We have tracked the Administration’s escalating campaign against fraud in federal health care and benefit programs: the release of near-unfettered Medicaid claims data, DOJ’s FOCUS initiative enlisting data-mining relators, the creation of the National Fraud Enforcement Division (Fraud Division) in an ongoing “enforcement maelstrom,” and the Fraud Division’s corporate enforcement playbook in Directives 26-12 and 26-13. Over the past two weeks, the Administration has added two new tools to its “War on Fraud” arsenal—one aimed at uncovering fraud and the other aimed at punishing it.

On October 14, 2026, HHS Secretary Robert F. Kennedy, Jr. formally delegated permissive exclusion authority to CMS, meaning that both HHS-OIG and CMS can now exclude providers from Federal health care programs. Six days later, on October 20, DOJ announced the Fraud Whistleblower Incentive Program (WHIP), a pilot program that pays whistleblowers at the charging stage of a criminal case. The next day, CMS announced its first exclusion and released a 28-minute documentary on health care fraud.

Fraud Whistleblower Incentive Program

In our October 14 post, we noted that Assistant Attorney General Colin M. McDonald’s Directive 26-12 directed Fraud Division leadership to design programs that “appropriately incentivize whistleblowers,” and that the manner in which such programs would interact with the relator-share framework of the False Claims Act (FCA) remained to be seen. Nineteen days after that Directive was issued, DOJ announced WHIP, formally titled the Fraud Division Criminal Tip Rewards Pilot Program.

WHIP’s most distinctive feature is the timing of the financial rewards offered to tipsters. Whereas most existing government whistleblower programs provide a financial reward to tipsters only after the final resolution of a criminal matter (including the forfeiture and appeals process), WHIP would provide eligible tipsters with a financial reward at the charging stage of a criminal case. According to DOJ, these “early-stage rewards” are designed to “encourage prompt disclosure of information by giving whistleblowers more certainty about the amount and timing of a possible reward payment, while still leaving whistleblowers eligible for potentially larger rewards should their tips ultimately lead to large financial penalties or forfeiture.”

To ensure WHIP’s “successful implementation,” the Department of the Treasury has committed $25 million to the pilot program.

WHIP Overview

DOJ has issued terms and conditions, as well as FAQs, detailing the pilot program. The following are WHIP’s key terms:

• Term. WHIP has an initial three-year term.

• Financial reward amount. DOJ anticipates paying eligible tipsters a reward ranging from $10,000 to $30,000 per “distinct tip,” though rewards are “entirely discretionary” and are “not guaranteed.” Rewards may be given to more than one tipster for the same matter, provided that each tipster individually meets all eligibility criteria.

• Financial reward timing. An eligible tipster generally will be paid a financial reward once DOJ obtains and unseals an indictment, information, or criminal complaint, though DOJ may pay earlier in its discretion.

• Tipster eligibility. A tipster will be eligible for a financial reward under WHIP only if, among other conditions, (i) the tipster is an individual (as opposed to a company or other entity), (ii) the tipster provides DOJ with “original information” in writing about a covered “subject area,” (iii) the tipster’s information is provided “voluntarily” and is “truthful and complete,” (iv) the tipster cooperates with DOJ in its “investigation of related conduct and criminal or civil actions,” and (v) the tipster’s original information “lead[s] to criminal charges” in one of the covered subject areas.
  • Tipsters who participated in misconduct generally excluded. Notably, while Directive 26-12 stated that the Fraud Division should “encourage and protect the disclosure of information by whistleblowers, including by those who participated in the criminal conduct,” WHIP largely excludes tipsters who participated in the reported conduct. Tipsters who “meaningfully participated in the criminal activity he or she reported, including by directing, planning, initiating, or knowingly profiting from that criminal activity,” are ineligible for a reward under WHIP, though DOJ has discretion to reward tipsters who had only a “minimal role” in the reported scheme.
  • Tipsters in oversight or compliance roles generally excluded. A tipster’s report generally will not be considered “original information” if (i) the tipster is an “officer, director, trustee, or partner” of an entity or an employee or contractor whose “principal duties” “involve compliance or internal audit responsibilities,” and (ii) the tipster learned of the alleged misconduct through the entity’s compliance reporting or internal audit processes. However, these persons may qualify as eligible tipsters (i.e., their report may be considered “original information”) if at least 120 days have elapsed since the entity’s “audit committee, chief legal officer, chief compliance officer (or their equivalents), or their supervisor” has received the information. That exception parallels the 120-day self-disclosure window under DOJ’s Corporate Enforcement Policy that we discussed in our October 14 post.
• Covered subject areas. Currently, financial rewards under WHIP are limited to reports about the following “subject areas”: (i) “Federal health care offenses and related crimes involving health care benefit programs or fraud against patients or others in the health care industry,” or (ii) “fraud on programs or benefits” administered by HHS, USDA (e.g., SNAP), DOL (e.g., unemployment benefits), HUD, Education (e.g., student aid), VA, the Department of War, or the SBA. However, WHIP “could, in the future, be expanded to include additional categories of fraud.” According to DOJ, WHIP “places a particular emphasis” on submissions involving hospice, home health care, day care (childcare-subsidy), and special services (e.g., autism care) fraud.

• Discretion. DOJ ultimately has “sole discretion” over the determination of whether to grant a financial reward and the amount of the reward.Those determinations are not appealable or subject to judicial review.

WHIP’s terms and conditions include several safeguards aimed at promoting communication and preventing retaliation. For example, DOJ states that it may weigh efforts to “impede” communications with DOJ, including “enforcing, or threatening to enforce, a confidentiality agreement,” in assessing the entity’s cooperation credit, compliance program, and culpability. Similarly, DOJ states that it will consider “any retaliation” in assessing the entity’s cooperation and may “decline to award the company any cooperation credit” and/or “institute appropriate enforcement action” in response. DOJ also may communicate directly with a director, officer, member, agent, or employee who initiated contact with DOJ, without the consent of the company’s counsel.

The FCA Interplay

In our October 14 post, we noted that it was unclear how the directive for the Fraud Division to “appropriately incentivize whistleblowers” would interact with the financial incentives made available to relators under the FCA. The WHIP terms and conditions and FAQs issued by DOJ do not specifically mention the FCA or qui tam actions. They state only that WHIP eligibility does not “preclude an individual from also recovering whistleblower payments at a later stage of the proceedings pursuant to other Government whistleblower programs, such as the Department’s Corporate Whistleblower Awards Pilot Program.” On its face, nothing appears to stop a whistleblower from collecting a WHIP award at the criminal charging stage and separately pursuing a relator’s share in a civil qui tam action. We expect the relators’ bar to explore that pairing.

Notably, WHIP’s “original information” requirement for tipsters tracks the FCA’s “original source” requirement for relators. To qualify as “original information” under WHIP, the tipster’s information must be “non-public” and “previously not known” to DOJ. It also cannot be “contained entirely in an allegation made in a judicial or administrative hearing, in a government report, hearing, audit, or investigation, or in the news media,” unless the tipster was the source.

At this stage, it is unclear whether allegations made by a relator in a qui tam action would affect the relator’s eligibility for a subsequent WHIP award (should DOJ decide to bring criminal charges). We will be watching how DOJ applies these provisions to determine whether the sequence of disclosures matters.

Signs of Larger Plans: The “1%” and “99%” Remarks

In terms of incentivizing whistleblowers, WHIP as published may be only the first step. A recent Oval Office announcement suggests the Administration has larger plans to incentivize whistleblowers. The President described a 1% “commission” on money recovered, with “no limit,” no requirement of criminal charges, and the President himself acting as “arbitrator” in “binding arbitration.” The Vice President added that the plan “is not to limit this just to criminal prosecutions.” None of this appears in WHIP’s published terms and conditions, which provide for $10,000 to $30,000 awards, require criminal charges, and leave award decisions to DOJ. It is also unclear how an uncapped 1% commission would be funded from the Department of the Treasury’s $25 million commitment. Whether the 1% concept becomes a separate program or a future expansion of WHIP remains to be seen, but stakeholders should expect whistleblower incentives to grow rather than shrink.

Responding to a reporter who compared the 1% figure to FCA relator shares, the Vice President said that “over 99%” of the fraud “we’re finding in the federal government isn’t covered by the False Claims Act.” That remark may be a reference to fraud in benefits and entitlement programs. Although the FCA technically reaches that conduct, individual losses tend to be small and attract little interest from relators’ counsel, even though the amounts are large in the aggregate. Smaller, faster incentives like WHIP may be aimed at drawing out reports in those areas.

CMS Gains Permissive Exclusion Authority

Since the 1980s, HHS-OIG has been delegated the authority to exclude persons and entities from participating in Federal health care programs, consistent with the Exclusion Statute (42 U.S.C. § 1320a-7).

In a July 21, 2026 press conference, the HHS Secretary announced that HHS would grant permissive exclusion authority to CMS. In an October 14, 2026 notice, the HHS Secretary followed through with that commitment, formally delegating to the CMS Administrator the Secretary’s permissive exclusion authority under subsection (b) of the Exclusion Statute. The notice explains the rationale for the delegation as follows: “As the agency directly responsible for administering Medicare and Medicaid, CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations.” In the Secretary’s view, delegating permissive exclusion authority to CMS “aligns investigative and enforcement responsibilities within a single operating division,” which should help “reduc[e] redundancy and improv[e] program integrity outcomes.”

The Secretary’s notice provides that the delegation of permissive exclusion authority to CMS “will be exercised in accordance with the Department’s applicable policies, procedures, guidelines, and regulations,” and the delegation does not include the authority to “conduct hearings” or “issue regulations.”

The notice also emphasizes that the delegation of permissive exclusion authority to CMS “does not affect or diminish” the Secretary’s prior delegation of mandatory and permissive exclusion authority to HHS-OIG. As a result, HHS-OIG remains the sole agency responsible for imposing mandatory exclusions, but HHS-OIG and CMS now have independent authority to impose permissive exclusions.

On October 27, 2026, HHS-OIG updated its Exclusion FAQs to address certain questions regarding how HHS-OIG and CMS will exercise their joint permissive exclusion authority. The FAQs make clear that, with respect to FCA matters, HHS-OIG will be solely responsible for resolving permissive exclusion authority on behalf of HHS. As a result, parties negotiating an FCA settlement with DOJ do not need to “talk to CMS about resolving their exclusion authority.”

Even with HHS-OIG’s updated Exclusion FAQs, there remain several open questions regarding how the delegation of permissive exclusion authority to CMS will impact health care industry members who may be the subject of exclusion:

• Will CMS apply HHS-OIG’s established criteria for permissive exclusion (which weigh conduct, cooperation, remediation, and compliance history) or instead develop its own criteria?

• When CMS is exercising its permissive exclusion authority, what notice, hearing, and appeal procedures will apply? Subsection (f) of the Exclusion Statute guarantees excluded parties “reasonable notice and an opportunity for a hearing,” and the delegation notice does not explain how CMS will provide them.

• How will CMS and HHS-OIG allocate cases and resolve disagreements? In the updated Exclusion FAQs, HHS-OIG states that it “do[es] not have additional information to share regarding case allocation” with CMS and recommends that questions be directed to CMS.

• Will CMS exclusions be made public? Currently, HHS-OIG’s List of Excluded Individuals/Entities (LEIE) includes only HHS-OIG exclusions. According to HHS-OIG’s updated Exclusion FAQs, HHS-OIG is “coordinating with CMS to make all exclusions public,” but “[i]mplementation details are under development.” Until that process is in place, providers may have difficulty screening employees and contractors for CMS exclusions.

Practical Takeaways

• Expect more direct reporting. A fast, fixed payout under WHIP gives employees and other internal whistleblowers a reason to go straight to DOJ. With respect to most employees, nothing in WHIP’s terms and conditions requires them to report internally first.

• Make internal reporting the easiest path. Given that officers, directors, trustees, partners, and compliance and audit personnel may become eligible tipsters if internal reports are not addressed within 120 days, companies should be prepared to investigate and make disclosure decisions within that window.

• Review confidentiality and separation agreements. Remove or revise provisions in confidentiality or separation agreements that could be read to impede employees from communicating with the government.

• Reinforce anti-retaliation protections. While HHS-OIG has long emphasized that an anti-retaliation policy is an important aspect of an effective compliance program, the fact that retaliation can cost a company cooperation credit under WHIP makes it even more imperative to ensure that managers are appropriately trained and that the company’s responses to internal reports are appropriately documented.

• Be proactive with data-driven reviews. Because CMS has direct access to claims data and Medicare contractor audits, the delegation of permissive exclusion authority to CMS could make exclusion a faster and more frequent consequence of the data-driven enforcement we have described throughout this series. Health care providers and suppliers looking to mitigate their exclusion risk would be well advised to proactively engage in the types of data-driven reviews currently being performed by CMS and DOJ. This is particularly important for hospice, home health, special services, and adult day care providers, as DOJ has signaled that reported fraud in those areas will be prioritized.

• Plan for parallel and administrative exposure. A single tip or data anomaly may now trigger criminal charges, an FCA action, and a CMS exclusion proceeding. Coordinating criminal, civil, and administrative counsel early is critical.

Conclusion

The War on Fraud now spans data releases, data-mining relators, a dedicated DOJ Fraud Division, a corporate enforcement playbook, upfront whistleblower rewards through WHIP, and administrative exclusion powers at CMS, and recent remarks from the Oval Office suggest that more generous whistleblower incentives may follow. As we wrote in our October 14 post, the maelstrom is no longer gathering; it has arrived. Providers and suppliers should assume that each of these tools may be used against them, often at the same time. It is time for in-house counsel and compliance personnel, along with their outside counsel, to batten down the hatches.