJ and Health and Human Services (HHS) and no corporate integrity agreement. The open question is whether a better deal changes corporate behavior when the government’s best leads already come from someone else.
In a written Q&A with CCI, experts and observers agreed that whistleblowers put companies in a race against time and that the pilot’s value depends on whether companies can find and investigate their own problems quickly enough to use it.
Whistleblowers drive healthcare FCA enforcement. Relators filed a record 1,297 qui tams across all sectors in FY25, 458 of them in healthcare, and whistleblower cases produced about 80% of the government’s record recoveries. Because those suits are filed under seal, a company weighing disclosure may already be too late, and the pilot is closed to conduct the government already knows about.
“The race may begin before a healthcare organization even knows there is a problem,” said Jose Vela Jr., a healthcare attorney at Clark Hill.
That puts the weight on companies’ compliance programs.
“If an organization does not have strong reporting, investigation and escalation processes, the benefits of a clearer disclosure pathway may not matter very much,” said Shannon Sumner, a principal at consultancy PYA.
Even when companies spot misconduct first, the incentive may mainly reach those already willing to disclose. Jeff McSorley, a partner in Crowell & Moring’s healthcare group and former DOJ trial counsel, expects the pilot to increase disclosures, “particularly among companies already inclined to come forward.”
Vela put the burden on the government: “DOJ will have to demonstrate that the benefits of participating outweigh the risks of coming forward.”
The below Q&A has been edited for length:
CCI: Healthcare companies already have multiple avenues for self-disclosure. What makes this program unique, and do you think it will incent self-reports in a more effective way than those other avenues? In short, why this program, why now, and are there aspects of it you expect to be more successful than other programs?
Jose Vela Jr.: DOJ has created another self-disclosure pathway, not replaced the existing CMS and OIG programs. Historically, healthcare organizations disclosed Stark Law violations to CMS, Anti-Kickback Statute violations to OIG, and potential False Claims Act violations to DOJ. The new pilot offers an opportunity to resolve overlapping federal civil and specified administrative exposure through a coordinated process with more predictable financial consequences. That gives healthcare organizations a financial incentive to come forward, particularly when exclusion from Medicare or loss of billing privileges could threaten their survival. But additional disclosure pathways also create complexity. Organizations must identify the violations, select the appropriate agency, and determine what liabilities the resulting settlement will actually resolve. DOJ will have to demonstrate that the benefits of participating outweigh the risks of coming forward.
Shannon Sumner: What stands out is that the government is trying to make self-disclosure clearer and more predictable. For potential civil violations of the False Claims Act, companies now have one point of disclosure through the DOJ Fraud Division, rather than navigating separate DOJ and OIG processes. From a compliance perspective, however, the real issue is whether the organization can identify problems early enough to use that opportunity. A strong compliance program should be able to detect concerns, investigate them quickly, escalate significant issues and document corrective action. … If an organization does not have strong reporting, investigation and escalation processes, the benefits of a clearer disclosure pathway may not matter very much.
Jeff McSorley: The new pilot program is unique because it specifically addresses civil False Claims Act (FCA) exposure, which other self-disclosure pathways generally do not resolve. … For legitimate healthcare companies, the FCA can pose the greatest financial risk because of the magnitude of potential liability. Before this pilot program, companies that took advantage of other disclosure pathways were left in a state of limbo about their potential FCA exposure. This program addresses that problem. … Companies can now reduce their overall financial liability, obtain a civil release and avoid administrative consequences such as exclusion from Medicare, CMS civil monetary penalties, or a costly corporate integrity agreement. … I expect it to increase disclosures, particularly among companies already inclined to come forward. Ultimately, its success will depend on consistent implementation and whether companies view the benefits as sufficient to justify the risks of disclosure.
CCI: The pilot covers civil liability only. Potential criminal conduct must be disclosed to the DOJ’s new National Fraud Enforcement Division. According to the announcement, a company that has made a criminal disclosure there need not submit a duplicate one to the pilot to seek the civil release; the DOJ says it will request additional information only as necessary. How should companies handle conduct with possible criminal exposure alongside the civil pilot?
JV: The same conduct can expose a healthcare organization to civil, criminal, and administrative liability. A physician compensation arrangement, for example, may violate Stark, the Anti-Kickback Statute, and the False Claims Act, and potentially constitute criminal fraud. DOJ’s coordinated policies recognize these overlapping violations. … The challenge is identifying the full scope of the misconduct before selecting the disclosure pathway. A company that mistakenly treats potential criminal conduct as exclusively civil may lose the opportunity to obtain favorable treatment under the criminal disclosure policy. DOJ has reduced duplicative submissions, but healthcare organizations remain responsible for identifying the violations and selecting the appropriate disclosure pathway. Getting it wrong can have serious consequences.
SS: Compliance teams do not need to make that legal determination themselves. Their job is to recognize when an issue is serious enough to require immediate escalation. … Organizations should have clear protocols for when compliance involves legal counsel and senior leadership. They should also know how they will preserve information, investigate the issue and document corrective action. The key is having that process established before a serious issue occurs. A well-designed compliance program helps ensure that significant concerns reach the right people quickly enough for the organization to make an informed decision about what to do next.
JM: When conduct may give rise to both civil and criminal liability, companies should promptly investigate the facts, assess the evidence of intent and involve counsel experienced in both civil False Claims Act (FCA) matters and criminal healthcare fraud. If there is credible potential criminal exposure, the company should carefully evaluate disclosure to DOJ’s National Fraud Enforcement Division (NFED), rather than relying solely on the civil self-disclosure pilot. This can be a difficult judgment call because there is rarely a bright line separating civil misconduct from criminal conduct. … From a civil perspective, the DOJ Civil Fraud Section will likely evaluate self-disclosures in the same manner, regardless of if they come through NFED or the new anti-fraud healthcare self-disclosure pilot program. The more consequential distinction is criminal exposure: disclosing under the pilot program alone does not address or mitigate potential criminal liability.
Q&A: False Claims Act’s Qui Tam Provisions Upheld — for Now
Constitutional challenge to whistleblower suits isn’t over, but neither is blistering pace of filings
Read moreDetailsCCI: Whistleblowers have long driven healthcare-related FCA enforcement (including producing about 80% of the record recoveries in FY25), and because qui tams are filed under seal, a company may not know whether a relator has already alerted the government. But notably, the pilot excludes conduct the government already knows about, such as what it’s heard from whistleblowers. Given all that, how should whistleblower risk shape the timing of self-disclosure under this pilot? Are companies in a race against time?
JV: Yes. The race may begin before a healthcare organization even knows there is a problem. Whistleblowers can report suspected misconduct directly to the government, and False Claims Act lawsuits filed under seal may remain unknown to the company for months or years. … A rushed investigation that misses additional violations, responsible individuals, or the full financial exposure may do more harm than good. Healthcare organizations must investigate quickly without sacrificing accuracy or completeness. The greatest risk is waiting until a government subpoena or whistleblower complaint forces an organization to confront misconduct that its own compliance program should have identified earlier.
SS: There is certainly more reason to move quickly. … However, I would not describe this as simply a race to the DOJ. It is really a race to understand your own compliance issues. Organizations need reporting systems that employees trust and processes that allow serious concerns to be evaluated quickly. If a significant hotline complaint or audit finding sits unresolved for months, the organization may lose options it otherwise would have had. This is another reason organizations should view internal reporters as an important part of the compliance program. Employees need to know that concerns will be taken seriously and addressed promptly. The earlier an organization understands a problem, the more effectively it can decide how to respond.
JM: To a certain extent, yes — companies are in a race against time. … That urgency, however, is not a reason to disclose hastily. Companies should promptly investigate credible red flags, assess potential liability and determine whether they can make a complete and accurate submission. … The challenge is balancing the risks of premature disclosure against the risk of losing the opportunity to qualify for the benefits of the pilot program. … Once a company decides to participate, it should move as quickly as reasonably possible while ensuring its disclosure is accurate and complete.
CCI: In other corporate matters, self-disclosure has often happened before internal investigations are complete, and companies have routinely received credit for “timely” reports. Does this pilot raise the stakes in that area? A timelier disclosure lowers the multiplier, but the DOJ won’t review partial submissions; each must fully describe the conduct, attach supporting documents and quantify the repayment. How should compliance teams run internal investigations so the company can disclose both quickly and completely? In your experience, do most companies have this well in hand or is more work necessary in this area?
JV: This may be the program’s greatest challenge. … Healthcare organizations must identify misconduct, determine which laws were potentially violated, establish its scope, and quantify the financial consequences, often before knowing whether a whistleblower has already contacted the government. There is no one-size-fits-all compliance program. HHS-OIG recognizes that organizations differ in size, complexity, and resources. A major health system may have dedicated compliance officers, auditors, and legal counsel. A small physician practice may depend on outside professionals. In my experience, identifying a problem is often easier than determining its full scope and financial consequences. DOJ should consider these differences when evaluating timeliness. The objective should be to reward genuine cooperation, not simply the financial ability to investigate faster.
SS: This is where compliance program effectiveness becomes very practical. … Companies therefore need investigation processes that can move quickly while still producing reliable information. Many organizations have investigation policies. The better question is whether those policies actually work when a significant issue arises. Compliance leaders should know who will lead the investigation, how documents and data will be collected, how financial impact will be determined, and when matters will be escalated. Organizations should test those processes by reviewing recent investigations and asking: How quickly did we identify the problem, determine its scope, quantify the impact and correct it? Those are meaningful measures of compliance effectiveness.
JM: The anti-fraud healthcare self-disclosure pilot raises the stakes because timeliness can affect the financial benefit, but the DOJ expects a fulsome submission—not a preliminary notice. Companies need a fast and disciplined process for investigating potential misconduct, assessing FCA exposure, gathering supporting documentation and calculating potential repayment obligations. In practice, companies should not wait until every factual question is resolved before disclosing if they have determined that disclosure is in their best interest. Instead, they should make the submission as fulsome as possible, supplement it if additional information becomes available, and respond openly and transparently to follow-up questions from attorneys in the Civil Fraud Section. … Even robust disclosures will likely require some follow-up. The greater risk is not necessarily that a company needs to supplement its disclosure in some manner, but that the government perceives the company as withholding information or not being forthright. Compliance teams should therefore prioritize a structured investigation, early involvement of experienced FCA counsel and transparent engagement with the government. Speed matters, but credibility throughout the process is essential.
CCI: Under the pilot, a disclosing company repays 1.25 to 1.6 times a base amount the DOJ calculates from the company’s financial data. Where a company lands in that range depends on several factors, including whether senior leadership was involved in the misconduct. That creates a potential conflict when those same leaders have a say in whether the company discloses at all. What role should the board and C-suite play in deciding whether to self-disclose, particularly in cases where senior leaders may have been involved in misconduct?
JV: Senior leadership involvement creates two problems: potential misconduct and a conflict of interest in deciding whether to disclose it. Executives implicated in questionable conduct should not control the investigation, determine what information reaches the board, or decide whether the company approaches DOJ. The board or an independent committee should oversee the investigation and disclosure decision when credible allegations implicate senior management. Independent counsel can preserve the integrity of that process and ensure decisions serve the organization rather than the individuals under investigation. DOJ’s repayment formula expressly considers senior leadership involvement, making corporate governance a financial issue as well as a legal one. A company cannot credibly demonstrate accountability while allowing potentially responsible executives to control the investigation into their own conduct.
SS: The most important principle is independence. If senior leaders may be involved in the conduct, the compliance program needs a way to escalate the issue without relying on those same individuals. … That is why direct access between the compliance function and the board is so important. The board does not need to conduct the investigation, but it should ensure the matter receives appropriate independent review and that management responds appropriately. Organizations should establish this process before a crisis occurs. If compliance has true independence, clear escalation authority and meaningful access to the board during normal operations, the organization is much better positioned to respond when allegations involve senior leadership.
JM: … Companies need an objective decision-making process that prioritizes legal obligations and long-term interests over any individual executive’s interests. In these circumstances, the board or an independent committee should oversee the investigation, with independent counsel where appropriate. Potentially implicated executives should not control the investigation or the disclosure decision. Companies must learn the facts and assess legal exposure without allowing personal interests to distort that analysis. The objective is to convince DOJ that the company is trying to do the right thing. That can pose a challenge when an executive who engaged in wrongful conduct is leading the company’s remediation efforts. … But the decision should not turn solely on the potential financial penalty. Boards must also consider broader exposure, including potential criminal liability, exclusion from federal healthcare programs, reputational damage and the need to remediate underlying misconduct. Ultimately, effective compliance requires accountability at the top.
