Good

morning

recording

in progress.

I'd like to call this public hearing of the committee on health to order.

Today is Wednesday, October 14th, 2026.

The time is eleven oh one AM.

I'm at large Councilmember Christina Henderson, Chair of the Committee on Health.

We're in room five hundred of the John A.

Wilson building, and this is a hybrid hearing with public witnesses testifying both virtually and in person, and our government witnesses testifying in person.

Today we will consider two pieces of legislation before the committee, Bill Twenty Six Dash Seven Nine Nine and Bill Twenty Six Dash Eight O Nine.

It broadens the DC Health Authority for regulatory oversight of health facility acquisitions, mergers, ownership changes, and other material changes required by, or excuse me, requiring a certificate of need from SHIPTA for these changes to move forward and exempt healthcare facilities and agencies from clean hands requirements when they are renewing their certificate of need.

Bill

26 809 as the Health Benefit Exchange Authority Technical Amendment Act of 2026.

I introduced this at the request of the Health Benefit Exchange Authority.

It makes several technical and clarifying amendments to HBX's authorizing legislation.

First, the legislation clarifies that HBX has independent personnel status, which is consistent with the district's other independent agencies.

Second, the bill would clarify HBX's purpose and authorities, including effectuating anything in the Affordable Care Act and applicable district law.

Third, the legislation amends the executive board membership to include one board member with specific expertise in information technology.

And finally, the legislation refines the Act's code of conduct to remove conflicting provisions with the district's comprehensive code of conduct, which became law after HBX's authorizing legislation.

I do look forward to today's legislation, excuse me, today's conversation on the bills.

If any of my colleagues join, uh we will certainly have conversation with them.

We're going to move to our public witnesses.

Our public witnesses will have three minutes to testify.

Certainly welcome to submit longer testimony for the record.

So we'll get started.

I'm going to call everybody together.

So if you're joining us virtually, you'll need to affirmatively accept our invitation to become a panelist.

Justin Palmer, who is from the DC Hospital Association, Veronica Sharp, and Andrew Ross from the Alzheimer's Impact Movement.

Give it a minute while folks are joining us.

Okay.

Justin, when you're ready.

Good morning, Chairperson Henderson and members of the committee on health.

My name is Justin Palmer.

I'm the Vice President for Public Policy and External Affairs at the District of Columbia Hospital Association.

Thank you for the opportunity to provide testimony on B-260799, the Healthcare Facilities Regulation Amendment Act of 2026.

DCHA and its members share the district's commitment to improving health care quality and patient safety for all district residents.

We appreciate DC Health's efforts to modernize the district's adverse reporting framework to address to address the evolving healthcare landscape given the growing risks of cybersecurity events have on patient care and safety.

Updating the process of reporting has been a part of an ongoing productive dialogue with the C with Senior Deputy Director Hurley.

While we support the intent of B260799, we offer the following recommendations to ensure that reporting requirements are clear and build on the district's existing patient safety program.

First, we believe the definition of adverse events should establish a clear threshold for mandatory reporting and rulemaking so the hospitals have certainty about what is reportable under the district's current patient safety program.

Hospitals already are required to report serious reportable events, SREs based on the 28 SREs identified by the National Quality Forum and four specific DC specific uh events.

Uh to preserve consistency, this established framework, we recommend maintaining the current definition and adverse events of adverse events in statute.

Second, we recommend that the mandatory reporting requirements for cybersecurity events be separate from the adverse events and have a risk-based framework.

As currently proposed, the definition of cybersecurity events could encompass routine activity that hospitals detect and successfully mitigate through normal IT security operations.

Instead, mandatory reporting should be limited to significant cybersecurity incidents that materially disrupt normal operations are reasonably and are reasonably likely to cause material harm to operations or result in the deployment of ransomware.

Third, we recommend extending the proposed 48 power 48-hour reporting requirement for qualifying adverse events or cybersecurity events to at least 14 days from the timeline healthcare facility becomes aware of the event, uh which is still in a substantial reduction to the current 60-day requirement.

This would provide hospitals the opportunity to confirm the facts of the events, determine whether it meets applicable reporting criteria and provide meaningful information to DC Health.

Fourth, we recommend a tiered-based structure uh to determine what requires a root cause analysis based on recommendations from NQF and the joint commission.

An extensive root cause analysis on every report may create a burden on staff, especially for smaller institutions, particularly if they are already participating in a patient safety organization.

Fifth, we recommend allowing 60 days to submit uh required root cause analysis or corrective action plans.

Serious adverse events and security events may involve multiple clinicians and third-party vendors, and through uh a thorough investigation of their cause may uh take more than 45 days.

We also recommend an exemption for an active criminal investigation that is underway to avoid interfering with law enforcement or prematurely releasing information for cybersecurity events.

Um turning on uh turning to CON and licensure provisions of the bill, we encourage the committee to retain the CON regulatory framework to allow uh I have one more page.

Uh um uh CON regulatory framework to allow uh uh capital expenditure increases on a project of uh up to 25% without triggering a new CON opposed to the 10% increase included in the legislation.

Uh

additionally, we recommend limiting adjustments to licensure fees to no more than every three years rather than periodically.

Uh

DCH and its members continue to access additional components of the bill given the complexity of the issues.

We encourage encourage the committee to extend the review uh of the legislation into the new council period to allow for additional stakeholder engagement and to avoid unintended consequences.