OIG Self-Disclosure Protocol: When to Use It, When to Hold Back

The OIG Self-Disclosure Protocol (SDP) is the established federal pathway for healthcare entities to voluntarily disclose conduct that may violate the Anti-Kickback Statute, False Claims Act, or Civil Monetary Penalties Law. The Provider Self-Disclosure Protocol was originally created in 1998, substantially updated April 17, 2013, and amended November 8, 2021. It is published at https://oig.hhs.gov/compliance/self-disclosure-info/protocol.asp. It is a powerful resolution tool when used correctly, and the wrong tool for several common scenarios. Counsel decides; the practice never files alone.

What the OIG SDP is — and what it is not

The SDP is a structured process by which a healthcare entity discloses identified misconduct to OIG, quantifies the damages, and negotiates a resolution. The November 8, 2021 amendment increased the minimum settlement amounts and refreshed several procedural provisions. Key features:

• Eligibility. Anti-Kickback Statute (AKS) violations under 42 USC § 1320a-7b(b), False Claims Act exposure traceable to AKS violations under 42 USC § 1320a-7b(g), Civil Monetary Penalty matters under 42 USC § 1320a-7a, and conduct that may be the basis for OIG exclusion.
• Exclusions. Pure Stark Law (Physician Self-Referral) matters go to the CMS Self-Referral Disclosure Protocol (SRDP), not OIG SDP. Matters that are nothing more than simple overpayments without AKS, CMP, or fraud overlay go through normal MAC or commercial-payer overpayment channels.
• Resolution multiplier. OIG typically settles SDP matters at 1.5x single damages, versus the statutory authority for up to 3x damages plus per-claim penalties under 42 USC § 1320a-7a and the False Claims Act multipliers.
• Suspension of the 60-day clock. Once OIG acknowledges receipt of the SDP submission, the 60-day report-and-return obligation is suspended under 42 CFR § 401.305(b)(2)(i) while the matter is pending. This is one of the SDP's most material practical benefits.
• CIA presumption. OIG generally agrees not to require a Corporate Integrity Agreement for SDP-accepted matters. The presumption is rebuttable, but the default is meaningful.
• Minimum settlement amounts. $100,000 for kickback-related matters; $20,000 for non-kickback matters. Matters below the minimums are returned without acceptance.

The SDP is not amnesty. OIG retains exclusion authority. DOJ retains False Claims Act authority. State Medicaid Fraud Control Units and state Attorneys General are not bound by OIG's resolution.

AKS versus Stark — sort this first

The substantive theory dictates the protocol. Counsel must sort it before filing.

| Theory | Resolution path | Statute / Regulation | | --- | --- | --- | | Anti-Kickback Statute (intentional remuneration to induce referrals) | OIG SDP | 42 USC § 1320a-7b(b) | | Stark Law (physician self-referral, strict liability) | CMS SRDP | 42 USC § 1395nn, with SRDP authority at § 1395nn(g)(5) | | False Claims Act tainted by AKS | OIG SDP plus possible DOJ track | 42 USC § 1320a-7b(g) | | Pure overpayment (no AKS, no Stark, no fraud) | MAC or commercial payer channels | 42 CFR § 401.305 | | Civil Monetary Penalty (e.g., employment of excluded individual) | OIG SDP | 42 CFR Part 1003 |

A mixed matter — AKS plus Stark overlap on the same arrangement — goes to OIG SDP, not SRDP. A Stark-only matter (e.g., a documentation defect on an office-space lease with a referring physician, no intent issue) goes to SRDP. Filing in the wrong forum delays resolution and can foreclose the SDP's benefits.

When the SDP is the right move

The SDP is the appropriate path when most of the following are true:

• The conduct is identified, quantifiable, and traceable to specific claims
• The conduct touches AKS, FCA-via-AKS, or CMP exposure
• The damages exceed the relevant minimum ($100,000 AKS / $20,000 non-AKS)
• The practice has the documentation to support a credible single-damages calculation
• The matter is internal — no current OIG, DOJ, UPIC, or qui tam relator activity that the practice is aware of
• Counsel and leadership have aligned on a self-disclosure strategy
• The practice can commit to the SDP's required workforce-cooperation and document-production obligations
• The matter has been concluded internally — no ongoing misconduct, control remediated, individuals counseled or separated as appropriate

A clean SDP submission resolves the OIG-side exposure at the lower multiplier, tolls the report-and-return clock, generally avoids a CIA, and creates a documented good-faith record for state board, payer, and credentialing inquiries.

When the SDP is the wrong move

The SDP is rarely the right move in these scenarios:

• Matter is purely Stark. Use SRDP instead.
• Damages are below the minimum. Use the MAC or commercial-payer overpayment process. The 60-day rule still applies independent of SDP.
• DOJ already has the matter. A pending qui tam, a Civil Investigative Demand, or a subpoena materially changes the analysis. Self-disclosure to OIG after DOJ is engaged generally cannot capture the SDP benefits and may complicate DOJ resolution. Counsel coordinates the parallel track.
• UPIC, ZPIC, or I-MEDIC is already investigating the same conduct. Self-disclosure mid-investigation is sometimes strategic; more often it is poorly timed. Counsel coordinates.
• The practice cannot defend the single-damages calculation. Submitting a number OIG considers undercounted erodes credibility for the entire submission.
• The control has not been remediated. OIG requires evidence that the conduct has been corrected. A submission with ongoing misconduct will be returned or used against the practice.
• The matter is more credibly characterized as a billing error than fraud. Misclassifying an honest mistake as SDP-worthy creates an admission that can be used by other regulators, state boards, payers, and qui tam relators.

What an SDP submission contains

The 2023 protocol's submission requirements are specific:

1. Identification. Name, address, EIN, NPI(s), provider type, and the disclosing entity's relationship to the conduct.
2. Description of conduct. A complete, detailed description of the conduct disclosed, including legal theory (AKS, CMP, FCA), the individuals involved, and the time period.
3. Federal healthcare programs affected. Medicare, Medicaid, TRICARE, and any other federal payer.
4. Damages calculation. A single-damages calculation with the methodology, the underlying data, and the supporting documentation. OIG expects the disclosing entity to do this work; the calculation is the basis for the negotiated multiplier.
5. Corrective action. A description of how the conduct has been remediated — control changes, personnel actions, policy updates, training.
6. Workforce cooperation. A commitment to cooperate with OIG, including making relevant individuals available for interview.
7. Certification. Signed certification by an authorized officer that the submission is true and complete to the best of the disclosing entity's knowledge.

Submission is electronic through the OIG SDP portal referenced on the protocol page. The November 8, 2021 amendment formalized the electronic-submission process and reaffirmed the certification requirement.

What NOT to do

• Do not submit without counsel. The certification, the damages calculation, and the legal characterization are all decisions with material downstream consequences.
• Do not minimize the damages calculation. OIG will independently validate. Understating the number is a credibility hit that follows the matter through every stage.
• Do not over-include. Disclose what is identified and quantifiable. Disclosing speculative or unsupported conduct widens the surface area.
• Do not communicate with OIG informally during the SDP review. All communication runs through counsel and is documented.
• Do not stop running compliance controls during the SDP review. OIG will look at the practice's compliance posture during the SDP review window. Lapses during that window are deeply damaging.
• Do not assume tolling extends to state and DOJ obligations. The 60-day rule tolling is OIG-specific. State Medicaid agencies, state Attorneys General, DOJ, and qui tam timelines run independently.

How the SDP process unfolds

`` Day 0 Internal identification and quantification. Counsel engaged. Control remediation begun. Day 0–60 Damages calculation built. SDP submission drafted. Day 60 SDP submission filed via OIG portal. Day 60–90 OIG acknowledges receipt; on acknowledgement, the 60-day report-and-return clock is suspended. Day 90–180 OIG initial review. Case assignment. Often a request for additional information. Day 180–360 OIG verification. Disclosing entity produces supporting documentation. OIG may interview individuals. Day 360–540 Settlement negotiation. Multiplier (typically 1.5x), payment schedule, certification of remediation. Day 540+ Settlement agreement executed. Payment. SDP closure letter. Suspension of the 60-day clock lifts on closure. ``

Timelines vary materially. Simple matters with clean damages calculations resolve in 9-12 months; complex matters involving multiple providers or extended time periods routinely take 18-30 months.

Parallel-track considerations

An SDP matter rarely sits alone. Counsel must concurrently manage:

• The 60-day report-and-return rule under 42 CFR § 401.305 for any overpayment portion of the damages, with the OIG acknowledgement-based suspension under § 401.305(b)(2)(i) documented
• DOJ False Claims Act exposure under 31 USC § 3729, independent of OIG resolution, with consideration of whether voluntary disclosure to DOJ is also appropriate
• State Medicaid Fraud Control Unit interest on Medicaid claims, listed by state on the OIG MFCU page
• State medical or pharmacy board self-reporting obligations triggered by the underlying conduct
• NPDB reporting if any individual is the subject of an adverse action arising from the conduct
• Payer notification obligations under commercial-payer contracts, which often require notice of investigations
• D&O and E&O insurance notice under applicable policy provisions

The SDP resolution is one piece of a larger compliance and risk picture. Counsel maps each parallel exposure at submission, not after.

State-law overlay

State Medicaid Fraud Control Units operate under 42 USC § 1396b(q) authority and are not bound by OIG SDP. The OIG SDP is a federal program; state false-claims or anti-kickback authorities pursue separate state-side resolutions. State Attorneys General have independent qui tam and false claims authority under state false claims acts modeled on the federal statute. Some states (California, New York, Texas) have particularly active MFCUs and AG enforcement. Counsel should evaluate whether a parallel state self-disclosure is appropriate; some states have their own disclosure protocols, others handle voluntary disclosure case-by-case.

State medical and pharmacy board self-reporting may be triggered by the underlying conduct or by the SDP submission itself; many state boards require self-reporting of federal civil monetary penalties or settlements within 30-60 days of resolution.

Restraint about outcomes

No protocol guarantees a result. The SDP improves the posture materially when used in the right matter, at the right time, with counsel-led preparation and a defensible damages calculation. It does not foreclose state enforcement, DOJ action, qui tam exposure, exclusion in serious matters, or payer recoupment. Practices considering self-disclosure work the decision through counsel, not through internal compliance committees alone.

This guide is not legal advice. The decision to self-disclose to OIG is a strategic legal decision; consult outside healthcare counsel before initiating a submission.

How d3rx fits

The d3rx compliance binder assembles the source-grounded administrative documentation a self-disclosure submission is built from — coding policy, internal audit log, training records, exclusion screening evidence, BAA inventory, financial relationships log. The d3rx audit defense workflow supports the parallel-investigation handling that often runs alongside an SDP matter. d3rx does not represent the practice in any OIG, DOJ, CMS, or state proceeding, does not provide legal advice, and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.