The U.S. Department of Health and Human Services (HHS) has announced a new general policy on what factors the agency will take into account when considering whether to make a criminal referral to the Department of Justice (DOJ) for individuals and entities who violate HHS regulations.

The notice, published on June 24, is in response to Executive Order 14294, which was issued by President Trump on May 9, 2025 and is designed to fight “overcriminalization in federal regulations.” That executive order pointed to the Code of Federal Regulations and its reams of pages in which lurk regulations that could result in criminal liability.

Under the executive order, agencies were required to issue guidance in the Federal Register (so, more pages to read) to identify their plan to address criminal regulatory offenses. In addition to this policy guidance, the agencies are required to submit a report within a year to the Office of Management and Budget (OMB) detailing all potentially criminal regulatory offenses as well as the potential punishment for violation of those regulations.

HHS general policy on criminal referrals

The HHS notice follows the requirements of the executive order precisely, identifying the following considerations that HHS “should consider” prior to any criminal referral to the DOJ:

• the harm or risk of harm, pecuniary or otherwise, caused by the alleged offense;
• the potential gain to the putative defendant that could result from the offense;
• whether the putative defendant held specialized knowledge or expertise, or was licensed in an industry related to the rule or regulation at issue; and
• evidence, if any is available, of the putative defendant’s general awareness of the unlawfulness of his conduct as well as his knowledge or lack thereof of the regulation at issue.

These are the same four factors identified in the executive order as aspects that an agency should consider when developing its policy. But before using the policy as an absolute guide to when HHS will refer regulatory violations for criminal investigation, impacted individuals should consider the nature of the policy.

• Even on its face, the policy announcement is “general” and “subject to appropriate exceptions.”
• Beyond those caveats, HHS is promulgating this policy through subregulatory guidance and at the behest of an executive order. It is not a full rule subject to the notice-and-comment procedures of the Administrative Procedure Act and pursuant to delegated legislative authority from Congress. As a result, just as with all subregulatory guidance documents, this policy is not binding on HHS and does not create a right of action for an individual who claims that HHS didn’t follow the policy when referring violations to the DOJ.

HHS report on criminal regulatory violations

In addition to the general policy in the notice, HHS announced that it has begun to sift through its regulations to create the criminal violation report required by E.O. 14294. According to the notice, that report will be submitted to OMB by May 9, 2026, and will include both the list of all criminal regulatory offenses as well as the range of potential penalties and corresponding mens rea required for each criminal offense.

If HHS and OMB follow the dictates of the executive order, that report will be published publicly on the HHS website. Additionally, the report will provide another guidepost for HHS to consider before making a criminal referral to the DOJ. As noted by the executive order, criminal referral for any offense not listed in the report will be strongly discouraged.

What does this mean for health care?

In the life sciences and health care context, many criminal fraud referrals are based on alleged statutory violations (e.g., violations of the Food, Drug, and Cosmetic Act, the Anti-Kickback Statute, the Health Care Fraud statute, and HIPAA). However, much of the conduct that the government often alleges violates those statutes is regulatory in nature, especially in the context of the extensive and detailed FDA implementing regulations in Title 21 of the C.F.R. (Good Manufacturing Practice regulations, among others), the Medicare payment rules, and the HIPAA Privacy Rule.

So, it will be interesting to see what regulations HHS identifies as criminal regulations in its report to OMB, and what mens rea it identifies or proposes to assign to these rule-based offenses given their complexity. Additionally, while HHS navigates its response to E.O. 14294, it seems possible that we see a reduction in referrals from the Food and Drug Administration (which enforces the FDCA), the Office for Civil Rights at HHS (which enforces HIPAA) and the Office of Inspector General (which enforces fraud and abuse laws), if they are discouraged from making criminal referrals for regulatory violations that also come within statutory criminal provisions during the pendency of this report. That said, many of the same regulations have civil enforcement counterparts, many of which are relevant to the DOJ’s recently launched False Claims Act Working Group.

Reed Smith will continue to follow developments with regard to changes in the regulatory and enforcement landscape during the Trump Administration. If you have any questions about this policy or other regulatory or enforcement questions, please don’t hesitate to reach out to the authors or to other health care lawyers at Reed Smith.