Healthcare facilities reporting overhaul

Summary#

B26-0799, the HealthCare Facilities Regulation Amendment Act of 2026, would amend several existing District laws. It would add an adverse-event reporting title to the Medical Malpractice Amendment Act of 2006 and change laws on health-facility licensing, assisted living, health-service planning and license renewals. Its stated goals include patient safety, stronger oversight and more transparency; those are goals, not guaranteed results. The bill is introduced and is not law.

  • Healthcare providers would have to report defined adverse events and cybersecurity events to the Department of Health (DOH), then submit an analysis and a plan to prevent similar events.
  • DOH would have to maintain a central system for collecting and analyzing those reports. Providers would also have to take part in a recognized patient safety organization and prove participation each year.
  • The bill would expand which changes in a health-care facility’s ownership, control or operations trigger the existing certificate-of-need process, including certain transactions involving private equity and management-services entities.
  • It would set federal standards as minimum operating standards in specified cases, allow periodic license-fee adjustments for inflation, and add fines for violations that put patients, residents or clients at risk.
  • It would allow provisional licenses under the licensing law, change assisted-living training and food-rule references, and exempt some license renewals from a Clean Hands requirement.

What it means for you#

  • Patients and the public: DOH may publish event counts and categories, but not personally identifiable patient information. Reports and related documents would generally be confidential and protected from use in legal proceedings, with exceptions for regulation and limited court-ordered disclosure in certain felony cases.
  • Health-care providers: Providers covered by the bill would have to report an adverse event or cybersecurity event within 48 hours of its start or within 48 hours of becoming aware of it, whichever is later. Within 45 days after reporting, they must submit a root-cause analysis and a corrective-action plan, including responsible parties and timelines. DOH may require more information.
  • Health-care providers: They would also have to maintain active participation in a qualifying patient safety organization and submit annual proof. Failing to provide required reports or documents could bring fines of $500 to $2,500; each day of a violation counts separately.
  • Health facilities and owners: More ownership and operational transactions could fall under the existing certificate-of-need process. The bill does not itself ban private-equity ownership.
  • Assisted-living facilities and workers: The bill would permit provisional licenses under the licensing law and replace specific dementia-training language with a cross-reference to District in-service training requirements. It does not say whether those requirements include the same dementia training.
  • Current law: The parent laws were not supplied, so the exact baseline and how these changes fit with existing rules could not be fully checked.

Money#

The fiscal estimate is $155,000 in fiscal year 2027 and $642,423 over fiscal years 2027–2030; the CFO says current proposed budgets do not have enough funds to implement the bill.

  • DOH would need one Nurse Specialist for inspection and investigative work related to adverse-event reporting.
  • The bill says adverse-event reporting would be funded through Board of Medicine license fees. It also allows periodic license-fee adjustments for inflation, but does not set new fee amounts.
  • The CFO says DOH can carry out the other provisions with existing resources.

What is unclear#

  • The bill leaves key terms such as “preventable” and “major intervention” to broad definitions; the Mayor may also set rules for reporting.
  • It does not specify the reporting form, detailed procedures, review timelines or appeals. The Mayor may issue implementation rules.
  • The bill’s text does not explain the criteria or process for provisional licenses.
  • The expanded certificate-of-need triggers could cover a range of transactions, but the supplied text does not establish how long review takes or how decisions are made.
  • The fiscal estimate identifies a funding gap, but the materials do not explain how it would be addressed. The bill’s fee-funding direction and the CFO’s finding that funds are insufficient are not reconciled.

Case for#

  • The bill appears intended to help DOH identify patterns in patient harm and cybersecurity problems, rather than receive only isolated reports.
  • Requiring providers to identify causes and set out corrective steps could support prevention of repeat events.
  • Reporting cybersecurity events recognizes that failures affecting records or normal operations can also affect care.
  • Broader transaction review and ownership disclosure could give regulators more information about changes that may affect facility operations.
  • Using federal minimum standards when District rules fall below them could reduce the risk of operating standards becoming outdated.

Case against#

  • Providers face a short reporting deadline and follow-up paperwork, while the bill leaves some reporting details to DOH rules. The scope of covered providers and events may be broad.
  • The bill protects reports from most legal discovery and use in proceedings. That may support candid reporting, but can limit access to information for patients or others seeking evidence.
  • The new risk-based fines can apply separately for each day of a violation, and the bill does not provide a total cap for those fines.
  • More transactions may enter the certificate-of-need process, but the supplied text does not explain review timelines or how the expanded triggers will work in practice.
  • The CFO identifies a funding shortfall, so implementation depends on finding resources or using the specified license-fee funding.