Health care organizations don’t have immunity from False Claims Act (FCA) lawsuits when they voluntarily disclose a violation to the government, despite what some may think. Only a release from the Department of Justice (DOJ) shields them completely from whistleblowers.

“There is a fundamental misunderstanding about the self-disclosure rules,” said former federal prosecutor Lisa Noller at the Healthcare Enforcement Compliance Conference in Washington, D.C. on Nov. 5. Although there’s a public-disclosure defense from whistleblower allegations, which means they can’t spring from an HHS Office of Inspector General audit, for example, the public-disclosure bar doesn’t extend to self-disclosures, said Noller, an attorney with Foley & Lardner LLP in Chicago. That’s true even though self-disclosures are available through the Freedom of Information Act. “The only way to get a release from the False Claims Act is from the U.S. attorney by actively asking for it and negotiating it and paying for it.”

The absence of a release won’t necessarily be a problem. OIG Senior Counsel Kenneth Kraft, who also spoke at the conference, said he is “not aware of any case where a U.S. attorney’s office acted on a [whistleblower lawsuit] after OIG resolved the conduct in the Self-Disclosure Protocol.”

Self-disclosures are a challenging area, with providers often unclear whether to repay the Medicare administrative contractor (MAC) or disclose a possible or actual violation to the HHS Office of Inspector General, CMS or U.S. attorney’s office. They also may make mistakes in their submissions that come back to bite them.

There isn’t always a legal obligation to disclose. “Not every issue is disclosable. If a client makes a mistake, it’s not necessarily a disclosable event,” Noller said. “There is confusion in the marketplace about what is required to be disclosed.” She said the protocols—the OIG Self-Disclosure Protocol (SDP) and the CMS Self-Referral Disclosure Protocol (SRDP)—set forth what must be disclosed. “If something is not covered by the protocol, there is no obligation to disclose it.”