DOJ’s 2026 Corporate Enforcement Policy: Navigating Self-Disclosure in Healthcare’s Four-Lane Framework

On Mar. 10th, the U.S. Department of Justice announced the first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy for criminal matters. While the policy builds on prior DOJ guidance, it introduces clearer incentives and sharper consequences for how companies respond when potential misconduct is identified.

At a high level, the policy formalizes the benefits available to companies that voluntarily self-disclose, fully cooperate, and timely and appropriately remediate. Absent aggravating circumstances, DOJ states it will decline prosecution. For “near miss” disclosures or matters involving aggravating factors, the policy contemplates significant reductions in penalties, including non-prosecution agreements and substantial reductions from the Sentencing Guidelines range.

The policy is explicit on timing. To qualify, disclosure must occur before an imminent threat of disclosure or government investigation and within a reasonably prompt period after the company becomes aware of the misconduct. It also incorporates a whistleblower overlay, preserving eligibility where a company reports within a defined window, generally up to 120 days after an internal report, provided all other conditions are satisfied.

For healthcare organizations, however, the analysis does not begin and end with DOJ. Healthcare entities operate within multiple disclosure and repayment frameworks, each governed by different statutes, agencies, and enforcement priorities.

The Four Disclosure Pathways in Healthcare

1. The 60-Day Overpayment Rule (CMS / Medicare Contractors)

For traditional Medicare Parts A and B, providers must report and return identified overpayments within 60 days of identification or the date any corresponding cost report is due, whichever is later, as set forth in 42 C.F.R. § 401.305. CMS regulations define identification to include situations where a provider has, or should have, through reasonable diligence, determined that it received an overpayment. The rule includes a six-year lookback period and provides limited suspension of the repayment deadline during certain self-disclosure processes or good-faith investigations.

Failure to comply may result in liability under the False Claims Act, as retention of an overpayment beyond the deadline creates an “obligation” to repay the government under 31 U.S.C. § 3729(a)(1)(G).

2. CMS Self-Referral Disclosure Protocol (Stark Law)

CMS’s Self-Referral Disclosure Protocol permits providers to disclose actual or potential violations of the physician self-referral law and resolve associated overpayment liability. CMS retains discretion to reduce the amounts owed based on the facts and circumstances of the disclosure, consistent with 42 U.S.C. § 1395nn.

This pathway is generally appropriate for Stark-only issues, although the same facts may implicate Anti-Kickback Statute exposure if intent becomes a factor.

3. OIG Self-Disclosure Protocol (Anti-Kickback / CMP Exposure)

OIG’s Provider Self-Disclosure Protocol applies to conduct that, in the disclosing party’s reasonable assessment, may violate federal criminal, civil, or administrative laws subject to civil monetary penalties. OIG guidance explains that the protocol is intended to resolve potential fraud involving the Anti-Kickback Statute, and that settlements typically involve a multiplier, often at least 1.5 times damages.

OIG also makes clear that the protocol is not intended for isolated overpayments or Stark-only violations, which should instead be directed to CMS or Medicare contractors.

4. DOJ Corporate Enforcement and Voluntary Self-Disclosure (Criminal Exposure)

DOJ’s March 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy governs corporate criminal exposure, including healthcare fraud, kickback schemes, and other knowing misconduct. It provides a structured framework for declinations and reduced penalties where disclosure is timely, voluntary, and accompanied by full cooperation and remediation.

The Strategic Problem: These Pathways Intersect

These pathways are not interchangeable and frequently overlap. A billing issue may begin as an overpayment matter but evolve into False Claims Act exposure if knowledge or reckless disregard is established. A Stark issue may raise Anti-Kickback concerns depending on intent and financial structure.

Disclosure to CMS or OIG does not necessarily preserve the benefits of DOJ voluntary self-disclosure. Conversely, proceeding directly to DOJ may introduce broader scrutiny and cost that might not have arisen at the agency level.

Where Organizations Lose Leverage

Organizations rarely lose leverage at the moment of disclosure; they lose it beforehand. Delay while attempting to complete an internal investigation, premature classification of issues, or failure to recognize escalating risk can narrow available options.

Under DOJ’s 2026 policy, timing is critical. By the time disclosure occurs, the opportunity for a declination or favorable resolution may no longer be available.

Practical Implications for Providers, Leadership, and Investors

Healthcare organizations must be prepared to assess potential misconduct early, distinguish among overpayment, Stark, Anti-Kickback, and criminal exposure, and determine which disclosure framework applies.

For executives and boards, this is a governance issue with enterprise-level implications. For private equity investors and platform operators, it directly affects diligence, valuation, and exit risk.

Key Takeaway

Self-disclosure in healthcare is not a single decision. It is a strategic determination among multiple regulatory pathways, each with different risks and consequences.

DOJ’s 2026 policy reinforces that timing and positioning matter. Organizations that act promptly and choose the correct pathway preserve options; those that delay or miscalculate risk losing leverage before engagement with enforcement authorities begins.