Article
What changed in October
Three federal moves landed within about two weeks. On October 14, 2026, the HHS Secretary’s delegation of permissive exclusion authority under Section 1128(b) of the Social Security Act to CMS was published in the Federal Register, effective immediately. HHS-OIG keeps its own exclusion power, so health systems now face two agencies that can bar them from federal programs on the same set of grounds.
On October 15, DOJ’s Fraud Division and HHS-OIG announced a joint policy that makes the Fraud Division the single intake point for self-reporting potential criminal health care violations. A qualifying report can earn credit under both DOJ’s corporate enforcement policy and OIG’s Self-Disclosure Protocol; a report made only to OIG earns no DOJ credit.
On October 22, HHS and DOJ’s Civil Division launched a six-month False Claims Act self-disclosure pilot. Companies that fully disclose previously unknown conduct, document it, remediate and repay at 1.25 to 1.6 times the base amount can receive a release of FCA liability, with no OIG exclusion or corporate integrity agreement and no CMS enrollment revocation or civil monetary penalties. Submissions close April 22, 2027.
The backdrop is an aggressive enforcement year. DOJ’s June 23, 2026 national takedown charged 455 defendants, including 90 doctors and other licensed professionals, over more than $6.5 billion in alleged false claims.
Why this is a governance issue
The pilot sets the multiplier partly on how quickly a company discloses and whether senior leadership was involved. Conduct the government already knows about is ineligible. That means the speed and integrity of internal escalation now carry a direct price, and the window is fixed. Meanwhile, CMS’s new authority raises open questions about its procedures, appeals and settlement waivers, so outcomes may be less predictable than under OIG alone.
What boards should review now
- Escalation path: How fast does a credible overpayment or billing concern reach the compliance committee, and who decides whether to investigate?
- Disclosure decision rights: Is it documented who recommends and who approves a civil or criminal self-disclosure, and on what timeline relative to April 22, 2027?
- Open matters: Ask counsel and the chief compliance officer for an inventory of unresolved audits, hotline reports and overpayment reviews that could be candidates.
- High-risk service lines: Confirm audit coverage for areas flagged in recent enforcement, such as behavioral health, hospice, wound care, durable medical equipment and telemedicine.
- Acquisitions: Review diligence and post-close audits, since the pilot gives weight to prompt correction of inherited problems.
- Exclusion exposure: Revisit screening and contingency plans now that both CMS and OIG can act.
These are questions for management and counsel, not legal conclusions; each organization’s facts will drive the right answer.
Sources
- HHS, DOJ Launch Healthcare False Claims Act Self-Disclosure Pilot (HHS, Oct 22, 2026)
- DOJ Sharpens Health Care Fraud Focus (Alston & Bird, Oct 27, 2026)
- HHS Secretary Delegates Permissive Exclusion Authority to CMS (Morgan Lewis, Oct 19, 2026)
- What Health Care Organizations Should Know About DOJ’s 2026 Fraud Takedown (Polsinelli, Jun 25, 2026)