The U.S. Department of Justice's first healthcare fraud declination under its new Corporate Enforcement and Voluntary Self-Disclosure Policy offers important lessons for healthcare companies navigating compliance and enforcement risks.
Haynes Boone attorneys Bill Morrison, Taryn McDonald and Neil Issar examine the DOJ's decision in Law360, highlighting key considerations around self-disclosure, cooperation, internal investigations and compliance strategies for healthcare companies and private equity-backed management services organizations.
Read the full article below and in Law360 here.
On July 29, the U.S. Department of Justice announced that it declined to prosecute a New Jersey-based management services organization, Campus Eye Management, under the agency's new corporate enforcement and voluntary self-disclosure policy. This was the first declination under the CEP.
At the same time, the DOJ indicted the company's founder and former CEO, Bruce DiDonato, on healthcare fraud and kickback charges. The declination offers important guidance for healthcare companies, particularly private equity-backed MSOs.
The declination sheds light on healthcare company and MSO scrutiny, and highlights considerations such as the logistics of potentially reporting to multiple agencies, and corporate decision-making surrounding cooperation against individual executives.
The CEP
The DOJ issued the CEP in March as the first departmentwide enforcement policy applicable to corporate criminal matters, except antitrust, which remains under the DOJ's Antitrust Division's separate corporate leniency policy. The CEP establishes a three-part framework that replaces the patchwork of division-specific policies that previously governed self-disclosure incentives.
Part 1 — Declination
The DOJ will decline to prosecute a company that voluntarily self-discloses misconduct,[1] fully cooperates,[2] timely remediates[3] and has no aggravating circumstances, so long as the company pays all disgorgement and restitution. Even where aggravating circumstances exist, prosecutors retain discretion to recommend a declination after weighing those circumstances against the company's disclosure, cooperation and remediation.
Part 2 — Near-Miss Nonprosecution Agreement
A company can fully cooperate and timely remediate, but remain ineligible for a declination under Part 1 of the CEP, either because its self-disclosure did not technically qualify — for example, because the DOJ already knew about the conduct — or because aggravating factors warrant a criminal resolution.
In these circumstances, the DOJ will provide a nonprosecution agreement, absent particularly egregious or multiple aggravating circumstances; allow a term of fewer than three years; not require an independent compliance monitor; and provide a fine reduction of 50%-75% off the low end of the U.S. sentencing guidelines range.
Part 3 — Discretionary Resolutions
Companies ineligible for Parts 1 or 2 may still receive up to a 50% fine reduction off the guidelines range at the prosecutor's discretion, with a presumption that the reduction will be taken from the low end for companies that fully cooperate and timely remediate.
The First Declination Under the CEP
The MSO at issue provided billing, administrative and other services to an optometry practice and ambulatory surgery center.
The DOJ alleged that, over an eight-year period, its CEO, DiDonato, billed Medicare and other insurers for duplicative and medically unnecessary diagnostic eye tests, and paid kickbacks and bribes to physicians in exchange for surgical patient referrals. DiDonato allegedly caused the submission of approximately $3.4 million in fraudulent Medicare claims, of which Medicare paid approximately $1 million. The DOJ further alleged that DiDonato marketed and sold the MSO to private equity investors based in part on the inflated Medicare reimbursements.
But the DOJ declined to prosecute the MSO for DiDonato's schemes under Part 1 of the CEP. The MSO made a timely voluntary self-disclosure; fully and proactively cooperated, including providing information about individuals and assisting with historical claims and insurer data analysis; committed to continued cooperation; timely remediated its billing, payment and compensation policies, and its compliance program; did not have aggravating circumstances; and agreed to pay $1 million in restitution.
Takeaways for Healthcare Companies
Self-disclosure might mean cooperating against your own people.
The DOJ credited Campus Eye with providing information regarding individuals. In other words, the company handed over evidence the DOJ used to indict its founder. Unlike the Antitrust Division's corporate leniency policy, which can extend immunity to cooperating employees, the CEP offers no protection to individuals.
Corporate boards deciding whether to exchange corporate leniency for individual accountability should therefore consider forming a special committee of independent directors, retaining separate counsel and preparing for internal friction that may come with cooperating against a senior leader. The decision becomes more complex if the individual is a founder, significant equity holder or someone whose cooperation is needed for the company to continue its operations.
Root cause analysis means more than blaming one person.
The CEP requires a "thorough analysis of the causes of underlying conduct." The DOJ expects companies to look beyond individual misconduct to systemic factors, such as compensation structures that reward volume over value, understaffed compliance functions, and rapid growth through acquisitions without sufficient compliance oversight.
A root cause analysis that points only to a single bad actor, without examining why a company's governance and compliance structures could fail to detect or even contribute to misconduct, could raise questions about whether a company's cooperation and remediation were adequate.
Disclosure must be to DOJ criminal divisions.
The CEP requires disclosure to a DOJ criminal component, such as the Criminal Division's Fraud Section, now part of the newly created National Fraud Enforcement Division, or the relevant U.S. Attorney's Office.
Self-disclosures to the Office of Inspector General, the Centers for Medicare and Medicaid Services, or other regulatory agencies generally do not qualify as voluntary self-disclosures under the CEP. The CEP leaves open the possibility that good faith disclosures to such entities "may qualify if appropriate under the circumstances," but that determination is left to the DOJ's discretion.
For healthcare companies accustomed to reporting compliance issues to the OIG or CMS, this is an important distinction. A disclosure to the OIG may satisfy the company's regulatory obligations, but it will not, by itself, preserve CEP benefits. As a result, companies that discover potential criminal conduct should consider a parallel-track strategy: civil disclosure to the OIG or CMS where required, and a separate criminal disclosure to the DOJ to preserve CEP eligibility.
On the other hand, not every compliance issue warrants disclosure to the DOJ. The CEP targets criminal conduct, not billing errors or good faith regulatory disagreements. This means companies should ask: Was the conduct intentional? Is the conduct attributable to a single rogue actor, or does it reflect systemic failures? And is a whistleblower or data analytics algorithm likely to report the conduct independently?
Imperfect disclosure can still yield benefits.
The MSO at issue satisfied the requirements of Part 1 of the CEP. But less discussed is Part 2 of the CEP, which outlines a near-miss pathway. Companies that cooperate and remediate but fail to technically qualify for voluntary self-disclosure under Part 1 can still receive a nonprosecution agreement, a term under three years, no monitor and a fine reduction. This means companies may benefit from self-reporting even if they are unsure whether their disclosure meets all the requirements.
Separately, the CEP gives companies a 120-day window to self-report after receiving an internal whistleblower complaint, even if the whistleblower also reported to the DOJ. That clock starts when the company receives the complaint, not when it finishes investigating. Every internal allegation of fraud should accordingly be treated as a potential trigger and escalated to senior leadership and outside counsel as soon as possible.
MSOs remain a government target.
The DOJ has long viewed the MSO model as carrying a heightened risk of fraud. According to the agency, management fees based on practice revenue can disguise kickbacks, and MSOs that control billing can direct medically unnecessary services.
Since 2019, the DOJ has secured over $61 million in civil False Claims Act settlements for kickbacks to providers disguised as MSO investment distributions, including recoveries from over 50 physicians.
So, MSOs and their private equity backers should, as part of their acquisition due diligence, take a hard look at billing patterns, physician compensation structures, referral volumes and whether revenue growth is driven by legitimate patient volume or by arrangements that could draw government scrutiny.
Conclusion
The recent MSO declination provides meaningful takeaways for healthcare companies' self-disclosure decision-making — even when it means turning over evidence against their own executives, or a parallel-track reporting strategy.
-
Bill Morrison is a partner and co-chair of the healthcare and life sciences practice group at the firm.
Taryn McDonald is a partner at the firm.
Neil Issar is counsel at Haynes Boone.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
[1] Voluntary self-disclosure means a company must make a good faith disclosure to the appropriate DOJ criminal component of misconduct that is not previously known to the DOJ, where the company had no preexisting obligation to disclose, and the disclosure occurs before an imminent threat of government investigation.
[2] Full cooperation requires, among other things, timely and truthful disclosure of all relevant facts and non-privileged evidence, attribution of facts to specific sources (not a general narrative), identification of all individuals involved regardless of position or seniority, proactive disclosure of relevant evidence even when not specifically asked, and making officers and employees available for interviews.
[3] Timely remediation requires a root cause analysis, an effective compliance program, appropriate discipline of employees responsible for misconduct, and appropriate retention of business records, including controls over personal communications and ephemeral messaging platforms (e.g., Snapchat, Signal).
