New Federal Self-Disclosure Program Raises the Stakes for Healthcare Providers and Executives
Healthcare providers routinely conduct internal billing reviews, engage outside consultants, and analyze claims data to identify reimbursement errors. But what happens when those reviews uncover potential overpayments? Must the provider immediately return the money? Can it challenge the findings? When does a potential billing discrepancy become a legal obligation to repay? And under what circumstances should a provider consider voluntary self-disclosure?
These questions have taken on renewed significance following the October 22, 2026 announcement of a new Healthcare False Claims Act Self-Disclosure Pilot Program by the U.S. Department of Justice (DOJ) and Department of Health and Human Services (HHS). The program offers qualifying healthcare organizations a defined pathway to resolve certain potential civil False Claims Act violations, including reduced financial exposure and protections against specified administrative enforcement actions. At the same time, a $32 million settlement announced earlier this year demonstrates the significant consequences that can arise when providers allegedly fail to address overpayments identified through their own internal reviews. Together, these developments present an important question for healthcare leadership: How should a provider respond when its own compliance activities reveal potentially improper reimbursement?
An Internal Audit Finding Is Not Automatically an Overpayment
A critical distinction is often overlooked in discussions of repayment obligations: an adverse audit finding does not necessarily establish that a provider received money to which it was not entitled. Billing consultants, recovery auditors, and compliance professionals may identify claims that appear inconsistent with medical necessity requirements, coverage policies, documentation standards, or billing rules. However, those findings may be subject to legitimate factual and legal disputes. A consultant may have applied an incorrect reimbursement standard, overlooked supporting documentation, or interpreted a coverage requirement differently from the provider. Consequently, healthcare organizations should not assume that every negative audit finding requires immediate repayment. Nevertheless, credible evidence of potential overpayments warrants timely investigation.
Under 42 C.F.R. § 401.305, Medicare Parts A and B providers generally must report and return identified overpayments within 60 days, subject to applicable exceptions and deadline suspensions. The regulation incorporates the False Claims Act's knowledge standard, including actual knowledge, deliberate ignorance, and reckless disregard. It also provides a limited suspension of the repayment deadline, potentially up to 180 days, for timely, good-faith investigations into related overpayments after an initial overpayment has been identified. The distinction matters: providers have the right to evaluate and challenge questionable findings, but they cannot disregard credible evidence of improper payments simply because the findings are unfavorable.
When Failing to Return an Overpayment Becomes an Enforcement Matter
The potential consequences were illustrated by the DOJ's May 2026 announcement involving Oglethorpe Inc., a psychiatric hospital operator, its founder, and two senior executives. The parties agreed to pay $32 million to resolve allegations that they knowingly failed to return Medicare overpayments associated with inpatient psychiatric admissions. According to the government, the overpayments had been identified by consultants retained by the healthcare organization. The settlement also followed an earlier Corporate Integrity Agreement, violations of which resulted in a ten-year federal healthcare program exclusion agreement. Notably, the litigation originated with four former employees, including individuals who had held senior clinical, operational, and financial positions. The settlement resolved allegations without a determination of liability.
Although the case involved psychiatric facilities, its implications extend to physician practices, clinical laboratories, pharmacies, diagnostic providers, and other organizations receiving federal healthcare reimbursement. The central issue was not simply whether the original claims were appropriate. It was the alleged knowing retention of payments after the organization had been alerted to potential problems. Under the False Claims Act, knowingly and improperly avoiding an obligation to repay the government can create liability independent of the original submission of a claim. For healthcare organizations, the manner in which internal audit findings are evaluated, escalated, and resolved can therefore become critically important.
A New Opportunity for Voluntary Self-Disclosure
The DOJ-HHS Healthcare False Claims Act Self-Disclosure Pilot Program, announced October 22, 2026, provides a new consideration for organizations that identify potential civil False Claims Act violations. The six-month program is available to qualifying healthcare companies seeking to disclose potential violations previously unknown to the federal government. Under the announced framework, participating organizations must provide a complete disclosure, produce supporting documentation, describe corrective actions, and make a financial repayment calculated using a multiplier of 1.25 to 1.6. In exchange, qualifying companies may obtain a coordinated civil resolution that includes: a release of federal False Claims Act liability for the disclosed conduct, no requirement for a Corporate Integrity Agreement as part of the resolution and protection against specified federal healthcare program exclusion actions. The program currently accepts submissions through April 22, 2027.
Importantly, this is not a general amnesty program or a substitute for ordinary Medicare repayment procedures. Eligibility depends on the nature of the conduct, the government's existing knowledge, the completeness of the disclosure, and satisfaction of the program's requirements. Potential criminal conduct also requires consideration of separate DOJ disclosure procedures. For providers confronting significant internal audit findings, the new framework adds another possible resolution strategy but determining whether to use it requires careful legal analysis.
The Decision Is Not Simply Whether to Repay
When a provider receives an adverse internal audit or consultant report, management should consider several distinct questions. The provider should evaluate the relevant coverage criteria, medical records, billing requirements, and methodology used to identify the alleged overpayments. Potential discrepancies, disputed claims, and established overpayments are not necessarily interchangeable. The applicable knowledge standard and the provider's response to credible information must be evaluated. Where repayment obligations exist, providers must assess the relevant federal or state reporting and repayment requirements, including any available suspension or applicable reconciliation process. An isolated coding mistake may present very different considerations from a systemic billing practice, repeated medical necessity deficiencies, or evidence suggesting knowing retention of improper payments. Depending on the circumstances, that strategy may involve challenging an audit, correcting claims, returning identified overpayments, conducting a broader investigation, or pursuing an available self-disclosure mechanism. There is no single response appropriate for every adverse audit finding.
Why Executive Oversight Matters
The Oglethorpe resolution also illustrates the potential significance of executive involvement in reimbursement and compliance decisions. Owners and executives may receive reports identifying questionable billing practices, recurring documentation deficiencies, or possible overpayments. They may also be responsible for allocating resources to investigations, approving corrective actions, and determining whether repayment is appropriate. Corporate status does not necessarily insulate individuals from liability for their own conduct under the False Claims Act. However, personal exposure is not automatic merely because an individual holds an executive position or receives an adverse audit report. It depends on the applicable legal standards and the individual's knowledge and conduct. Healthcare organizations should therefore establish clear procedures for escalating material audit findings, documenting management decisions, and ensuring that identified issues are evaluated to completion.
MDRXLAW regularly advises healthcare providers, owners, and executives on government investigation, Medicare and Medicaid audits, and False Claims Act exposure. Our attorneys assist providers in evaluating adverse audit findings, challenging unsupported reimbursement demands, assessing repayment obligations, and determining appropriate disclosure and resolution strategies. Healthcare organizations that have received significant internal audit findings or identified potential overpayments should seek legal guidance before making decisions that may affect their regulatory exposure, reimbursement rights, or participation in federal healthcare programs.
* This article is provided for informational purposes and does not constitute legal advice.*
If your organization has uncovered potential overpayments or received adverse internal audit findings, please feel free to contact our attorneys at info@mdrxlaw.com or at 212.668.0200 before deciding on your next steps.
