The Department of Justice’s decision not to prosecute an eye care management company this week, while indicting its founder on fraud and kickback charges, gives healthcare compliance teams their first real-world look at how a new federal disclosure policy works.
The Department of Justice released its first-ever, departmentwide Corporate Enforcement and Voluntary Self-Disclosure Policy March 10, replacing a patchwork of policies that individual divisions and U.S. attorney’s offices had maintained on their own. The policy applies to all corporate criminal matters the department handles except antitrust violations.
On July 29, the Department of Justice’s National Fraud Enforcement Division said it would decline to prosecute Campus Eye Management Holdings and its subsidiary, Campus Eye Management, resolving a healthcare fraud investigation into the companies under the new policy. Campus Eye’s declination is the department’s first healthcare-sector resolution under the new framework.
Six things to know about the case and policy:
1. The case. Campus Eye — a management services organization that provided billing and other services to an optometry practice and ASC — agreed to repay $1 million to victims as part of its declination under the policy. Its founder, E. Bruce DiDonato, who formed Campus Eye with outside investors in December 2021 and became its CEO, was separately charged in a seven-count indictment with conspiracy to commit healthcare fraud, conspiracy to violate the Anti-Kickback Statute, healthcare fraud and paying illegal healthcare kickbacks. According to the indictment, Mr. DiDonato conspired from at least 2015 through March 2023 to bill Medicare for unnecessary or duplicative diagnostic eye tests, paying kickbacks to ophthalmologists in exchange for surgery referrals in a scheme that generated about $3.4 million in fraudulent Medicare claims, of which Medicare paid roughly $1 million. He later sold Campus Eye to private equity investors, marketing the deal in part on the strength of those reimbursements. The indictment contains allegations only, and Mr. DiDonato is presumed innocent unless and until proven guilty.
2. How the policy works. Under Part I of the policy, the department will decline to prosecute a company entirely if four conditions are met: the company voluntarily self-disclosed the misconduct, fully cooperated with the investigation, timely and appropriately remediated the problem, and no aggravating circumstances are present. Companies that receive a Part I declination still must pay disgorgement, forfeiture and any victim restitution tied to the misconduct, and the department makes all such declinations public.
3. What counts as “voluntary.” The policy defines voluntary self-disclosure with five requirements: the company made a good-faith disclosure to the appropriate department component, the misconduct was not already known to the department, the company had no preexisting legal obligation to disclose, the disclosure came before any imminent threat that the department would learn of the misconduct on its own and the company reported within a reasonably prompt time. A separate exception under the department’s Corporate Whistleblower Awards Pilot Program lets a company still qualify even after a whistleblower has reported internally and to the government first, as long as the company self-reports within 120 days of learning of the whistleblower’s internal complaint.
4. What happens short of a full declination. Companies that cooperate and remediate but don’t meet every voluntary self-disclosure requirement, or that have aggravating factors, fall into Part II and are eligible for a nonprosecution agreement of fewer than three years with no independent compliance monitor and a fine reduction of 50% to 75% off the low end of federal sentencing guidelines. Everything else falls into Part III, where prosecutors keep discretion over the form and length of the resolution and any monitorship, with fine reductions capped at 50%.
5. Overlapping disclosure paths. The policy governs whether the department will prosecute a company criminally, but it isn’t the only disclosure regime healthcare organizations have to weigh when a billing problem surfaces. Depending on what’s found, an organization may also need to consider the 60-day overpayment rule, which requires providers to report and return identified Medicare and Medicaid overpayments within 60 days or risk False Claims Act exposure; CMS’ Self-Referral Disclosure Protocol for potential Stark Law violations; and the HHS Office of Inspector General’s Self-Disclosure Protocol, which covers Anti-Kickback Statute exposure. The four pathways aren’t interchangeable, and a matter can migrate between them. Disclosing to CMS or OIG also doesn’t automatically preserve eligibility for a DOJ declination. A disclosure made only to a regulatory agency generally does not, on its own, count as a voluntary self-disclosure to the DOJ under the new policy, though prosecutors retain discretion to credit it depending on the circumstances. For compliance teams, the bigger strategic risk tends to be less about which pathway to disclose through and more about delay: organizations are more likely to lose leverage while still completing an internal investigation than at the moment they finally disclose.
6. The takeaway for healthcare compliance teams. The case underscores two threads the department has emphasized elsewhere in the policy: rewarding companies that self-report and cooperate, while still pursuing the individual executives involved regardless of how the corporate matter resolves. For health systems and investors evaluating physician practices, ASCs or other provider entities, particularly those built on private-equity-backed platforms, the case is also a reminder that reimbursement-driven valuations tied to improper billing can survive a sale and resurface as liability well after closing.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.