MURIEL BOWSER
MAYOR
July 5, 2023
Honorable Phil Mendelson
Chairman
Council
of the District of Columbia
John
A. Wilson Building
1350 Pennsylvania Avenue, NW, Suite 504
Washington, DC 20004
Dear Chairman Mendelson:
Enclosed for consideration and enactment by the Council
of the District of Columbia is an
emergency bill, the "Contract No. DCHBX-E-2023-0002 with Norton Rose Fulbright, LLC
Approval and Payment Authorization Emergency Act of2023," and the accompanying emergency
declaration resolution.
The legislation
will approve Contract No. DCHBX-E-2023-0001 between Norton Rose Fulbright,
LLC, and the District
of Columbia Health Benefit Exchange Authority, to provide legal
representation by outside counsel specializing in cybersecurity and privacy compliance, with a
focus on complex cybersecurity attacks and data breach investigations. In addition, the legislation
will approve payment for services received and to be received under the contract.
My administration is available to discuss any questions you may have regarding this legislation.
In order to facilitate a response to any questions you may have, please have your staff contact
Kenneth Wallington, Contracting Officer, DC Health Benefit Exchange Authority, at (202) 679-
5952.
I urge the Council to take prompt and favorable action on the enclosed legislation. 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
~~
Chairman Phil Mendelson
at the request of the Mayor
A PROPOSED RESOLUTION
IN THE COUNCIL OF THE DISTRICT OF COLUMBIA
To declare the existence of an emergency with respect to the need to approve Contract
No. DCHBX-E-2023-0002 with Norton Rose Fulbright, LLC, in the not-to
exceed amount of $2.6 million, and to authorize payment for goods and services
received
and to be received under the contract.
RESOLVED, BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That
this resolution may be cited as "Contract No. DCHBX-E-2023-0002 with Norton Rose
Fulbright, LLC Approval and Payment Authorization Emergency Declaration Resolution
of 2023".
Sec. 2 (a) There exists an immediate need to approve Contract No. DCHBX-E-
2023-0002 for representation and litigation services between the District of Columbia
Health Benefit Exchange Authority ("DCHBX") and Norton Rose Fulbright, LLC
("Norton Rose"), in the not-to-exceed amount of $2.6 million, and to authorize payment
for goods and services received and to be received under the contract.
(b)
On March 6, 2023, DCHBX received notice that data for some DC Health
Link customers had been published on a data breach forum. DCHBX immediately
launched a comprehensive investigation, began working with law enforcement, and
engaged a third-party expert forensics firm to investigate.
1 33 (c) Norton Rose has a practice that focuses on complex cybersecurity attacks and
34 data breach investigations, involving sophisticated threat actor groups and advanced
35 persistent threats focused
on critical infrastructure entities. To date, DCHBX is aware of
36 5 putative class action complaints that have been filed arising out of the data breach.
3 7 ( d) Because there was a need to mitigate the risk
of harm to consumers as quickly
38
as possible, including providing notice to affected individuals immediately, conducting a
39 comprehensive review
of the HBX information technology systems and processes, and
40 litigation ensued within
10 days of the incident, it was necessary to acquire expert legal
41 services without delay and there was insufficient time to submit the contract to the
42 Council in advance.
43 ( e) Council approval
of the contract is required pursuant to section 451 of the
44 District of Columbia Home Rule Act, approved December 24, 1973 (87 Stat. 803; D.C.
45 Official Code § 1-204.51 ), and section 202
of the Procurement Practices Reform Act of
46 2010, effective April 8, 2011 (D.C. Law 18-371; D.C. Official Code§ 2-352.02), and
4 7 Council approval is necessary to continue receiving these critical services.
48 Sec.
3. The Council determines that the circumstances enumerated in section 2
49 constitute emergency circumstances making it necessary that the Contract No.
DCHBX-
50 E-2023-0002 with Norton Rose Fulbright, LLC Approval and Payment Authorization
51 Emergency Act of 2023 be adopted after a single reading.
52 Sec. 4. This resolution shall take effect immediately.
2