The OIG Self-Disclosure Protocol

The OIG Self-Disclosure Protocol — its full name is OIG's Health Care Fraud Self-Disclosure Protocol — is a published, voluntary process the HHS Office of Inspector General (OIG) offers to a provider that has discovered its own potential fraud and wants to resolve it before, or instead of, being investigated. OIG first issued it in 1998, reissued and renamed it in 2013, and amended it in 2021. It sits in the Compliance and Regulations category because self-disclosure is the endpoint of a working compliance program: it is what a practice does with the serious thing an audit or an investigation turns up.

The protocol is grounded in OIG's own enforcement authority. OIG is the agency that imposes civil monetary penalties under the Civil Monetary Penalties Law (section 1128A of the Social Security Act) and that can impose exclusion from the federal health care programs under section 1128. The SDP is the channel through which OIG will compromise those two authorities — a penalty and the threat of exclusion — in exchange for a provider's voluntary, cooperative disclosure. Any provider, supplier, or other person subject to OIG's civil-monetary-penalty authority is eligible to use it; it is not limited to a specialty or a size.

The single most useful thing to understand about the SDP is its boundary, because getting the channel wrong wastes time and can forfeit the benefit. The SDP is for a matter that, in the provider's own reasonable assessment, potentially violates a federal criminal, civil, or administrative law for which civil monetary penalties are authorized. In plain terms: it is for potential fraud. A false-billing pattern the provider knows was not payable, a kickback arrangement, or billing for services an excluded person furnished are the kinds of conduct it exists to resolve.

Two categories of problem are expressly outside it, and both have a different home:

• A matter that is only an overpayment or an error. If the conduct carries no potential fraud liability — a genuine mistake, a miscalculation, a duplicate payment with no bad intent behind it — the SDP is not the route. That belongs in the payer's voluntary refund process, disclosed to the Medicare contractor or other responsible payer. OIG says as much directly: if it reviews a disclosure and finds no potential fraud liability, it refers the matter to the payer to accept the refund and provides no penalty release, because there was nothing of its kind to release.
• A physician self-referral (Stark) issue that stands alone. Conduct that raises liability only under the physician self-referral law, with no accompanying Anti-Kickback exposure, is disclosed to CMS through its separate Self-Referral Disclosure Protocol — a different protocol, run by a different agency. OIG does not settle Stark-only matters, and the two protocols are not used for the same arrangement. Where an arrangement implicates both the Anti-Kickback Statute and Stark, it goes to OIG's SDP; where it is Stark and nothing else, it goes to CMS.

Self-disclosure is voluntary, so the protocol has to be worth using. Its value is that resolving a matter through the SDP is materially better than having the government find the same conduct on its own, in three concrete ways.

1. 01

   A lower multiple of damages

   When the government resolves a matter it initiated, it can seek a higher multiple of the single damages, plus penalties. OIG's stated practice is to settle SDP matters for a lower multiplier than it would require in a government-initiated case, because a provider that came forward and cooperated is in a different position than one that was caught. The exact multiple is a settlement practice OIG sets and can revise, and it is decided case by case — so the point to hold is the direction, not a number: disclosing costs less than being investigated for the same conduct.
2. 02

   A standing presumption against integrity obligations

   When OIG resolves a fraud matter it pursued, it often requires ongoing integrity obligations — the monitoring, training, and reporting commitments of a corporate integrity agreement — as the price of not being excluded. For matters resolved through the SDP, OIG has adopted a presumption against requiring those obligations. A provider that discloses and settles generally releases its exclusion exposure without taking on years of imposed oversight.
3. 03

   The 60-day overpayment clock is suspended

   A fraud finding usually sits on top of an overpayment, and the 60-day overpayment rule would otherwise require that money back on a fixed deadline. Once OIG acknowledges receipt of a timely SDP submission, the obligation to return the related overpayment is suspended — under 42 CFR § 401.305(b)(2), until a settlement is entered or the provider withdraws or is removed from the protocol. Disclosing does not force a provider to choose between two federal deadlines; entering the SDP pauses the return clock while the matter is worked out.

None of this makes the conduct free, and none of it is automatic. The benefits are the reason the protocol exists and the reason counsel so often recommends it once a genuine fraud problem is confirmed: the resolution is more favorable, more predictable, and closes the matter, where waiting risks a government-initiated case on worse terms.

A disclosure is a written submission, not a phone call, and OIG specifies what it must contain. The provider identifies itself and the federal programs it billed, describes the conduct in enough detail to show what happened and over what period, names the specific laws it believes were potentially violated, identifies the individuals and entities involved, and estimates the damages to each program — or commits to producing that estimate within a defined, short period. The submission also describes the corrective action already taken, states whether the matter is already under any government inquiry, and certifies that the disclosure is truthful and made in good faith.

After the submission, the provider conducts and reports an internal investigation of the conduct and quantifies the damages using a methodology OIG will accept. Cooperation and good faith are conditions of staying in the protocol, not courtesies: a disclosing party that does not cooperate can be removed, which returns the matter to the ordinary enforcement track. Improper arrangements have to be ended as part of coming forward — a provider cannot disclose a kickback and keep paying it.

The reason the SDP is so often described by what it is not is that a provider facing a self-identified problem has three possible destinations, and they do not overlap. Choosing correctly is the first substantive step.

A billing team does not run a self-disclosure — that is a decision for the compliance program and counsel — but it is usually where the facts that lead to one first surface, and how it handles them shapes whether disclosure stays an option.

• Escalate the findings that are more than an error. A credit balance from a keying mistake is a refund. A pattern that looks like the practice billed for something it was not entitled to, a financial arrangement that rewards referrals, or a claim tied to an excluded person is a compliance question — route it up rather than quietly adjusting it.
• Do not close a potential-fraud finding as a routine refund. Refunding the money can look like the responsible move, but if the conduct carried potential fraud liability, a quiet refund neither resolves the penalty exposure nor earns the SDP's more favorable terms — and it can look like concealment later.
• Preserve the record. The identification date, what was found, who was involved, and what was billed are the facts a disclosure is built from and an investigator asks about first. The practice that documented its findings is the one that can show it acted in good faith.
• Let the compliance program choose the channel. Whether a matter belongs in the SDP, in CMS's Stark protocol, or in the payer's refund process turns on the nature of the conduct — a legal judgment, made with counsel, not a billing call.