OIG Self-Disclosure Protocol: Billing Overpayments

When a clinical research billing overpayment is purely administrative — a coordinator mis-coded a visit, a coverage analysis was applied incorrectly, a claim was submitted to Medicare for something the sponsor already paid for under the clinical trial agreement — the standard path is to return the money through the payer’s normal overpayment process (for Medicare, the Medicare Administrative Contractor’s voluntary refund process). This guide is about a different, narrower situation: when the overpayment is entangled with conduct that could also violate the federal Anti-Kickback Statute (AKS) or another law carrying Civil Monetary Penalty (CMP) exposure — for example, a physician-investigator compensation arrangement, a per-enrollment referral incentive, or a sponsor payment structure that looks like it rewards referrals rather than just research effort. In that situation, HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP) is the mechanism built specifically to let a provider or institution come forward first, on favorable terms, rather than wait to be found. This guide covers what the SDP is, when clinical research billing overpayments actually belong in it rather than a routine refund, how it interacts with the 60-day overpayment rule, and what the process and trade-offs look like in practice. For the underlying billing-exposure and Stark-specific mechanics, see the companion guides on False Claims Act liability in clinical trial billing and Stark Law and clinical research investigator compensation.

What the OIG Self-Disclosure Protocol is

HHS-OIG established the Provider Self-Disclosure Protocol in 1998 as a formal channel for health care providers, suppliers, and other individuals or entities subject to OIG’s civil monetary penalty (CMP) authority to voluntarily report and resolve conduct they have identified as a potential violation of federal fraud laws. In November 2021, OIG revised and renamed it the Health Care Fraud Self-Disclosure Protocol, updating the eligibility, submission, and settlement terms described below. The protocol is administered directly by OIG (not CMS or the Department of Justice), and disclosures are submitted through OIG’s dedicated SDP process — OIG is explicit that self-disclosures should not be routed through the general OIG Hotline, which is for reporting someone else’s suspected fraud, not your own organization’s.

The SDP exists because OIG wants an incentive structure that rewards providers who find and report their own compliance failures. A provider that investigates itself, quantifies the damage, and brings it to OIG gets materially better settlement terms than one that is caught by an audit, a whistleblower (qui tam) suit, or a government-initiated investigation.

SDP vs. routine overpayment refunds vs. CMS’s Self-Referral Disclosure Protocol

Not every clinical research billing overpayment is an SDP case. Three distinct pathways exist, and picking the wrong one either overcorrects a simple billing error or under-corrects real fraud exposure:

Routine refund to the Medicare Administrative Contractor (MAC). Use this when the overpayment is a straightforward billing or coding error with no plausible kickback, referral, or false-statement angle — for example, a charge that should have been billed to the sponsor under the clinical trial agreement was billed to Medicare instead, caught and corrected promptly, with no compensation arrangement in the fact pattern.
HHS-OIG Self-Disclosure Protocol. Use this when the overpayment traces back to conduct that could independently violate the Anti-Kickback Statute or another CMP-eligible law — most commonly in the clinical research setting, an investigator or coordinator compensation structure, recruitment bonus, or referral arrangement that raises kickback concerns and also produced improperly billed claims.
CMS Self-Referral Disclosure Protocol (SRDP). Use this for a Stark Law–only issue — a physician self-referral problem with no accompanying kickback intent. This distinction matters because OIG’s SDP is not available for disclosing a Stark violation that has no AKS component; that has to go through CMS’s separate SRDP instead. See the Stark Law and clinical research investigator compensation guide for how Stark’s strict-liability, no-intent-required standard differs from the AKS’s intent-based standard, which is exactly why the two overpayment-disclosure regimes are split between two different agencies.

When a clinical research billing overpayment belongs in the SDP

In a clinical trial billing context, the SDP becomes the right tool when an internal investigation (often triggered by a coverage-analysis audit, a compliance hotline report, or a routine Medicare billing reconciliation) surfaces a fact pattern like:

An investigator, sub-investigator, or coordinator compensation arrangement tied to enrollment volume or referral rate, where the same population also generated Medicare or Medicaid claims for routine costs.
A sponsor “finder’s fee” or per-patient payment to referring physicians that was not properly structured under a Fair Market Value, non-referral-volume-based agreement.
Free or below-fair-market-value items, services, or study-related benefits provided to referring physicians or patients that could be construed as remuneration to induce referrals, alongside claims billed to a federal health care program for the same patients’ routine care.
A billing arrangement uncovered during an internal audit that the institution cannot in good faith characterize as a simple coding error, because it’s bound up with a compensation or referral structure that hasn’t been vetted against an AKS safe harbor.

If the compliance review finds only a coding or coverage-determination mistake — no compensation-for-referrals fact pattern at all — the SDP is the wrong (and unnecessarily costly) tool; the routine MAC refund process is the correct one. Institutions that default every clinical-trial billing correction into the SDP out of excess caution both slow down routine corrections and dilute the SDP’s function as a fraud-specific channel.

Eligibility and the “voluntary” requirement

Health care providers, suppliers, and other individuals or entities subject to OIG’s CMP authority are eligible to use the SDP. The disclosure has to be genuinely voluntary: a submission made after OIG, another law enforcement agency, or a relator has already identified the conduct — through an audit notice, subpoena, civil investigative demand, or filed qui tam complaint — is not a “self”-disclosure in the sense the protocol rewards, and OIG will not extend SDP settlement benefits to conduct it (or the government) already knew about through another channel. This is a central reason institutions move quickly once an internal audit or hotline report surfaces a potential AKS-adjacent billing issue: the settlement benefits described below are only available while the disclosure is still ahead of any external discovery.

The 60-day overpayment rule and how the SDP suspends it

Separately from the SDP, the Affordable Care Act’s overpayment provision (Section 6402(a), codified at 42 U.S.C. § 1320a-7k(d)) requires a provider that has “identified” a Medicare or Medicaid overpayment to report and return it within 60 days, or the retained overpayment itself becomes a “reverse false claim” under the FCA. That 60-day clock is exactly what makes fraud-adjacent billing overpayments urgent rather than routine — see the companion guide on FCA liability in clinical trial billing for how the reverse-false-claims theory attaches to an unreturned overpayment.

When the overpayment can’t yet be reliably quantified without a fuller investigation — which is typical for a kickback-adjacent billing issue spanning a compensation arrangement and multiple years of claims — submitting to the OIG SDP is the mechanism that legitimately pauses that clock. Under 42 CFR § 401.305, the 60-day repayment obligation is suspended once OIG acknowledges receipt of an SDP submission, and it stays suspended until a settlement is reached, or the provider withdraws or is removed from the SDP. CMS’s Self-Referral Disclosure Protocol has an equivalent suspension mechanism for Stark-only matters. This is one of the SDP’s most practically important features for a research billing overpayment: it converts an open-ended, ongoing 60-day-violation exposure into a paused clock while the institution and OIG work through a defensible damages calculation.

Step by step: the SDP process

Internal investigation and scoping. Before submitting, the disclosing party has to have already done the internal work: identify the conduct, determine the applicable law(s) implicated (AKS, CMP law, or both), and reasonably quantify the affected claims and the resulting overpayment.
Submission. The disclosure is submitted to OIG in the format and through the channel OIG’s current SDP guidance specifies, including a description of the conduct, the individuals/entities involved, the legal authorities implicated, and the disclosing party’s damages calculation and methodology.
OIG acknowledgment. OIG’s acknowledgment of receipt is the trigger that suspends the 60-day overpayment clock described above.
Cooperation and verification. OIG may request additional documentation, ask the disclosing party to expand or refine the damages analysis, or otherwise verify the scope of the conduct before settlement terms are discussed.
Settlement negotiation. OIG and the disclosing party negotiate a settlement amount and, where applicable, additional integrity obligations. The party can withdraw from the SDP at any point before a settlement is finalized, though withdrawal ends the 60-day clock suspension and the underlying overpayment obligation resumes.
Resolution. A finalized settlement releases the disclosed conduct from further CMP/exclusion liability on the terms agreed, closing out that specific matter.

Why disclosing is usually the better option: the settlement benefits

OIG’s November 2021 update sets out the concrete terms that make voluntary disclosure worth the administrative burden:

A reduced damages multiplier. OIG’s general practice is a minimum settlement multiplier of 1.5 times single damages for SDP matters, though OIG can require a higher multiplier if the facts warrant it. That compares favorably to government-initiated investigations and settlements, where multipliers up to the FCA’s statutory maximum of three times damages are possible.
Defined minimum settlement amounts. The 2021 update doubled the SDP’s minimum settlement floor for Anti-Kickback Statute matters to $100,000 (from $50,000) and doubled the minimum for all other SDP matters to $20,000 (from $10,000) — a floor, not a typical outcome; actual settlements scale with the calculated damages.
A presumption against a Corporate Integrity Agreement (CIA). OIG applies a presumption against requiring a CIA — the ongoing compliance-monitoring and reporting obligation OIG typically imposes in settlements it initiates — for an entity that comes forward through the SDP, in contrast to government-initiated fraud settlements, where a CIA is common.
Release from CMP exclusion exposure on the specific disclosed conduct, once a settlement is reached, rather than an open-ended exposure to OIG’s independent permissive-exclusion authority.

Risks and trade-offs to weigh before disclosing

The SDP is not a shortcut around liability, and it isn’t free of downside:

It requires admitting scope, not minimizing it. A credible SDP submission depends on a thorough internal investigation; understating the scope of the conduct or the damages calculation to OIG undermines the good-faith basis the settlement benefits depend on, and can be discovered during OIG’s own verification.
It doesn’t stop a relator. Submitting to the SDP does not, by itself, prevent a qui tam relator (a whistleblower with independent, non-public knowledge of the same conduct) from filing an FCA suit — voluntary disclosure is a mitigating factor, not an immunity, and timing matters: OIG will not extend SDP benefits to conduct it learns is already the subject of an active qui tam filing.
It commits real institutional resources. The internal investigation, damages quantification, and negotiation process is often lengthy and resource-intensive, particularly when the conduct spans multiple trials, sponsors, or years of claims data.
It’s the wrong tool for a Stark-only issue. As noted above, a pure Stark Law problem with no AKS component belongs in CMS’s SRDP, not OIG’s SDP — filing in the wrong protocol wastes the disclosure’s timing advantage.

Who should be involved in the decision

Because the SDP decision sits at the intersection of research administration, institutional compliance, and outside health care fraud counsel, it is rarely a call one office makes alone. A research billing compliance program built around the seven elements of an effective compliance program — particularly the elements covering internal monitoring/auditing and prompt response to detected offenses — is what surfaces these issues early enough for the SDP’s timing advantage to still be available. Institutions should also confirm the individuals involved in the underlying conduct are not separately subject to OIG exclusion, since an excluded individual’s involvement changes the compliance posture of the disclosure itself. An SDP matter is also a useful early-warning signal for the kind of issue that could otherwise surface later in an OIG audit or contribute to a subsequent funds clawback or recoupment action — self-disclosure is, among other things, a way of getting ahead of both.

Frequently asked questions

Does the OIG Self-Disclosure Protocol cover Stark Law violations?

Not on its own. OIG’s SDP does not accept a disclosure of a Stark Law (physician self-referral) violation that has no accompanying Anti-Kickback Statute liability. A Stark-only issue goes through CMS’s separate Self-Referral Disclosure Protocol (SRDP). If a research billing issue implicates both Stark and the AKS, the two disclosures may need to be coordinated with counsel across both protocols.

Is every clinical trial billing overpayment an SDP matter?

No. Most clinical trial billing overpayments are coding, coverage-analysis, or reconciliation errors with no referral or compensation angle, and should go back through the standard Medicare Administrative Contractor overpayment/refund process, not the SDP. The SDP is specifically for overpayments entangled with conduct that could independently violate the AKS or another CMP-eligible fraud law.

What is the minimum settlement amount under the SDP?

Following OIG’s November 2021 update, the SDP’s minimum settlement floor is $100,000 for matters involving the Anti-Kickback Statute and $20,000 for all other SDP matters. These are floors set by OIG policy, not caps — actual settlements are calculated from the disclosed damages and the applicable multiplier.

Does submitting to the SDP stop the 60-day overpayment clock?

Yes, once OIG acknowledges receipt of the submission. Under 42 CFR § 401.305, the Affordable Care Act’s 60-day overpayment repayment obligation is suspended from that acknowledgment until a settlement is reached, or the provider withdraws from or is removed from the SDP.

Can we still be sued by a whistleblower after self-disclosing?

Submitting to the SDP is not a bar to a qui tam suit filed by a relator who has independent knowledge of the same conduct, though OIG’s willingness to extend SDP settlement benefits depends on the disclosure genuinely preceding any government or relator discovery of the issue. This is a key reason institutions move quickly once a potential AKS-adjacent billing issue is identified internally.

Related CASRAI resources

This guide is general information for research administrators and compliance staff, not legal advice. Whether a specific billing overpayment belongs in the OIG Self-Disclosure Protocol depends on facts that should be reviewed with institutional compliance and health care fraud counsel before submission.