Self-Disclosure: OIG, CMS, or a Simple Refund — Choosing the Door

Three doors, and the problem picks the door

Federal self-disclosure is not one process but three, and the nature of the problem — not your preference — decides which. An ordinary billing or coding overpayment with no fraud dimension is returned to the payer. Conduct that implicates a fraud statute — the anti-kickback statute, the False Claims Act — goes to the OIG's Self-Disclosure Protocol, a formal channel the agency maintains for exactly that purpose 1Ref 1HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That the OIG maintains a Self-Disclosure Protocol for providers who discover conduct implicating federal fraud laws, and what a submission must contain.. A violation that is purely a Stark self-referral technicality routes to CMS.

The sorting question: is there a colorable fraud statute in play, or only an honest overpayment? Getting the door right matters because each carries a different disclosing authority, timeline, and settlement posture.

When a simple refund is the right door

Most problems a solo practice finds in its own claims are ordinary overpayments, and ordinary overpayments go back to the payer that overpaid — your Medicare Administrative Contractor for Part B, or the commercial plan's overpayment process — not to a fraud authority. Finding your own error through a routine self-audit is the healthy case: you quantify it, refund it, and document the fix.

The reason not to sit on it is legal, not moral. Under the False Claims Act, "knowingly" reaches reckless disregard and deliberate ignorance, so a known, unreturned overpayment can convert an innocent mistake into false-claims exposure 2Ref 2U.S. Department of Justice (2026).The False Claims Act.That the FCA imposes treble damages and per-claim penalties, that 'knowingly' includes reckless disregard, and that qui tam relators can sue — so retaining a known overpayment is exposure.. The clock to return an identified overpayment is short once you have quantified it; treat the refund as time-sensitive the day the self-audit closes.

• Refund, don't disclose, when the error is a coding or documentation mistake, you can quantify the amount, and no kickback or falsified record is involved.
• After the self-audit, write down what you found, what you refunded, and the process change that prevents a repeat — that remediation record is what protects you if the same issue surfaces later.
• Escalate beyond a refund when the pattern looks intentional, involves an arrangement with a referral source, or you cannot rule out a fraud statute.

When the OIG Self-Disclosure Protocol fits

The OIG's Self-Disclosure Protocol is the door when the conduct plausibly implicates a federal fraud statute rather than a coding slip: paying or receiving anything of value tied to referrals (the anti-kickback statute), billing for services not rendered, or arrangements you cannot fit inside a safe harbor. The anti-kickback safe harbors are defined by regulation — space and equipment rental, personal services, employment, and others, each with required elements 3Ref 3Office of the Federal Register (2026).42 CFR 1001.952 — Exceptions (Anti-Kickback Safe Harbors).That the anti-kickback safe harbors are defined by regulation — rental, personal services, employment, and others — each with required elements an arrangement must meet.. If an arrangement almost fits a safe harbor but misses an element, that gap is the kind of thing the protocol exists to resolve.

When you are unsure whether an arrangement even implicates the statute, the OIG also publishes advisory opinions on specific arrangements 4Ref 4HHS Office of Inspector General (2026).Advisory Opinions.That the OIG issues advisory opinions on whether specific arrangements implicate the anti-kickback statute, and publishes them., which map the terrain before you decide to disclose. The protocol suits deliberate or systemic problems; the refund path suits honest mistakes. If a submission is warranted, the credibility of your damages estimate — and the corrective action you have already taken — shapes the resolution.

When a Stark-only problem sends you to CMS instead

Not every self-referral problem goes to the OIG. The Stark law is a strict-liability statute — no intent required — administered by CMS, and it prohibits a physician from referring designated health services to an entity with which the physician has a financial relationship unless an exception applies 5Ref 5Centers for Medicare & Medicaid Services (2026).Physician Self-Referral.That the Stark law is strict-liability, administered by CMS, and prohibits referring designated health services to an entity with which the physician has a financial relationship unless an exception applies.. When the only defect is a Stark technicality — a lease that lapsed, a compensation term not set in advance — with no kickback and no false claim behind it, that belongs in CMS's self-referral disclosure pathway, not the OIG protocol.

The distinction matters: the disclosing authority, the settlement math, and the paperwork all differ. Most solo behavioral-health practices touch Stark rarely, but it reaches any practice that refers imaging, labs, physical therapy, or other designated services in-house or to a connected entity. When a single set of facts could plausibly be read as both a Stark foul and a kickback, treat it as the more serious of the two and let counsel choose the door.

What an OIG submission actually contains

An OIG self-disclosure is a structured submission, not a phone call. The protocol asks you to identify the conduct and the laws it may violate, name the people involved, describe how you discovered it and the internal investigation you ran, and give a preliminary estimate of the damages with your methodology 1Ref 1HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That the OIG maintains a Self-Disclosure Protocol for providers who discover conduct implicating federal fraud laws, and what a submission must contain.. In practice that means the self-audit comes first: you cannot disclose a number you have not calculated.

Build the submission as a factual, sourced narrative — dates, codes, the corrective action already taken — because the credibility of your damages estimate shapes the resolution. A submission that shows a clean investigation and a completed fix reads very differently from one that gestures at a problem without quantifying it. This is the point where a practice of one that has kept its documentation in order has a real advantage over one scrambling to reconstruct what happened.

What disclosure buys you — and what it doesn't

Self-disclosure mitigates; it does not immunize. The reason it is worth doing is arithmetic: the False Claims Act carries treble damages and per-claim penalties, and it lets private relators sue on the government's behalf 2Ref 2U.S. Department of Justice (2026).The False Claims Act.That the FCA imposes treble damages and per-claim penalties, that 'knowingly' includes reckless disregard, and that qui tam relators can sue — so retaining a known overpayment is exposure.. The FCA and the solo practice are not strangers — a single knowingly false claim is enough to trigger it. A credible, prompt disclosure typically reduces the multiplier and signals good faith, but it does not erase liability or guarantee a specific number.

It also does not stop a relator who files first: qui tam suits reward whoever reports before you do, which is a live reason not to wait once you know. And it does not remove exclusion risk — the OIG can bar an individual or entity from federal programs, after which no federal payment may be made for their services 6Ref 6HHS Office of Inspector General (2026).Exclusions Program.That the OIG can exclude individuals or entities from federal health programs, after which no federal program payment may be made for their services.. Weigh those stakes with counsel before choosing to disclose rather than refund.

Before you disclose: the self-audit and the counsel trigger

Before any disclosure decision, run the self-audit and stand up the minimum compliance response the OIG expects even from a practice of one. The OIG's General Compliance Program Guidance scales the seven elements of an effective program — including a defined path for responding to and correcting detected problems — to small practices 7Ref 7HHS Office of Inspector General (2023).General Compliance Program Guidance.That the OIG's General Compliance Program Guidance scales the seven elements of an effective compliance program — including responding to and correcting detected problems — to small practices.. That response element is exactly the muscle a disclosure decision uses.

Bring in counsel when any of these is true:

• The conduct may implicate the anti-kickback statute or the False Claims Act, not just a coding error.
• The dollar exposure is material or spans multiple years.
• A referral relationship, an ownership interest, or an arrangement with another entity is involved.
• You cannot confidently rule out intent, or a whistleblower or payer audit may already be in motion.

For an ordinary overpayment you found and can quantify, a documented refund is usually the whole job. For anything touching a fraud statute, the choice of door is a legal judgment — make it with someone who does this for a living. The telehealth enforcement history of recent years shows how fast a billing shortcut becomes a fraud case, which is the argument for moving early rather than hoping.