FEATURED ARTICLES

HHS-OIG Releases Updated Health Care Fraud Self-Disclosure Protocol, Directing Criminal Disclosures to DOJ

On October 15, 2026, the HHS Office of Inspector General (OIG) released an updated Health Care Fraud Self-Disclosure Protocol (SDP), its first revision since November 8, 2021. While OIG describes the 2026 update as providing “additional clarifying changes,” noteworthy changes include classifying federal crimes as conduct that is no longer eligible for the SDP, which now should be disclosed to the Department of Justice (DOJ).

As background, OIG established the SDP in 1998 for providers to voluntarily identify, disclose, and resolve instances of potential fraud involving the Federal health care programs. The SDP provided guidance on how to investigate this conduct, quantify damages, and report the conduct to OIG to resolve liability under OIG’s civil monetary penalty (CMP) authorities. Between 1998 and 2025, OIG claims to have resolved disclosures that resulted in recoveries of more than $1.2 billion to the Federal health care programs.

A provider that uses the SDP must submit a report through OIG’s website, and the disclosing provider is expected to investigate conduct internally, identify the specific laws potentially violated, estimate the damages affecting Federal health care programs, and identify its corrective action. According to OIG, parties that follow the SDP benefit from the process by receiving a presumption against being required to engage in integrity agreements and may realize lower potential damages.

While this latest version of the SDP is not an overhaul, there are some key differences affecting healthcare providers when compared to the earlier 2021 version. These include:

The 2026 SDP does not change the minimum settlement amounts set in 2021. These remain $100,000 for kickback-related submissions and $20,000 for all other matters. The 90-day deadline to complete the internal investigation and damages estimate, measured from the date of the initial submission, also stays the same. 

The updated OIG Health Care Fraud Self-Disclosure Protocol is available here. 

Reporter, Michael L. LaBattaglia, Washington, D.C., +1 202 626 5579, mlabattaglia@kslaw.com

HHS Delegates Exclusion Authority to CMS

On October 14, 2026, HHS published a Federal Register notice formally delegating to the CMS Administrator its permissive exclusion authority, which allows the exclusion of individuals and entities, including healthcare providers, from participation in federal healthcare programs such as Medicare and Medicaid. The delegation is effective immediately. The notice does not change the criteria for exclusion but may lead to increased use of this enforcement tool.

HHS Secretary Kennedy first announced his intent to delegate this authority at a July 21, 2026 press conference. Until now, the authority resided exclusively with the HHS Office of Inspector General (OIG). CMS requested the delegation, and HHS’s notice explains that CMS is well positioned to develop the evidentiary basis for exclusion determinations because it directly administers Medicare and Medicaid. The notice further states that consolidating investigative and enforcement functions within a single operating division will reduce redundancy.

Scope of Delegation

The delegation is limited to permissive exclusion authority under Section 1128(b) of the Social Security Act; mandatory exclusion authority under Section 1128(a) is not included. Grounds for permissive exclusion include lesser criminal convictions, typically misdemeanors, related to healthcare fraud or controlled substances. Permissive exclusion may also result from license revocations or suspensions, substantially excessive charges or medically unnecessary services, kickbacks and other prohibited conduct, false statements on enrollment applications, and ownership or control by excluded individuals.

OIG’s existing delegation is unaffected, and OIG retains sole authority over mandatory exclusions arising from program-related criminal convictions and certain other felonies. The delegation does not extend to conducting hearings or promulgating regulations.

Practical Implications for Providers

CMS must exercise the delegated authority consistent with HHS’s existing policies, procedures, guidelines, and regulations. As a practical matter, the delegation should not expand the types of cases subject to exclusion risk. It may, however, increase the frequency with which permissive exclusion authority is used.

At present, CMS has not provided details about which component of the agency will exercise the delegated authority or which categories of cases it will prioritize. CMS lacks a dedicated criminal investigative function and typically relies on the HHS Office of General Counsel for legal support. It also remains unclear how the delegation will affect the resolution of investigations or litigation involving allegations of fraud. Historically, providers negotiated for HHS OIG to release its permissive exclusion authority as part of a settlement. The new delegation may require CMS to participate in those negotiations, potentially delaying or complicating settlement discussions.

This announcement is the latest effort by the current administration to more efficiently investigate and prosecute suspected fraud. Although the full scope of CMS's role remains to be seen, the delegation marks a meaningful shift in the federal program-integrity landscape that warrants close attention in any pending or future government inquiry.

Reporter, Alana Broe, Atlanta, +1 404 572 2720, abroe@kslaw.com

DOJ Announces $315 Million Settlement Agreement with CVS Related to Filling Unlawful Opioid Prescriptions and Associated False Claims

On October 13, 2026, the Department of Justice (DOJ) announced that CVS Pharmacy Inc. and related corporate entities (CVS) entered into two settlement agreements concerning allegations that from October 17, 2013, through December 2, 2025, CVS filled illegal prescriptions for opioids and other controlled substances and sought payment for those invalid prescriptions from Medicare and other government healthcare programs. The allegations related to filling prescriptions were resolved civilly under the Controlled Substances Act (CSA), while the allegations concerning payments from Medicare and other payors were resolved civilly in a separate agreement under the False Claims Act (FCA).

The settlements resolve allegations initially raised by a relator, a former CVS employee, in a 2019 qui tam suit filed in the Middle District of Tennessee, which were subsequently transferred to the District of Rhode Island. United States ex rel. Hillary Estright v. CVS Health Corporation, et al., No. 22-cv-00222 (D.R.I.). The government filed an intervening complaint on December 13, 2024, alleging claims under the CSA and FCA.

With respect to the CSA allegations, the government alleged CVS knowingly dispensed controlled substances for prescriptions that were not valid, were not for a medically accepted indication, were not medically necessary, were not issued for a legitimate medical purpose and/or in the usual course of professional practice, presented red flags that were not resolved or documented, and/or were in violation of the restrictions on refills. Under the CSA settlement agreement, CVS, while denying the allegations, agreed to pay $126 million and to prospective restrictions until August 15, 2032, including implementation of a Controlled Substance Dispensing Oversight Program and related policies and procedures, annual compliance certifications to the DEA to be performed by a Chief Pharmacy Controlled Substances Officer, regular aggregated reporting of volumes of controlled substances dispensed at national and state levels, a Prescriber Review Process employing data analysis to identify potential prescribers of concern, reporting of provider information blocked under CVS’s Provider Review Process, implementation of a Prescription Validation Process designed to identify and resolve any red flags identified, and regular compliance review site visits of retail pharmacies, among other restrictions.

With respect to the FCA allegations, the government alleged CVS knowingly submitted claims for the same prescriptions described in the CSA settlement. While denying the allegations, CVS agreed to pay $189 million to resolve the allegations.

The DOJ Press Release is available here. The Settlement Agreements are available here (CSA) and here (FCA). 

Reporter, Hamilton Craig, Washington, D.C., +1 202 626 8976, hcraig@kslaw.com

UPCOMING EVENTS

Life in the Government’s Crosshairs: A Survival Guide for Providers in a New Era of Medicare Advantage Enforcement

Thursday, October 29, 1:00 P.M. – 2:00 PM ET

Join us for a roundtable webinar examining critical developments for providers who contract with and submit claims to Medicare Advantage plans, including the evolving enforcement landscape, the growing role of AI in compliance and government oversight, intensified scrutiny of risk adjustment diagnosis coding and its implications for providers, key considerations for MA contract negotiations, and important factors for providers entering marketing arrangements with MA plans. We will also outline practical steps providers can take to minimize risk in this rapidly shifting environment. For questions, contact Ella Peek.

Editors: Chris Kenny and Ahsin Azim

Issue Editors: Lindsay Greenblatt and Brittany Tandy