The Centers for Medicare & Medicaid Services (CMS) recently posted revised forms for its voluntary self-referral disclosure protocol (SRDP), the process Medicare providers and suppliers use to self-disclose and resolve actual or potential violations of the physician self-referral law (Stark Law). Providers may use the updated forms now, and they must use them for disclosures submitted on or after Nov. 1, 2026. CMS describes the revisions as minor edits to reduce burden, and our comparisons of the four revised forms (available for download below) largely bear that out.
That said, a few changes stand out. The updated forms:
- allow a group practice that failed to provide the written imaging notice required under the in-office ancillary services exception to disclose on a single Physician Information Form, rather than one form per physician;
- clarify when a practice must submit both the Group Practice Information Form and Physician Information Form(s);
- put more weight in the questions on when the disclosing party discovered the issue and when the noncompliance began; and
- remind parties that refunding directly to a Medicare Administrative Contractor (MAC) may be an option, particularly for smaller amounts, and specifically ask to describe planned auditing and monitoring.
Background
The Stark Law generally prohibits a physician from referring Medicare patients for designated health services (DHS) to an entity with which the physician or an immediate family member has a financial relationship. The law prohibits the entity from billing for DHS resulting from prohibited referrals, unless an exception applies.
Because the Stark Law is strict liability, small technical problems can create outsized exposure, including overpayment liability, civil monetary penalties and False Claims Act risk. That is why Congress directed CMS in Section 6409 of the Affordable Care Act to create the SRDP, which CMS established on Sept. 23, 2010. The SRDP lets providers and suppliers disclose actual or potential violations, and it gives CMS authority to settle these disclosures for less than the full amount received by the provider or supplier for the DHS.
CMS last updated the SRDP forms effective March 1, 2023, as we discussed in our March 2023 alert, “CMS Streamlines Stark Law Self-Disclosures.” That update created the Group Practice Information Form, allowed a single Physician Information Form for physicians who stand in the shoes of their physician organization, and permitted fully electronic certifications (instead of submitting paper certificates). The 2026 forms, approved by the Office of Management and Budget on July 17, 2026, build on that streamlined framework.
Key 2026 Changes
Imaging notice disclosures. To rely on the in-office ancillary services exception for certain advanced imaging (MRI, CT and PET), a referring physician must give the patient written notice at the time of referral that the patient may obtain the service elsewhere, along with a list of at least five other suppliers within 25 miles (42 C.F.R. § 411.355(b)(7)). Until now, a group practice disclosing missed notices had to file a separate Physician Information Form for each physician. The use of the Physician Information Form does not change here. Instead, CMS extends the same single-form approach it already allows for physicians who stand in the shoes of their organization: a qualifying group practice may submit one Physician Information Form, plus a list of each affected physician’s name, NPI and period of noncompliance, in lieu of a single form for each physician.
Disclosures requiring both forms. Some practices will need both the Group Practice Information Form and the Physician Information Form for disclosure. CMS explains that a practice disclosing a failure to qualify as a group practice under § 411.352 during some periods, and a separate problem in other periods, should file the Group Practice Information Form for the former and Physician Information Form(s) for the latter. CMS’s example is a practice that failed the § 411.352(h) patient-encounter test in 2021 and missed imaging notices in 2022 and 2023. The submission checklist now reads “AND/OR” to reflect this clarification.
Discovery dates and lookback periods. The SRDP has always asked about timing, but CMS appears to be placing more emphasis on it now. New items ask parties to explain any significant delay between first becoming aware of a potential issue and identifying the overpayment. The new items also allow parties to estimate when noncompliance began if it predates the six-year lookback period. CMS also moved the date-of-discovery question off the Group Practice Information Form and individual Physician Information Forms and onto the main SRDP Disclosure Form. That form now asks for the month and year the party first became aware of potential noncompliance, and how. CMS distinguishes that date from when the overpayment was identified under § 401.305(a)(2) (i.e., the date discussed under the 60-day overpayment rule).
In our view, the move reinforces CMS’s focus on timing and treats discovery as an organization-wide question rather than a physician-by-physician one. CMS’s new example demonstrates this difference: a practice that spotted a potential issue during transaction diligence in March 2026 and identified the overpayment on June 1, 2026, the date that starts the six-year lookback. Both are now disclosed.
Reminder to consider refunds. CMS now explicitly reminds parties that the SRDP is not the only path for addressing noncompliance. A party may satisfy its report-and-return obligation by refunding the full overpayment directly to its MAC, for example, when preparing an SRDP submission would cost more to prepare in legal expenses than the overpayment or when a quick resolution is needed ahead of a transaction. This option has always been available, but it is easy to overlook.
Auditing and monitoring. CMS seems to want more than a promise that the problem is fixed. The question on steps to prevent future noncompliance now asks about anticipated auditing and monitoring, so disclosing parties should be ready to describe concrete follow-up.
Physician-Owned Hospital Updates. CMS also cleaned up its special instructions for disclosures involving only physician-owned hospital website and advertising requirements (§ 411.362(b)(3)(ii)(C)). Consistent with the general SRDP, disclosing parties now submit the signed certification electronically with the disclosure rather than mailing it to CMS.
Redline Downloads
Comparisons of each revised form are available here: SRDP Disclosure Form and Protocol; Group Practice Information Form; Physician Information Form; and Special Instructions for § 411.362(b)(3)(ii)(C) disclosures.
Practical Takeaways
While these changes are modest, the updated forms will be mandatory for SRDP disclosures starting Nov. 1, 2026. The update is also a good reminder that the Stark Law is strict liability, and that group practices should confirm they are giving the required imaging notices. Self-disclosures are common, and CMS continues to work through them. As we noted in our April 2026 post, “CMS Reaches $100 Million in Stark Self-Disclosure Settlements,” CMS had settled 1,234 SRDP submissions through Dec. 31, 2025, totaling $105,090,031.
If you have questions about Stark Law compliance or whether a self-disclosure makes sense, please contact the authors or another member of the McGuireWoods Healthcare Compliance, Regulatory & Policy practice group.