OIG updated its Health Care Fraud Self-Disclosure Protocol on October 15, 2026, starting the 90-day investigation clock at initial submission
Published November 8, 2026 · Coverage November 1–7, 2026, Pacific · Medium priority
OIG's updated Health Care Fraud Self-Disclosure Protocol (SDP), issued October 15, 2026, makes what OIG calls additional clarifying changes. One change moves the deadline for submitting the completed internal investigation and damages calculation from 90 days after acceptance into the SDP to 90 days after the initial submission; a disclosing party that cannot finish its investigation before sending its submission must certify in that initial submission that it will finish within 90 days of the date of the initial submission. The updated protocol states a general minimum multiplier of 1.5 times single damages and minimum settlements of $100,000 for kickback-related matters and $20,000 for other matters. Earlier editions did not report this update. OIG also listed an updated self-disclosure FAQ on November 2, 2026. The self-disclosure page now carries a question on where to disclose given the new self-disclosure options in 2026, and says conduct that implicates the False Claims Act (FCA), OIG administrative authorities and CMS administrative authorities should be disclosed to the FCA Self-Disclosure Pilot Program. The page does not mark which FAQ text changed on November 2.
Background
OIG first published the protocol in 1998, as the Provider Self-Disclosure Protocol, to establish a process for persons to voluntarily identify, disclose and resolve instances of potential fraud involving the Federal health care programs. OIG updated it in its entirety in 2013 and, on November 8, 2021, amended and renamed it to increase the minimum settlement amounts and make other clarifying changes.
Who this affects
Hospitals and other providers considering or making disclosures to OIG under the SDP.
Why it matters
Inference: the internal investigation and damages work for an SDP submission now has to be essentially complete within 90 days of filing, so disclosure timing decisions and the 60-day overpayment clock interplay need to be planned before filing.
Required actions
- For an SDP submission made before the internal investigation is complete: certify in the initial submission that the investigation will be completed within 90 days of the date of that submission, and report the findings of the completed investigation and the damages calculation within those 90 days (per the updated protocol).
Recommended action
- Update internal disclosure procedures and templates to the October 15, 2026 protocol.
- Re-check any pending or planned SDP disclosures against the new 90-day clock.
Scope and timing
- Authority status
- Guidance
- Responsible owner
- Compliance; Legal
- Other dates
- Protocol issued 2026-10-15, as the protocol states; OIG's What's New page lists the updated protocol under 2026-10-16
Not established
No redline of the prior (2021) protocol was retained, so changes other than the 90-day clock (which the protocol itself states) are not established. The $20,000 minimum for other matters appears in the protocol text but is not newly set by this update as far as the retained text shows.
Sources
Complete edition and supplemental material
This article in the complete report →
Executive triage, source-coverage limitations, context and forward horizons remain in the complete report.
Read the entire Compliance Sweep report →