2026-10-14 - Committee on Health

Good morning. Recording in progress. I'd like to call this public hearing of the Committee on Health to Order. Today is Wednesday, October 14, 2026. The time is 1101 a.m. I'm at-large Councilmember

Christina Henderson, Chair of the Committee on Health. We're in Room 500 of the John A. Wilson building, and this is a hybrid hearing with public witnesses testifying both virtually and in person, and

our government witnesses testifying in person. Today, we will consider two pieces of legislation before the Committee, Bill 26-799 and Bill 26-809. I'm going to describe each of the bills before we

hear from our public witnesses. First, Bill 26-799, the Health Care Facilities Regulation Amendment Act of 2026, introduced by Chairman Mendelsohn on behalf of the Mayor, proposes changes that would

strengthen DC Health's regulatory and enforcement authority for health care facilities. Specifically, the legislation requires all health providers to submit reports of adverse events or cybersecurity

events to DC Health within 48 hours and corrective action plans within 45 days. It requires health care providers to maintain activity, participation, and national patient safety organizations. It

authorizes DC Health to issue provisional licenses to new assisted living residents. It decreases the Alzheimer's training requirement for assisted living administrators from 12 hours annually to 4

hours annually. It authorizes DC Health to impose financial penalties of over $100,000 to health facilities whose violations present an immediate danger to the life and safety of patients, residents,

or clients. It broadens the DC Health Authority for regulatory oversight of health facility acquisitions, mergers, ownership changes, and other material changes required by -- or, excuse me, requiring

a certificate of need from SHPDA for these changes to move forward and exempts health care facilities and agencies from clean hands requirements when they are renewing their certificate of need. Bill

26-809, as the Health Benefit Exchange Authority Technical Amendment Act of 2026, I introduced this at the request of the Health Benefit Exchange Authority and make several technical and clarifying

amendments to HBX's authorizing legislation. First, the legislation clarifies that HBX has independent personnel status, which is consistent with the district's other independent agencies. Second, the

bill would clarify HBX's purpose and authorities, including effectuating anything in the Affordable Care Act and applicable district law. Third, the legislation amends the executive board membership

to include one board member with specific expertise in information technology. And finally, the legislation refines the act's code of conduct to remove conflicting provisions with the district's

comprehensive code of conduct, which became law after HBX's authorizing legislation. I do look forward to today's legislation -- excuse me, today's conversation on the bills. If any of my colleagues

join, we will certainly have a conversation with them. We're going to move to our public witnesses. Our public witnesses will have three minutes to testify. Certainly welcome to submit longer

testimony for the record. So we'll get started. I'm going to call everybody together. So if you're joining us virtually, you'll need to affirmatively accept our invitation to become a panelist. Justin

Palmer, who is from the D.C. Hospital Association, Veronica Sharp, and Andrew Ross from the Alzheimer's Impact Movement. Give it a minute while folks are joining us. Okay. Justin, when you're ready.

Good morning, Trippers Henderson and members of the Committee on Health. My name is Justin Palmer. I'm the vice president for public policy and external affairs at the District of Columbia Hospital

Association. Thank you for the opportunity to provide testimony on B260799, the Health Care Facilities Regulation Amendment Act of 2026. DCHA and its members share the district's commitment to

improving health care quality and patient safety for all district residents. We appreciate DC Health's efforts to modernize just the district's adverse reporting framework to address the evolving

health care landscape, given the growing risks of cybersecurity events you can have on patient care and safety. Updating the process of reporting has been part of an ongoing productive dialogue with

the senior deputy director Hurley. While we support the intent of B260799, we offer the following recommendations to ensure that reporting requirements are clear and built on the district's existing

patient safety program. First, we believe the definition of adverse events established a clear threshold for mandatory reporting and rulemaking so the hospitals have certainty about what is

reportable. Under the district's current patient safety program, hospitals already are required to report serious reportable events, SREs, based on the 28 SREs identified by the National Quality Forum

and four DC specific events. To preserve consistency, this established framework, we recommend maintaining the current definition of adverse events in statute. Second, we recommend that the mandatory

reporting requirements for cybersecurity events be separate from the adverse events and have a risk-based framework. As currently proposed, the definition of cybersecurity events could encompass

routine activity that hospitals detect and successfully mitigate through normal IT security operations. Instead, mandatory reporting should be limited to significant cybersecurity instances that

materially disrupt normal operations and are reasonably likely to cause material harm operations or result in the deployment of ransomware. Third, we recommend extending the proposed 48-hour reporting

requirement for qualifying adverse events or cybersecurity events to at least 14 days from the timeline, a healthcare facility becomes aware of the event, which is still a substantial reduction to the

current 16-day requirement. This would provide hospitals the opportunity to confirm the facts of the events, determine whether it meets applicable reporting criteria, and provide meaningful

information to DC Health. Fourth, we recommend a tiered-based structure to determine what requires a root cause analysis based on recommendations from NQF and the Joint Commission. An extensive root

cause analysis on every report may create a burden on staff, especially for smaller institutions, particularly if they are already participating in a patient safety organization. Fifth, we recommend

allowing 60 days to submit required root cause analysis or corrective action plans. Serious adverse events and security events may involve multiple clinicians and third-party vendors, and through a

thorough investigation of their causes may take more than 45 days. We also recommend an exemption for an active criminal investigation that is underway to avoid interfering with law enforcement or

prematurely releasing information for cybersecurity events. Turning to CON and licensure proficiency of the bill, we encourage the committee to retain the CON regulatory framework to allow capital

expenditure increases on a project up to 25% without triggering a new CON opposed to the 10% increase included in the legislation. Additionally, we recommend limiting adjustments to licensure fees to

know more than every three years rather than periodically. DCH and its members continue to assess additional components of the bill given the complexity of the issues. We encourage the committee to

extend the review of the legislation into the new council period to allow for additional stakeholder engagement and to avoid unintended consequences. There are more details in our submitted testimony

and we will likely be submitting supplemental materials while the record is open. Thank you for the opportunity to testify. Thank you. I don't see Veronica, but I do see Andrew. Andrew? Thank you,

Chairman Henderson and members of the committee. I appreciate the opportunity to testify today. I am Andrew Ross, Director of State Policy for the Alzheimer's Association and am here in recognition of

the importance of the Healthcare Facilities Regulation Amendment Act of 2026, particularly sections 3B and 3C of B260799. Thank you, Chairman Henderson, the committee for your continued leadership in

making Alzheimer's a priority across the district. This legislation, however, would reduce annual dementia training required of assisted living administrators by two thirds. We're seeing research and

care for Alzheimer's changing rapidly right now, which is driving the need for more training, not less. A large segment of DC residents in assisted living facilities have Alzheimer's or another form

of dementia making this even more important. And it's ensuring that facilities are led by well trained administrators that have a well trained workforce is critical. The association urges the

committee to amend the bill to remove these provisions and keep the requirement that administrators complete the 12 hours of dementia training each year. In the district, more than 15,000 residents

live with Alzheimer's. This is the highest prevalence of older adults with Alzheimer's compared to any state and compared to any county. In 2025, Medicaid costs for people with Alzheimer's in the

district reached an estimated $153 million. But the council and this committee in particular has really built a strong foundation, including establishing a dementia services coordinator position,

training standards for direct care workers, training for first responders, and a new dementia specialist position within the Department of Aging and Community Living. Administrators and living set the

standard of care. They make staffing decisions, supervise a staff who provide daily care, manage transitions as needs change. And today, it is very, very beneficial that those administrators are

completing training under the Assisted Living Residence Act, which includes the 12 additional hours of dementia training. While this is considered a clarification in practice, it is a two thirds

reduction in ongoing training for the leaders of these residences. The Department of Health, though, really does deserve credit for their actions in working towards implementing the Demented Training

for Direct Care Workers Amendment Act. However, that law is still not fully implemented. It took effect in March of 2021. The Department proposed regulations in early 2025. We submitted comments and

support. However, more than five years later, those rules have still not been issued. Without that, there's no established process to move forward. And protecting training is so important, but really

only half the picture because there's a significant gap that we have not filled, which is recognizing the advancements in diagnosis and treatment to address this disease in its earliest stages. So I

appreciate the opportunity to testify today and we are happy to take any questions that you may have. Thank you so much. And I just want to note for the record, we do know that there are a few

stakeholders that weren't able to make today's hearing. Who plan to submit written testimony as well? So we'll certainly incorporate that. And we're always open to follow up conversations. I do have a

couple of questions I want to ask. So, Justin, the health care facilities bill updates, well, rather, expands the definition of adverse events from what we currently have. And in your testimony,

you're saying, no, we like the current definition. Well, the current definition because of the current reporting requirements are the NQF, the 28 NQF definitions, and the four DC specific. I think

there is a question of, I think from what we heard from our members is the new definition doesn't give, doesn't help with the specific specifics of what they need to report as much and they're

comfortable with the current definition. So you don't feel as though the definition being proposed provides clarity? Our members did not. OK. All right. That's good to know. I do want to push back

just a little bit in terms of some of the things that you talked about in your written testimony that cybersecurity incidents should not be considered adverse events. No. Or you just want to hand it

separately. They're separate. They can be adverse events, but I think they have complexities. There is the SREs versus cybersecurity. So we just prefer them to be treated separately. So not opposed to

reporting cybersecurity events. And there is also a tiered of, you know, there are certain things that get reported directly to the duty officer immediately or Miss Cooper, like when there is patient

safety and all those things that are involved. So that is not a concern because those reporting would still happen with those. I think we're not opposed to reporting both of those incidents. OK. Also

in your written testimony, which I'm also going to push back on, quote, we also recommend extending the proposed 48 hour reporting requirement for qualifying adverse events or cybersecurity events to

at least 14 days from the time the health care facility becomes aware to the event. Why do you need two weeks to tell DC Health that you had a cybersecurity attack? So I think we can treat again,

treat cybersecurity and adverse events separately. Adverse events require the staff members involved to be interviewed. Staff members or incidents that were involved in the event may not be working

the next day or may not be made their hospitals have had incidents where the person has left the country on travel. And so meeting the 48 hours for adverse events, like notification of something went

wrong, like through the HMC or something like that, not suggesting that that take for 40 hours. I am now starting to understand why you all are suggesting separate it out. And so I'll ask DC Health

was that the intention, though, of like now we want all adverse events known within I think there's a there is going to be complications with the hospitals turning around. All of the things that are

required for an adverse event within 48 hours. OK, that is what we have heard. I want to because our hospitals are reporting now and so don't have problems reporting the adverse events like that is

not what we're concerned about. OK, I think we could definitely talk about putting some more clarity in there. So I think obviously you have a lot more in your testimony than there's a lot in the

bill. I mean, yes, there's a lot of the bill. And also just to say for the record, this is the bill that it was introduced by the chairman on behalf of the mayor. The name of the bill doesn't

necessarily capture all the things in the bill, which I know is sometimes hard for folks where they just look for the titles to determine whether or not they should care about a piece of legislation.

But there have been some entities and providers who have said, like, hey, you guys should pay attention to this bill because you're in it. And they didn't know. So it's a lot there. But. And we're

still getting feedback from hospitals as of this morning. We were like, well, we have more feedback. OK, OK. Well, and well, that's why we'll submit some supplemental information as well. Great. Mr.

Ross, thank you so much for being here and for your advocacy as well. So not that I'm agreeing, but I'm just going to say that my understanding is that the attempt here by D.C. Health in terms of

changing the assisted living administrator training requirements was to streamline with other requirements that exist in a different bill. Well, in a different section of the code for other long term

care folks who only have to do four hours of training. Do you do you buy that or? So there definitely are there's two different sectors of code that discuss dementia specific training. And the 2021

law is is newer than the assisted living residents act, which is where this current bill is taking action. However, to go from a higher standard that is very, very appropriate, recognizing the

population being served to four hours, we feel does not reflect the importance of dementia specific training. And it is not if the issue is just about streamlining. We're happy that this 12 hour

basically moved over into the other part of code in seven, seven, forty four. But not there's no other reason, my opinion, recognizing the importance here for context. Also, our neighbor in Virginia

also have a 12 hour standard for administrators. Again, memory care, for example, is largely assisted living. This is a population that is over half or so of residential care facility. Residents have

dementia. Very, very, very important. Yeah. And I guess and I heard through your testimony to sort of the idea that in a variety of different instances, we have different standards for directors and

administrators than we have for everyone else. You can say the same for like in education context, right? We have a different standard of training for principal versus someone who is a

paraprofessional or a teacher aide. So we'll ask some further questions on that. But thank you so much for being here. Thank you to our public witnesses. I don't have any further questions. OK, I know

what the gender says, but then I see one agency here ready to go. And I don't see the other one. OK, so we're going to go health first health first here here. We're going to go with health first DC

Health rather. So we're going to hear from Sam Hurley, who's the senior deputy director of the Health Systems and Preparedness Administration at DC Health. Mr. Hurley, before you begin, I need to

swear you in, but also any of your colleagues who may join you at the table if you have to phone a friend. So if everybody can raise their right hands. If you're going to speak today, you might be

called to the table. But if you are, raise your hand. All right. Do you swear our firm under penalty of law that the testimony you're about to provide to the Council of the District of Columbia and

this committee is to choose the whole truth and not the truth? Great. All right, Sam, when you're ready. Good morning, Chairperson Henderson, members of the Committee on Health and Council staff, my

name is Sam Hurley, and I am the senior deputy director for DC Health Health Systems and Preparedness Administration or HISPA. I am pleased to testify today on behalf of Mayor Mary Bowser in support

of the Health Care Facilities Regulation Amendment Act of twenty twenty six. We urge council to pass this legislation as it will increase patient safety, improve health system solvency and strengthen

enforcement and accountability for facilities serving Washingtonians across all eight wards. As the district's public health authority, DC Health uses a wide range of regulatory and health planning

tools to protect the health and safety of district residents. Through these functions, DC Health licenses and oversees health care facilities, monitors compliance with district and federal

requirements, investigates complaints and incidents, and takes action when facilities fail to meet established standards. DC Health currently licenses over one hundred and fifty health care facilities

and agencies, including hospitals, nursing homes, assisted living facilities and ambulatory surgical facilities. Additionally, DC Health is establishing a registration system for health care entities

not currently required to attain a license. These include doctor and dentist offices, telehealth providers and federally qualified health centers. DC Health regularly assesses its regulatory structure

and through that work, we identified three areas where additional statutory oversight or authority would strengthen our ability to oversee these facilities. One, greater visibility in the changes in

health care ownership and control. Two, stronger mechanisms to identify, understand and address patient safety events. And three, more flexible tools to respond to compliance and enforcement concerns.

Since identifying these areas, DC Health has explored how other jurisdictions have approached them and developed the following solutions. DC Health needs regulatory options that allow us to respond

appropriately when concerns involving financial solvency or impacts of financial consolidation on the quality of care are identified. Health care transactions and facility ownership increasingly

involve complex organizational and financial agreements that may negatively impact solvency or quality. Between 2010 and 2019, the value of private equity investments in health care increased from $42

billion to $120 billion, despite such investments being associated with cost and quality reductions. This bill works to address these concerns by updating the district's health planning framework and

clarifies what constitutes an acquisition of effective control or a material change. These updates accounts for arrangements involving mergers and acquisitions, private equity companies, health care

real estate investment trusts and other transactions that can meaningfully alter the operation or governance of a health care facility. By more clearly defining which transactions need to be reported,

DC Health can better assess changes in the health care landscape and their implications for health system viability. Additionally, to improve patient safety, the Health Care Facilities Regulation

Amendment Act of 2026 includes two major provisions improving patient safety reporting and accounting for emerging risks such as cybersecurity incidents. These proposed changes are grounded in what we

have heard from patients, families, counsel, health care professionals, and our other partners to improve the quality and consistency of patient safety reporting. The bill builds upon the Adverse

Event Reporting System established by the Medical Malpractice Amendment Act of 2006 and the requirements that all health care providers and medical facilities report qualifying adverse events. This

legislation further expands it to include cybersecurity events. Our health care systems globally, including here in DC, are tied to the remotely hosted and maintained electronic tools that contain

their electronic health records, interconnected information systems, and other technologies that support day-to-day operations. When those systems are compromised, the consequences can extend beyond

data security and interfere with the provider's ability to deliver care. Since 2009 there have been at least 33 health care breach filings reported by district entities affecting 685,611 individuals.

However, this is an incomplete picture as there may be entities that choose not to report to prevent public scrutiny. Bringing these events into the same system will give DC Health greater visibility

and insight into how disruptions occur that may have direct implications for patient care and continuity of operations. Lastly, effective oversight requires an adequate range of enforcement tools. A

regulatory framework that offers a continuum enforcement options allows for DC Health to intervene appropriately without treating every event type of non-compliance the same. Under the existing

framework, DC Health's enforcement options are limited when a violation warrants a stronger response than the available financial penalty, but does not ride to the level of suspending or revoking a

facility's license. In those circumstances, the available penalty may not be sufficient to encourage timely corrective action, while license suspension or revocation may be unnecessarily disruptive to

patients and access to care. Under the proposed framework, violations that place a patient, resident, or client at risk of serious injury, harm, impairment, or death may be subject to a fine of up to

$10,000 for each violation, with each day of continuing violation constituting a separate offense. This bill also removes the existing $100,000 aggregate limit for a series of related offenses. These

changes strengthen the district's financial penalty structure to provide more meaningful response when serious violations occur. Additionally, this bill ties DC Health's regulatory framework to

federal requirements promulgated by federal agencies such as the Center for Medicare and Medicaid Services, or CMS. This complements DC Health's existing authority to adopt and enforce best practice

standards by nationally recognized organizations such as the Joint Commission on Accreditation of Healthcare Organizations, better known as the Joint Commission. This ensures our enforcement framework

is up to date and reduces the risk that district requirements fall behind regulatory best practices. Taken together, this legislation creates a more comprehensive approach to healthcare oversight,

identifying serious events and understanding their causes, keeping standards current and responding appropriately when facilities fall short of those standards, and modernizing oversight to recognize

that the risks facing healthcare facilities are changing, whether through cybersecurity threats, evolving ownership structures, or other developments that were not contemplated when portions of our

existing framework were established. Most importantly, this proposal reflects that we have heard from our partners and we have learned through the work that we do as the district's healthcare facility

regulator. We share counsel's commitment to ensuring that residents receive safe, high-quality care, and this legislation represents a deliberate effort to strengthen the systems that support that

goal. Thank you for providing me with the opportunity to testify, and I'm available to respond to any questions the committee may have. All right, thank you, Director Hurley. So let's just jump right

in on some of these. Let's start with the adverse event reporting, which is a portion of this. The bill enhances DC Health's authority when an adverse event occurs in a medical facility. I talked a

little bit about this with Mr. Palmer from the hospital association about the broadening definition of adverse event. What are your thoughts about leaving or the suggestion of leaving the definition

of adverse events as it currently is, but just establishing a new standard for cybersecurity events? We would be open to having a conversation about what that would look like. We did try and create a

new definition of adverse event that aligned with what the National Quality Forum and the Joint Commission defined as an adverse event. So that's where we were going, is trying to align it with our

existing practice, but then adding the additional of a cybersecurity event into that, because we've seen from evidence, from literature, that cybersecurity events do result in adverse outcomes. Yes.

Have there been any cases that DC Health is aware of where you all felt that a facility should have informed you all, but that they pushed back suggesting that the incident did not fit into the

definition of adverse event? So nowhere in our current definitions would cybersecurity events be reported in that structure? Because as Mr. Palmer pointed out, it's bound to the 28 nationally

standardized and then the four additional ones that we have added from the district. And so we are clarifying that we want to add cybersecurity because it is a little bit different, per se. It's not a

care event. I'm trying to understand current situations. So if I am CEO of X Health Group and we're hacked, am I currently responsible for informing anyone? There are federal requirements, but I do

not get any information about them. So federally you are required to report under CISA if you were a health care facility over a certain size. But for the district, there is an unusual incident

requirement under Renata's shop in the Office of Health Care Facilities, but that is separate and apart from the adverse event reporting process. Okay, this is helpful. I mean, I'm remembering we have

another bill on cybersecurity in our committee, but it's about Disney Department of Insurance, Securities and Banking. And they had a situation where the current existing DC law did not require

companies to inform Disney when they had a cybersecurity event. And there was a situation where something took place and Marilyn told us, hey, FYI, y'all are involved in this, which is a bit

embarrassing that we have to hear secondhand from another state. So we already have a bill that is kind of moving and considering on that particular instance. And so, okay. There have been instances

in our health care system here in DC of cybersecurity attacks, but I can't, some of them were in 2024 before I was in this position. So I don't know what the time period is of us knowing about them,

but it is one of those things where making it abundantly clear that the expectation is to tell us. Okay, in the definition that's in the introduced bill, we use the word preventable that let's see,

here we go. Any preventable event occurrence or situation that results in the death or harm of an individual or in pairs and individuals ability to perform activities of daily living. How will DC help

determine if an event is preventable? So much of that is based off of the technical guidance that was published by the National Quality Forum and the Joint Commission. So we have adopted and hold

their technical guidance that has a whole formulary, essentially, of how you break down whether or not this was preventable or not preventable. Where there are steps that could have been put in place

that a reasonable expectation to have been put in place to avoid this. You know, not to go into DISB or insurance language, but, you know, we understand that there are acts of God per se, like some

things happen that you could, you couldn't predict. But at the same time, if, for instance, you had someone assaulted on your facility, but you didn't have any patient safety mechanisms in place to

protect people from being assaulted, you could have done something to prevent that assault. So that is the expectation. And there's a whole framework by which you evaluate that that we have adopted

from national standards instead of creating our own. Okay. Are you at all concerned? And this is more specifically on the cybersecurity piece. Are you at all concerned about receiving a high volume of

reports about small issues that might distract you from significant issues? I think the definition, as it's written, that it has to affect the provider's ability to conduct normal operations or

provide health services is trying to get at that. Like, we all receive phishing emails. I mean, I received one this morning. I don't expect them to send me an email or a notice about a phishing email.

But if there's a swatting attack where they had, you know, a million server pings, I would expect them to tell me about that, because if we have a swatting incidents that it's occurring at multiple

hospitals, we would want to know so that we can alert those hospitals. Yeah. Yeah. Okay. It's so sad that we have to think about the reality of this, but we're sort of, we're seeing this happening

even amongst utilities, right? People attacking utility companies about this particular information. Okay. The bill also requires that within 45 days of the adverse event or cybersecurity event, a

provider submit a root cause analysis and corrective action plans. Should this be required for all events or just significant events? So all events that we have on the serious adverse event, which are

the ones defined nationally and four additional ones we see as serious events. And so the expectation would be that there's a root cause analysis on all of those events. However, you know, there is

always an opportunity for us to have a conversation about it. But when we're talking about these are like one of them is you allow metal into an MRI space, which is highly dangerous. One of them is

you have a, you have a retained object after a surgical procedure. One of them is you have a sexual assault. So I would expect a corrective action plan for all of those. I think candidly what is

likely being referred to is there is a serious adverse event of bed source. So if you have a bed sore graded over at a stage three or four, which is four is the worst. Yeah. If you have a bed sore in

those grades or categories, that is a serious adverse event because there are mechanisms to prevent that and there are techniques to prevent that. And so I think that is probably the concern. And

that's our most commonly reported serious adverse event is bed source is bed source. And so what are we doing to prevent that? How are we minimizing the number of bedsores that are acquired in

facilities? I think it's important to continue pressing. No, you need to have a corrective action plan that you're implementing to reduce the incidence of bed source. Okay, the bill adds a definition

for health care provider that includes any health facility that needs to get a CON any facility under the health care and community residents facility hospital and home care licensure act and any

facility that is that has a licensed certified or registered health professional rendering services, which is different than we just did a bill, the medical debt mitigation bill that just became law

that has a definition of health care provider, which is defined as a person whose primary business is to provide medical services, products or devices, including a health care facility. I'm just

anticipating that the council general counsel is going to ask for us to streamline what you guys be open to that conversation for more consistency. Yeah, I believe we'd be open to the conversation. I

think looking at the section of law that this is amending the it lists out health provide health professionals. And that's what we're trying to do here is to make it future proof so that as we add

health professionals to the horror or we add health facility types, it doesn't mean that we have to go amend this section as well. Instead, it just says anything covered under these sections are

inclusive. Got it. Okay. The current law states that an adverse event reporting is confidential and is not subject to disclosure except if a court requires DC health to disclose it in a criminal

felony case. This bill as provisions that allows health professional licensing boards DC health and the mayor to review and use these documents to regulate health providers. What's the rationale for

this change. So the idea is that there are already requirements and expectations for health care facilities to notify the Office of Health facilities of the same event types right so, but there is no

mechanism by which we say, okay, we, the Office of Health facility received 10 complaints. We received 10 adverse event reports, are they the same. If there's a difference. I would want to know, did

the Office of Health facility receive all of these adverse events, because they should have. And so it's a, it's an ability for us to make sure that we have some accountability. And when we do have

this bridge and this connection now it, we believe it's going to open up the door for us to streamline reporting. So you can report into one system instead of having to report into two different

pathways right now. Okay, what about, I get the sharing within DC health. Yes, ma'am. Why do health licensing boards also need this information. So for instance, if there is there reportable events

about sexual assault and those types of things if there's a health care professional that is involved in that health care assault in that sexual assault. I would want to be able to refer them to the

appropriate board for them to take whatever action they need. So right now, let's say, Renata's team receives a complaint or an adverse event report, and it is an allegation of sexual assault, you're

saying DC health can't refer the provider to a health licensing board for discipline. I'm saying they're different. So Renata receives unusual incidents. We, this is serious adverse event reporting

they are completely separate parts of the statute. Interesting. And so that is the problem is that Renata receives essentially, she should receive pretty much the exact same thing, right. All of these

things should go to Renata as to the Office of Health facilities as well. In that process, she can refer to the Board of Medicine, she can do whatever she needs. However, in this process because of

the existing language and the structure that it has, it gives us very tight parameters in which we can release the information even internally. And so what we're trying to do is we're trying to say,

yes, you have to report it, but it isn't a mechanism by which you can avoid accountability for those items either. Okay. What about the Council? So there is requirements to report annually. There is

an annual report that comes out. I think that is the provision that we would report those annual occurrences. And so, you know, I certainly think that we can have that conversation of what that looks

like. But yeah, I mean, that's up to you. No, I mean, I could just foresee a situation. I mean, we could hypothetical all day long, right. But whereas EOM, the Executive Office of the Mayor within the

DC Health and the Mayor because that's specifically named here and the license before everybody knows that a situation has occurred. It's making its way into the public and yet the legislature has no

idea. That's the one thing I want to. Okay. So the current law authorizes financial penalties for failing to report an adverse event of not less than 500 and not more than 2500 per violation with

every day of the violation kept counting as a separate fence. How much revenue did DC Health collect from these fines? Which year? I can answer it for all the years, but zero dollars is for whichever

year you would like to ask the answer is zero dollars. Okay. Is that because we've had no reports, or we have just like everybody has been following the rules and they've been reporting accurately. A

lot of it is because we have had multiple transitions in the reporting system. And so we have tried to, we have we are transitioning. So we had a reporting system that was established shortly after

the establishment of the law. It cost approximately $162,000 a year. Great. We went to renew the contract and their estimate was 300 and almost $370,000 a year, it doubled, you know, doubled in price.

We obviously did not have 300 and think it was came to like $356,000. We did not have $356,000 budgeted for that. And so what we ended up having to do is go back to paper forms, which are exciting.

Exciting to extract data from and so what we did is we moved to paper forms. However, we have moved to a new electronic system which I, you know, was referenced by Mr. Palmer, as far as we've been

working collaboratively with our partners on the rollout of the system and the building of the system. And so we have published, there is a live electronic reporting system now that cost $0, just

wanted to put that out, $0, $0 that we have live now for receiving these adverse events. So we know that there has been a period of under reporting because of the, the nature of reporting has just

been complex. Okay, I told my staff the other day I was like, hey, government contracting. What do you mean you can just double the price of your software in a year. Hmm, lucrative, I guess. All

right, the bill requires healthcare providers to maintain active participation in a patient safety organization that meets nationally accepted patient stand patient safety standards. Is this currently

a standard practice for healthcare providers. So, I would say all of the health, all of the hospitals, acute care facilities are already part of patient safety organizations and many of the other

providers are also part of patient safety organizations. They're nationally identified and governed under federal statute as far as confidentiality and the provisions, but they also have expertise to

provide some quality assurance and quality improvement resources that we may not have that specific expertise, because they are patient safety organizations for, for each niche of the healthcare

industry so making sure that they are getting the best advice from the nationally, most from nationally recognized entities is the ideal, rather than DC health, being the one having to come up with

the advice and provide it, instead I would rather them get it from nationally recognized entities. Is there no other way for you all to have this particular requirement for facilities but for

legislation. Like why if you if you all felt strongly about this why wouldn't this be something that you implemented like two months ago. I think part of it is that most facilities already do it.

Okay, but codifying it so that that is the expectation standard, everyone knows. Okay, that's the that's the intention here. Couple more on adverse events. So the bill removes the cap of $100,000 for

financial penalties for violations of this act. What's the rationale for removing the cap. So the cap the $100,000 cap is that should there be multiple situations that involve multiple patients that

involve multiple preventable items right that we aren't limited at $100,000 penalty to address the severity of the severity of the issue. Okay, yes, ma'am. In the same vein, let me go back so the

financial pill and financial penalties for failure to report, not less than 500, not more than 2500 for violation was the last time that we've, I guess, calibrated this amount of money. I am not sure

to be kidding. I don't know that we have readdress this, this penalty. Okay. Yeah, I'm not sure that we've addressed this penalty. But I do think it's important to note that for most of the serious

adverse events failure to report it would likely result in some other penalties. Okay, for instance, if you failed to tell me that there was a sexual assault in your facility and the Office of Health

facilities came in and found that there were adverse findings. There's likely more penalties coming your way. So, is this, is this the penalty that we're really worried about, or is it the all of the

other things on the back end. Okay, we have had, we, the committee, the council, we've had lots of conversations with DC Health in the past year about, well, past few years about your received limited

authority to do some inspections and enforcement when there are patient quality and patient safety concerns at a facility. What immediately comes to mind is with regard to St. Elizabeth's Hospital.

And, you know, issues we've had at Cedar Hill issues we've had at the psychiatric Institute of Washington. How will this bill address some of the challenges we've had in those particular situations

where it wasn't about like, Oh, did they have, you know, a water source and enough syringes, but rather the actions of what we're taking place from a quality and patient safety perspective. I think it

addresses it in two ways. I think it addresses it in the reporting requirements of making sure that there's additional teeth for you to tell me about things that impact patient care and patient

safety. On the other side, I think that it also gives us more teeth when it comes to regulatory actions, the way our current language is written is it's based on actual harm versus the potential for

harm. And so currently the way it's written is someone has to actually get hurt. But if you have live wires dangling from the ceiling but no one got electrocuted, I still should be able to penalize

you for having the live wires hanging from the ceiling just because someone didn't get electrocuted is irrelevant. You still have the threat and the potential for danger. And so what this does is it

also clarifies that the potential for that serious adverse event, or pardon me I'm conflating things, the potential for that adverse event, or, you know, potential harm is what this does is it

clarifies our ability to regulate based on that potential versus just actual harm, which I think will address many of those issues because I don't have to wait to someone gets hurt before I can

actually do something. Okay, let's talk a little bit about the assisted living provisions. So, the bill authorizes DC health to issue a provisional license versus living residences, instead of an

unconditional 12 month license, how long is a provisional license supposed to last for. I'm going to phone a friend. Okay, why the friends are here. So provisional licenses are 90 days. Okay, so when

would an illicit assisted living residents move from provisional to full, is that within that 90 day period. So once you complete the application or is there, I guess, complete the application

inspection. So, come on, if you just introduce yourself for the record. Good morning Renata Cooper associate director for office of health facilities. So the provisional license period initially would

be 90 days, they would have the option of getting a second 90 day provisional license so there would be a first provisional second provisional. And then if they meet the licensure requirements, then

they would get the full license but the full license will be based off of the date of the initial provisional license so you don't get 12 months after that 120 right it's the 12 months after. So,

that's what exists currently for all other healthcare facilities so this isn't an effort to really bring assisted livings into alignment with what already exists, especially for those residential

facilities because this is the only provider type that we have that is actually a residential facility that does not have a provisional license period. Okay. Could there be any scenario where we gave

somebody a provisional that didn't graduate to a full. Possibly. Okay. Is that complicated by anything, I'm asking this because I think we just marked up a bill on Medicaid credentialing, where we had

proposed a provisional slash temporary license provider and got some pretty heavy pushback from healthcare finance to essentially say like, no, that's risky. In that case, I don't know, would there be

any risk here. I would say no, I think that without knowing the full context of the previous bill it likely is in addition to other programs that they have that there's was like, let's say I give you

a provisional license under Medicaid but then you don't get fully credentialed, then who's paying, because you've been seeing patients and providers and now Medicaid won't work. Right. So for us, most

of our ALRs, I mean, ALRs are not a federal provider type. So they are, you know, private pay, or if they enroll or apply and become an EPD waiver provider through healthcare finance, then they may

get reimbursement that way. But that's likely not the case. For us, the concern as to why we would like to implement this is because ALRs are taking a pretty high acuity of residents. And so what

we've seen over time is that some providers are, for lack of a better words, loading their facilities up in the very beginning phases. And once you get a full license, the only way you see me again

likely is based off of a complaint unless I'm coming to your annual licensure survey. You don't see that happen with provisionally licensed providers. Because although you are licensed, you're

licensed to operate, you know, we've done the pre-licensure inspection as far as from an environmental perspective and made sure that the structure is appropriate for individuals to live there and

safe or whatnot. But you're expecting to see us come back again to evaluate you for the provision of healthcare services. For assisted livings, that is not the same because they're not really

expecting to see us again until almost a year at their annual licensure period unless we receive a complaint. Okay. So on that, the current law states that an ALR shall be re-inspected within six

months of the initial licensure? Yes. Okay. Would that also apply for provisional license? Yes. Okay. The bill states that these provisional licenses shall have the same structure as those currently

allowed for community residential facilities and home care agencies, which only grants them for 90 days with one extension. Is that what you all had in mind for this as well? So that's the streamline?

Yes, to bring them in alignment. Okay. And then I got to ask the question that Mr. Ross raised from the Alzheimer's Association. The bill proposes that an assisted living administrator training be

decreased from 12 hours annually to four hours annually. You want to say more about why you guys are proposing this? So the premise behind that was to put in alignment with the requirements for direct

care workers, the ones who are actually providing hands-on care with those patients who may have dementia or Alzheimer's or some dementia-related condition. It's to make sure that it's consistent

across the board so that everyone in that shop has an expectation of four hours of continuing education annually. For those that are licensed, that puts it eight hours every two years. It's just

bringing consistency about it because they're the only folks that would have a 12-hour requirement and everyone else has four hours. I mean, what would you say, though, to the argument that as the

administrator, you have a different standard than someone who might be a direct care worker? My concern would be that the administrators are hopefully not providing as much direct care as the people

who are actually... working with the patients. And so, you know, I would much rather see the direct care workers, the ones who are actually involved caring for the patients. And if the expectation and

standard for them is four hours every year on top of their initial eight hour training, then that was our expectation is that that is the standard. So why are we creating a new standard for someone

who has less actual direct patient care and involvement with the patient? Okay. Let's talk a little bit about the corporate mergers and acquisitions, which I honestly thought we would have more public

witnesses talking about this from a spicy standpoint, but here we are. So the bill requires that any acquisition or purchase of a healthcare facility or material change to the operations or governance

of a healthcare facility now requires a certificate of need. What do you see as the benefit of requiring the certificate of need? So currently we have existing regulatory, our existing interpretation

of our regulatory authority requires that facilities go through this process as it stands. What we are doing is making it abundantly clear for all of the individuals participating in the certificate

of need process that this is the expectation. And so giving us greater clarity and insight into private equity and this type of transaction allows us insight for future action and future regulatory

stances. We have seen other jurisdictions, including other jurisdictions, including Pennsylvania and others that have taken significantly more action than we are taking in this bill, but I need the

data and information to actually take that action. And so making sure it's abundantly clear, the expectation is that when you have any of these types of transactions that you are coming to our

certificate of need program in SHFTA, that's what we're trying to clearly communicate with the regulated community here. Do you have any estimate or idea of how many of these types of transactions are

currently occurring in the district? I mean, obviously we hear about what's happening in sort of national spaces and for those who might not be familiar, right? There's a lot of private equity that

our purchasing providers are purchasing health facilities. I think probably the more flashier of notice was when Amazon purchased one medical, like how often is this occurring? Oh, you're counting, my

bad. You're fine. So since 2025, SHFTA has reviewed over 20, at least 20 transactions that have included for-profit entities, transitioning nonprofit to for-profit, et cetera. And so it is one of

those things where making sure that we are abundantly clear to the regulated community that when you are having these types of transactions, we need to know about it so that we have a better

understanding of the incidents within the districts. So this requirement in the bill would only apply to healthcare facilities that need a CON in order to operate. Is there any benefit to increasing

DC health oversight over the acquisitions and transfers for more types of healthcare facilities, including ones that don't require a CON? I think the question would be around structure, right? And so

currently we don't have that regulatory infrastructure to oversee facilities that are not covered by the CON. Okay. And so I think the question would be what kind of regulatory infrastructure would

that look like? And so that would be an expansion of our regulatory authority and our regulatory infrastructure. Yeah. I mean, I think though there's a public interest there if you have a health

provider facility that made a considerable amount or established themselves using a lot of public resources to then switch to a for-profit entity. I think that there is a, it's in the public interest

to kind of understand how much they're walking away with or not in that regard. Okay. The bill adds a definition for healthcare real estate investment trust. Are these types of entities already

operating in the district? That is definitely a phone the friend. Okay. Good morning. I'm Terri Thompson. I'm the director for the state health planning and development agency. So yes, there are real

estate investment trusts that are operating in the district of Columbia. The Shipta currently has authority to review changes and leases. Part of the challenge is identifying those entities that are

not coming to us with that information. Interesting. How would you know about it otherwise? Is it you all usually just sort of stumbling upon it or somebody reporting it? Washington's very small. And

so we, there's very little that we don't learn about over time. Okay. But sometimes it's when the transaction is at closing or just closed and then we're going back and having to do reviews to make

sure. So part of the challenge is the fees that get built into the leases and making sure that the entity is not going to wind up getting swallowed out by the fees that they have to pay in order to be

in the facility. Yeah. Okay. How do you currently track them at this point? So I guess it would be if only they, they come to you. So the good part is we have a small bar association in the district

of Columbia. Yeah. So many of the individuals have been doing this for a long time. So they know. So they know what they're supposed to do. We're now having individuals retiring and having new

attorneys coming in. And so it's a matter of trying to make sure that the new attorneys are very clear that SHPDA takes its responsibilities very strongly and that we do have finding authority and

that if they skip us, it'll create issues for the other side. Okay. How do you all envision DC Health working with the Office of the Attorney General to implement and enforce the new requirements? So

the SHPDA already works with the Attorney General's office, particularly on conversions. And there have been limited instances where we've had concerns about antitrust. And so we have the authority in

our statute to make a referral on conversions. Obviously it's a mandatory requirement for us to refer conversions, but it's, it's conversions that have come into our sphere. Yeah. Right. So then let

me go back to the previous question that I had asked Sam, which is, should this be broader than just the facilities who require a COA? Am I supposed to be the friend that's been phoned? Is that Sam's

answer? I think it goes back to the regulatory infrastructure. Okay. How would we do that? It isn't impossible, but it's a question that if we were to expand it beyond that, who does that? Right?

Okay. The bill proposes to remove the clean hands provision to require, to renew your certificate of need for healthcare facilities. Now, you guys know there was it for your license, not for the, for

license renewal. Yes. Not for certificate of need. Wait, say that again. It should, the bill is intended to remove the clean hands requirement for renewal of your healthcare facility license. Okay. I

don't think we interpreted it that way, but all right. So why? And I asked this cause like, I think we had, we, we have a live issue now of, um, a health facility who does not have clean hands, um,

where it's a concern about whether or not they should be renewed. Yeah. So they owe us a lot of money to be clear. I'm going to not open that can of worms, but I will go into the, so the provision

remains for entities coming in, getting initial licensure. You must present with a clean hands. Yes. The idea is exclusively for renewal is that DC health, rather than regulating your financial

situation and relationship with the district, with the district, you are part of the district. True. True. But instead of regulating that, why are we not focusing on the health component of it?

Because what happens is if I can't issue you a license, for instance, say you have a 150 patient facility, theoretically, theoretically that doesn't have a clean hands and I can't issue you a license.

So where am I going to put those 150 patients when their license runs out? What happens? Because that's, that is part of the problem is that if, if OTR or other entities want to garnish revenue and do

those types of things, there are a variety of mechanisms that DC government can take to retain to recapture revenue and to do those things. Taking us out of that mix of it, we are worried about the

patient care that you're providing at your facility. We have, DC government has mechanisms by which we can recover funds and we are worried about if we get into this business, I'm going to be the one

that has to close a healthcare facility because you didn't pay a bill to whomever district agency. And while that is problematic, is that the Department of Health's role? And that's the question. If

you, if council doesn't agree with that, that is what it is. But we have seen multiple situations where we have had healthcare facilities that had, that were unable to obtain a clean hands in time.

And so we ended up getting in this weird scenario where we were having to figure out, are we closing this facility next week? I hear you on that. But I also feel like if a facility is unable to obtain

a clean hands, that suggests something about the finances of said facility, which also might suggest something about the quality of patient care at said facility as well. It has the potential, but

correlation and causation are two different things. Okay. So we have to, we have to make sure that if I go in and I don't find clinical abnormalities or I don't find quality of care or abnormalities,

is that the mechanism by which we shut someone down as through whether or not you comply with clean hands. And I think that was our rationale is that, okay, are we that person? Luckily you get to

write the laws. What's that? Luckily you get to write the law. I understand that, but like this is kind of complicated because you guys are, obviously you're the agency that's here before us. I'm sure

the office of the chief financial officer, OTR in particular has a particular view of this. I would imagine that healthcare finance would have a particular view of this as well. Was this workshopped

amongst all of your friends? This did go through the process that we have through the executive branch. All right. Well, I, I want to explain for the public too, like in these cases and the

hypothetical scenarios that we're talking about, I'm not talking about, Oh, so-and-so didn't pay a parking ticket. It's usually significant over a thousand dollars, over a thousand dollar, um,

situations that we're talking about here. Um, okay. Is there anything else about the bill that you wanted to say for the record that I haven't asked you? We'll probably have some, well, we will have

some follow up conversations and obviously we'll have some more, um, talks with friends amongst the government about some of these, um, various pieces there as well. Um, but I don't have any further

questions on this bill. So thank you so much. Um, we're going to take like a five minute break and then we'll come back and we'll do the, um, health benefit exchange. So, five minutes.