The Self-Disclosure Protocol: What to Do After You Find a Violation
You are reviewing billing records and find a compliance error: miscoded payments, an arrangement that crossed a line under Stark Law or the Anti-Kickback Statute, HIPAA protocols nobody followed.
Saying nothing or quietly fixing it feels protective. It is often the most dangerous path. The Self-Disclosure Protocol lets you come forward and resolve the matter before investigators arrive.
The Self-Disclosure Protocol (SDP) is a formal process established by the Office of Inspector General (OIG) of the U.S. Department of Health and Human Services that lets providers voluntarily report potential fraud, billing errors, or compliance violations, often for reduced penalties.
Why Does Discovering a Violation Put You at a Legal Crossroads?
The False Claims Act, the Anti-Kickback Statute, Stark Law, and HIPAA each carry civil and sometimes criminal penalties, and many require no intent.
- Doing nothing compounds the risk daily
- Quietly correcting may still constitute concealment
- Self-disclosing gives you control over timing and terms
Understand what the False Claims Act means for your practice first.
What Are the Two Main Self-Disclosure Pathways?
Is This an OIG Self-Disclosure?
The OIG Self-Disclosure Protocol covers potential violations of federal law involving Medicare, Medicaid, or other federal programs. It fits when:
- The conduct involved potential fraud, not just billing error
- The violation could result in exclusion
- The arrangement potentially violated the Anti-Kickback Statute
Is This a CMS Self-Referral Disclosure?
The CMS Self-Referral Disclosure Protocol (SRDP) covers Stark Law violations: a physician referred Medicare patients to an entity holding a financial relationship that met no exception. The wrong pathway complicates resolution, so let a healthcare compliance attorney choose.
What Triggers the Need for Self-Disclosure?
When Is Self-Disclosure Legally Required?
If you have identified an overpayment from Medicare or Medicaid, you are legally required to report and return that overpayment within 60 days of identifying it. Failure to do so can itself constitute a False Claims Act violation.
What Situations Commonly Lead Providers to Self-Disclose?
| Violation Type | Relevant Statute | Disclosure Path |
|---|---|---|
| Improper physician referral arrangements | Stark Law | CMS SRDP |
| Kickbacks with vendors or referral sources | Anti-Kickback Statute | OIG SDP |
| Billing for services not rendered or upcoding | False Claims Act | OIG SDP |
| Medicare/Medicaid overpayments | ACA 60-Day Rule | OIG SDP or direct repayment |
| Employment of excluded individuals | OIG Exclusion Statute | OIG SDP |
| Improper MSO arrangements or fee-splitting | Anti-Kickback Statute / State Law | OIG SDP / State agency |
Review Management Services Organization fee arrangements regularly.
What Are the Step-by-Step Requirements of the Self-Disclosure Process?
Step 1: Conduct an Internal Investigation
A privileged internal investigation should identify:
- The nature and scope of the potential violation
- The time period involved
- Which claims or arrangements were affected
- Whether the conduct has stopped
- Who was involved
Without privilege, your findings could be discoverable. Involve a healthcare investigations attorney early.
Step 2: Quantify the Overpayment or Damage Amount
Both agencies require a calculation: each affected claim, the improper payment, interest where applicable, and valid sampling for large volumes.
Step 3: Prepare and Submit the Disclosure
An OIG submission must contain:
- A complete description of the violation
- The period covered
- The federal programs affected
- The estimated damages
- Corrective action already taken
- Information on all individuals involved
CMS SRDP submissions also require the financial relationship, the referrals, and the compensation terms.
Step 4: Implement Corrective Action Before You Submit
Acting first signals good faith: end the arrangement, restructure compensation, add billing controls, train staff, and strengthen your compliance program.
Step 5: Negotiate the Settlement
The OIG has historically resolved self-disclosures at 1.5 times the single damages amount rather than the treble damages available under the False Claims Act, a significant reduction for cooperative disclosing entities.
What Are the Benefits of Voluntary Self-Disclosure?
Reduced Financial Penalties
Under the False Claims Act, violations can result in civil penalties of more than $27,000 per false claim, plus treble damages. Providers who disclose and cooperate often resolve the same conduct for far less.
Reduced Risk of Exclusion
Voluntary disclosure plus corrective action substantially reduces the likelihood of exclusion from Medicare and Medicaid.
Avoiding Criminal Referrals
Cooperation reduces, though does not eliminate, criminal referral risk. The government’s stated priority is compliance and repayment.
Control Over Narrative and Timing
You decide when the conversation starts and how the facts are framed. If the government finds it first, you lose that.
What Mistakes Do Providers Most Often Make After Discovering a Violation?
Waiting Too Long to Act
The 60-day clock runs from the date an overpayment is identified. Time lost to internal debate weakens any good-faith claim.
Attempting to Handle It Without Legal Counsel
Disclosure requires statutory analysis, defensible calculations, scope decisions, and negotiation. Going it alone often forfeits the benefits.
Disclosing Too Much or Too Little
Too broad invites scrutiny of unrelated conduct. Too narrow lets the government find what you omitted. A healthcare fraud defense attorney calibrates scope.
Failing to Stop the Conduct Immediately
A disclosure covering ongoing conduct is compromised.
Communicating Internally Without Privilege Protection
Emails and meeting notes created outside privilege can be discoverable. Involve counsel first.
How Does Self-Disclosure Interact With an Existing Government Investigation?
The OIG protocol closes once you are under investigation for the conduct disclosed. After a subpoena, a Civil Investigative Demand, or contact from the Department of Justice or HHS OIG, the focus shifts to defense with a healthcare defense attorney.
What Role Does Your Compliance Program Play in Self-Disclosure?
A documented program surfaces problems early and shows the violation was an aberration, not a pattern. If you have none, the OIG Compliance Guidance is a starting framework to tailor with counsel.
How Does Self-Disclosure Apply Specifically in Texas?
Texas Medicaid matters may also require disclosure to the Texas Office of Inspector General, and the Texas Medical Board may act where a license is affected. Use a Texas healthcare attorney who handles both tracks as federal enforcement intensifies.
What Happens After a Self-Disclosure Is Resolved?
Will a Corporate Integrity Agreement Be Required?
For more significant violations, the OIG may require a Corporate Integrity Agreement (CIA):
- Independent review organization audits
- Annual compliance certifications
- Mandatory employee training
- Reporting of future issues
CIAs typically run for five years, so negotiating their scope matters.
What Ongoing Monitoring Is Expected?
Enhanced internal monitoring is wise, because the government treats repeat violations seriously.
Should You Expect Continued Government Scrutiny?
Resolution does not make you invisible to audits, and sometimes prompts closer review of related areas.
How Does Self-Disclosure Affect Medical Spa and Specialty Practice Owners?
For med spas, risk centers on supervision, scope of practice, and corporate practice of medicine rules, and grows once the practice accepts insurance. Telemedicine adds prescribing and licensure risk. Owners of any medical spa in Texas or a telemedicine practice should review compliance routinely.
Frequently Asked Questions About the Self-Disclosure Protocol
What is the difference between the OIG Self-Disclosure Protocol and the CMS Self-Referral Disclosure Protocol?
The OIG protocol covers fraud and abuse broadly, including Anti-Kickback Statute and False Claims Act issues. The CMS protocol handles Stark Law self-referral violations.
Am I required to self-disclose if I find a billing error?
If the error produced a Medicare or Medicaid overpayment, you must report and return it within 60 days. Errors creating no government overpayment may be handled internally.
Can self-disclosure make things worse for my practice?
Handled correctly, disclosure beats waiting for the government. Penalties, exclusion risk, and criminal exposure run higher for government-detected violations.
How long does the self-disclosure process take to resolve?
Simple overpayment matters resolve in months. Complex fraud or Stark matters can take a year or longer.
Does self-disclosure protect me from a qui tam lawsuit?
It does not stop a whistleblower from filing, but it limits the government’s ability to intervene in a case covering the same conduct.
What happens if I miss the 60-day repayment deadline?
Failure to report and repay an identified overpayment within 60 days can itself constitute a False Claims Act violation. Call counsel immediately.
Can a non-physician healthcare business owner use the self-disclosure process?
Yes. The protocols are open to any entity in federal healthcare programs, including management services organizations.
What is a Corporate Integrity Agreement and how do I avoid one?
A CIA is a monitoring arrangement imposed in settlement, requiring auditing and reporting for a period of typically five years. A strong program and real corrective action improve your odds.
Should I tell my staff about the self-disclosure?
Broad internal disclosure before privilege exists creates evidentiary risk. Decision-makers need to know; counsel should shape the scope.
How does self-disclosure affect my medical license?
Licensing authorities may learn of a disclosure through settlements or exclusion actions. Coordinate with a licensing defense strategy.
Your Next Step After Discovering a Violation
Only providers who use the protocol correctly and promptly get its full benefit. When a physician arrangement is involved, start with the fundamental concepts behind Stark Law and the Anti-Kickback Statute.
At Dike Law Group, healthcare law is all we do. Contact Dike Law Group for a confidential consultation at 6160 Warren Parkway, Ste. #100, Frisco, TX 75034, or call (972) 290-1031. Find us on Google Maps.
Additional Resources
- Fundamental Concepts of Stark Law and Anti-Kickback Statute
- False Claims Act in Healthcare
- Dallas Healthcare Compliance Attorney
- Texas Healthcare Investigations Lawyer
- OIG Self-Disclosure Guidance
Disclaimer: This article is intended for general educational purposes only and does not constitute legal advice. The Self-Disclosure Protocol involves complex legal determinations that vary based on individual facts and circumstances. For guidance specific to your situation, please consult a qualified healthcare compliance attorney.