The DOJ's healthcare self-disclosure pilot is open through April 22, 2027, and offers a significant opportunity. Companies that report potential False Claims Act (FCA) violations unknown to the government can resolve them at 1.25 to 1.6 times a base repayment, with a coordinated release from the DOJ and HHS and no corporate integrity agreement. However, anything the government already knows is excluded. With whistleblower cases accounting for about 80% of the government's record recoveries in FY25, and qui tam suits filed under seal, you may be behind before you know there's a race.
Why These Mistakes Keep Happening
Most compliance programs are designed to demonstrate effort, not speed. Hotlines exist, audits run, and policies get signed. But the pilot rewards the ability to quickly surface a problem, scope it, quantify it, and decide on a disclosure pathway. As Shannon Sumner of PYA noted, without strong reporting, investigation, and escalation processes, a clearer disclosure pathway may not matter. The gaps below are mostly structural and often remain invisible until a subpoena arrives.
Mistake 1: Treating the Hotline as a Mailbox
Why it happens: Hotline volume feels like a success metric, so teams focus on intake and closure rates rather than how quickly a serious allegation reaches someone who can act on it.
Consequence: A significant complaint or audit finding that sits unresolved for months can strip away options. Meanwhile, an ignored employee has a direct path to the government, and a sealed complaint may already exist.
Fix: Build severity triage into intake. Define which allegation types (billing patterns, physician compensation arrangements, referral relationships) trigger same-week escalation to compliance leadership and counsel. Track time-to-escalation for serious matters as a program metric, and treat internal reporters as an asset: close the loop with them so they have no reason to go outside.
Mistake 2: Having No Pre-Agreed Escalation Protocol
Why it happens: Compliance teams assume escalation is a judgment call best made in the moment. Under pressure, nobody is sure whether to call legal, who informs senior leadership, or who owns the file.
Consequence: Hours turn into weeks while ownership gets sorted. Evidence preservation is delayed, and the decision about whether to disclose gets made by default rather than by design.
Fix: Write the protocol before you need it. Compliance staff don't have to make the legal determination themselves; their job is recognizing when an issue is serious enough to escalate immediately. Document who gets notified, when counsel is engaged, how information is preserved, and how corrective action is recorded. Test it with a tabletop exercise against a realistic scenario, such as a physician arrangement that may implicate several statutes.
Mistake 3: Treating a Rushed Investigation as a Fast One
Why it happens: The race narrative creates pressure to disclose first and fill in the gaps later. That instinct comes from other corporate contexts where credit has gone to prompt reports made before an investigation was complete.
Consequence: The pilot doesn't work that way. The DOJ won't review partial submissions; each must fully describe the conduct, attach supporting documents, and quantify the repayment. A rushed review that misses additional violations, responsible individuals, or the full financial exposure can do more harm than good.
Fix: Separate the decision clock from the investigation clock. Move quickly on credible red flags, then assess whether you can make a complete and accurate submission. Pre-build the pieces that slow teams down: claims-data extraction capability, a repayment quantification method, and a document-collection template. Once you decide to participate, move as fast as is reasonable while keeping the disclosure accurate and complete.
Mistake 4: Assuming Civil Disclosure Covers Criminal Exposure
Why it happens: The pilot is attractive, and teams focus on the pathway in front of them. The same conduct, though, can carry civil, criminal, and administrative consequences.
Consequence: The pilot covers civil liability only. A company that mistakenly treats potentially criminal conduct as exclusively civil may forfeit favorable treatment under the criminal disclosure policy. Disclosing under the pilot alone doesn't address or mitigate criminal liability.
Fix: Engage counsel experienced in both civil FCA matters and criminal healthcare fraud early, and assess evidence of intent before choosing a pathway. There is rarely a bright line between civil misconduct and criminal conduct, so make that assessment a formal step in your investigation workflow. If credible criminal exposure exists, evaluate disclosure to the DOJ's National Fraud Enforcement Division rather than relying on the pilot.
Mistake 5: Picking a Disclosure Pathway by Habit
Why it happens: Organizations have historically sent Stark Law issues to CMS, Anti-Kickback Statute issues to OIG, and FCA issues to DOJ. The pilot adds another route rather than replacing the existing ones.
Consequence: Extra pathways add complexity. If you can't identify the full set of potential violations, you can't determine which agency to approach or what liabilities a resulting settlement will actually resolve.
Fix: Run a scoping memo before any pathway decision. List every statute the conduct may implicate, the exposure under each, and what each pathway would and wouldn't release. Weigh the pilot's coordinated release and the avoidance of exclusion from Medicare, CMS civil monetary penalties, and a corporate integrity agreement against the risks of coming forward.
Prevention Checklist
- Serious hotline and audit matters trigger escalation within a defined number of days, and you track it.
- A written escalation protocol names owners for compliance, legal, and senior leadership.
- Evidence preservation steps are documented and rehearsed.
- Investigation templates cover scope, responsible individuals, supporting documents, and repayment quantification.
- Claims-data analysis capability is in place before an issue arises.
- Counsel with civil FCA and criminal healthcare fraud experience is identified in advance.
- Every investigation includes a formal civil-versus-criminal exposure assessment.
- A scoping memo compares disclosure pathways before any submission.
- Internal reporters receive follow-up, and you monitor for retaliation risk.
- You've reviewed these controls against the April 22, 2027 pilot deadline.
The pilot can't help you find a problem. Only your program can do that, and the clock on sealed complaints is already running.
