What does the FCA self-disclosure pilot mean for coding overpayments?

Written by Amanda McGurk · Published 9 November 2026 · Last reviewed 9 November 2026

The DOJ and HHS False Claims Act Self-Disclosure Pilot lets healthcare companies disclose potential FCA violations unknown to the government, through April 22, 2027. Companies repay 1.25 to 1.6 times a base amount and avoid a Corporate Integrity Agreement. Ordinary coding overpayments still follow the 60-day rule.

Sources: the DOJ Civil Division announcement of October 22, 2026 , the pilot protocol , the HHS announcement , and 42 CFR 401.305 .

This is operational guidance for coding and compliance teams, not legal advice. Disclosure decisions belong with counsel.

What is the FCA self-disclosure pilot?

The Healthcare False Claims Act Self-Disclosure Pilot Program (FCA SDPP) is a six-month program from the Justice Department's Civil Division and HHS. According to the DOJ announcement , it gives healthcare companies a way to resolve potential civil FCA violations through one coordinated civil release covering the FCA and certain HHS administrative authorities.

The pilot protocol names those authorities: Medicare enrollment revocation under 42 C.F.R. 424.535 and permissive exclusion under 42 C.F.R. 1001.901 and 1001.951.

The pilot covers civil conduct only. A company disclosing potential criminal conduct must go to the Justice Department's National Fraud Enforcement Division. On October 15, 2026, HHS-OIG and the Fraud Division announced that a criminal disclosure to the Fraud Division alone earns the benefit of both the Department's Corporate Enforcement Policy and the OIG Self-Disclosure Protocol.

Why does a coding audit finding become a disclosure decision?

Picture a health system compliance director reading a quarterly E/M audit. The sample shows a coding pattern that ran for two years and points to a Medicare overpayment. The coding manager wants to re-educate coders and refund the claims through the MAC. Counsel wants to know who knew about the pattern, and when.

A refund through the Medicare contractor resolves an overpayment. A disclosure resolves potential liability. The pilot adds a third route with a fixed repayment range and a firm deadline. Your audit file decides which route fits, because it has to prove when you identified the problem, how far it spread and how you calculated the amount.

An RCM company coding for hospital or physician group clients gets the same questions from those clients. Our guide to FY2025 CERT coding errors shows where Medicare reviewers find coding problems most often.

What does the pilot require and offer?

The protocol lists the required elements. A submission must:

• Describe the conduct that potentially violates the FCA, including the specific laws or requirements and the time period.
• Attach exhibits that show how the conduct worked.
• Specify the remedial measures taken to stop it and prevent a repeat.
• Provide financial information the DOJ Civil Division needs to calculate the Base Self-Disclosure Repayment.
• Include a certification from an authorized representative that the submission is truthful and complete.
• Name a point of contact with a phone number and email address.

In return, the company receives a DOJ release under the FCA for the disclosed conduct, with no factual admissions. The HHS announcement adds that OIG will not impose an exclusion or require a Corporate Integrity Agreement, CMS will not revoke enrollment and billing privileges, and neither CMS nor OIG will impose civil monetary penalties. Per the protocol, the company need not disclose the same conduct again to the OIG Self-Disclosure Protocol or the CMS Self-Referral Disclosure Protocol.

The repayment equals 1.25 to 1.6 times the Base Self-Disclosure Repayment. DOJ moves the multiplier on timeliness, the duration and scope of the misconduct, senior leadership involvement, the financial benefit to the company, and whether a successor company inherited the conduct and moved fast to remediate.

The protocol's first worked example is a billing case. A hospital that missed Medicare's 14-day rule runs a sample chart review, extrapolates an error rate across the claim population, and hands the government its results plus its sampling and extrapolation methods. Your coding audit team produces that kind of evidence today. The pilot asks you to document it well enough for DOJ to check.

Is a coding overpayment the same as a potential FCA violation?

No. An overpayment is money Medicare paid that the provider was not entitled to keep. A potential FCA violation turns on knowingly submitting a false claim, or knowingly keeping an identified overpayment past the deadline. Under 42 CFR 401.305 , a person has identified an overpayment when the person knowingly receives or retains it, and the regulation borrows the meaning of "knowingly" from the False Claims Act at 31 U.S.C. 3729(b)(1)(A).

The regulation requires a person to report and return an overpayment by the later of 60 days after identification or the date any corresponding cost report is due. Any overpayment retained after that deadline is an obligation for purposes of 31 U.S.C. 3729. A routine coding error refunded on time stays an overpayment. One kept past the deadline can become FCA exposure.

The pilot sits on the liability side. DOJ built it for conduct a company believes may violate the FCA, and only when the government does not know about it. If the government was aware, the protocol says the company may receive cooperation credit under Justice Manual Section 4-4.112 but is not eligible for a pilot resolution.

Does the pilot pause the 60-day clock?

The regulation does not say so. Section 401.305(b)(2) suspends the return deadline when OIG acknowledges a Self-Disclosure Protocol submission, when CMS acknowledges a Self-Referral Disclosure Protocol submission, or when a person requests an extended repayment schedule. The FCA pilot is not on that list, and the pilot protocol does not address the 60-day rule. Ask counsel how a pilot submission interacts with your deadline before you rely on it.

How should compliance and HIM teams prepare a disclosure-ready audit?

Start from what 401.305 requires. If you calculate an overpayment with statistical sampling, the regulation says your report must describe the sampling and extrapolation methodology. A good-faith investigation into related overpayments suspends the deadline until the investigation ends, but no longer than 180 days after the first overpayment was identified. The lookback period is 6 years from the date the overpayment was received.

1. Date the identification. Record when the first overpayment was identified and who identified it. The 60-day and 180-day periods in 401.305 run from that date.
2. Scope the related claims. Define the claims that share the same cause, such as one CPT family or one provider, and record why you drew the line there.
3. Fix the sampling method before you pull charts. Write down the frame, sample size and extrapolation approach. Our post on medical coding audit sample size covers the trade-offs.
4. Keep the code-level evidence. For each sampled claim, store the billed code, the supported code, the documentation passage that decided it and the guideline applied. Report overcoding and undercoding separately, since both change the amount.
5. Record the remediation. Capture coder education, edit changes and provider documentation fixes with dates. The protocol asks for remedial measures, and DOJ weighs timeliness.
6. Bring counsel in early. Counsel picks the route: a contractor refund, an OIG or CMS protocol, the FCA pilot or a criminal disclosure.

For the billing-side view of intent, see is downcoding fraud in medical billing?

Where does MediCodio AI fit in disclosure readiness?

MediCodio AI applies AI medical coding to the coding work your audit has to explain later, and it keeps the evidence attached to each code. MediCodio AI keeps a 100% code-level audit trail. Every code ships with its documentation passage and the compliance rule behind it, so your team has the step 4 evidence before anyone pulls a sample.

Nothing runs autonomous on day one. Everything starts in review, and the autonomous lane widens one specialty or case type at a time as your auditors confirm first-pass accuracy on your charts. Complete charts flow through AutoPilot for fully autonomous coding. Charts where the documentation is thin or contradictory stay in CoPilot, where certified coders review and finalize the output.

MediCodio AI reports 98%+ coding accuracy as first-pass accuracy across deployments since 2023, measured at the code level on production charts before any correction, against a reference review by AAPC- and AHIMA-credentialed coders applying official guidelines and payer policy to the same documentation. Your compliance team and counsel decide whether a finding is an overpayment or a disclosure matter. Learn more about our medical coding audit services , how the code-level audit trail works, and how we support hospitals and health systems and RCM companies .

What has not changed?

The 60-day rule applies to each Medicare overpayment you identify, whether or not you use the pilot. The OIG Self-Disclosure Protocol and the CMS Self-Referral Disclosure Protocol remain available, and criminal matters go to the DOJ Fraud Division. The documentation standard has not moved either, since the code billed still has to match what the record supports. The pilot window closes at 11:59 PM on April 22, 2027.

Frequently asked questions

Who can use the FCA self-disclosure pilot?

Healthcare providers, suppliers, manufacturers, payors and related entities that bill or are paid by HHS federal health care programs can use it. The disclosed conduct must be a potential civil FCA violation the federal government did not know about before the submission. Criminal conduct goes to the DOJ National Fraud Enforcement Division instead.

What does a company repay under the pilot?

The repayment equals 1.25 to 1.6 times the Base Self-Disclosure Repayment that the DOJ Civil Division calculates. The multiplier depends on timeliness, the duration and scope of the conduct, senior leadership involvement, financial benefit, and whether a successor company inherited the conduct and moved fast to remediate. Disclosing companies make no factual admissions.

Should every coding overpayment go through the pilot?

No. A coding error billed without knowledge of the error is an overpayment. Once identified, 42 CFR 401.305 generally requires you to report and return it within 60 days, and keeping it past the deadline is an FCA obligation. The pilot is for conduct a company believes may violate the FCA. Counsel decides the route for each finding.

Can we extrapolate an audit error rate for a disclosure?

Yes, if you document the method. The pilot protocol's first example has a hospital extrapolate a sample chart review error rate and produce its sampling and extrapolation methods. Under 401.305, an overpayment report based on statistical sampling must describe the methodology. Set the frame and sample size before pulling charts.

What is the deadline to submit under the pilot?

Submissions must reach FCA-SDPP@usdoj.gov by 11:59 PM on April 22, 2027. DOJ and HHS describe the program as a six-month pilot, and late or partial submissions will not be accepted or reviewed. Build in time for chart review, sampling, remediation records and counsel review before that date.

Book a Demo to run an accuracy review on your own charts and see the documentation passage and rule behind every code. Keep overpayment, sampling and disclosure decisions with your compliance team and counsel.

Sources

• U.S. Department of Justice: Justice Department's Civil Division and HHS Announce Anti-Fraud Healthcare Self-Disclosure Pilot Program, October 22, 2026 .
• DOJ and HHS: Healthcare Self-Disclosure Pilot Program protocol .
• HHS: HHS and the Justice Department's Civil Division Announce Anti-Fraud Healthcare Self-Disclosure Pilot Program, October 22, 2026 .
• HHS-OIG: National Fraud Enforcement Division and HHS Announce Self-Disclosure Protocol for Criminal Health Care Fraud, October 15, 2026 .
• eCFR: 42 CFR 401.305, Requirements for reporting and returning of overpayments .