ENROLLED ORIGINAL
1
A RESOLUTION
25-199
IN THE COUNCIL OF THE DISTRICT OF COLUMBIA
July 11, 2023
To declare the existence of an emergency with respect to the need to approve Contract No.
DCHBX-E-2023-0002 with Norton Rose Fulbright, LLC, in the not-to-exceed amount of
$2.6 million, and to authorize payment for goods and services received and to be received
under the contract.
RESOLVED, BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this
resolution may be cited as “Contract No. DCHBX-E-2023-0002 with Norton Rose Fulbright,
LLC Approval and Payment Authorization Emergency Declaration Resolution of 2023”.
Sec. 2 (a) There exists an immediate need to approve Contract No. DCHBX-E-2023-0002
for representation and litigation services between the District of Columbia Health Benefit
Exchange Authority (“DCHBX”) and Norton Rose Fulbright, LLC (“Norton Rose”), in the not-
to-exceed amount of $2.6 million and to authorize payment for goods and services received and
to be received under the contract.
(b) On March 6, 2023, DCHBX received notice that data for some DC Health Link
customers had been published on a data breach forum. DCHBX immediately launched a
comprehensive investigation, began working with law enforcement, and engaged a third-party
expert forensics firm to investigate.
(c) Norton Rose has a practice that focuses on complex cybersecurity attacks and data
breach investigations, involving sophisticated threat actor groups and advanced persistent threats
focused on critical infrastructure entities. To date, DCHBX is aware of 5 putative class action
complaints that have been filed arising out of the data breach.
(d) Because there was a need to mitigate the risk of harm to consumers as quickly as
possible, including providing notice to affected individuals immediately, conducting a
comprehensive review of the DCHBX information technology systems and processes, and
litigation ensued within 10 days of the incident, it was necessary to acquire expert legal services
without delay and there was insufficient time to submit the contract to the Council in advance.
(e) Council approval of the contract is required pursuant to section 451 of the District of
Columbia Home Rule Act, approved December 24, 1973 (87 Stat. 803; D.C. Official Code § 1-
204.51). Council approval is necessary to continue receiving these critical services.
ENROLLED ORIGINAL
2
Sec. 3. The Council determines that the circumstances enumerated in section 2 constitute
emergency circumstances making it necessary that the Contract No. DCHBX-E-2023-0002 with
Norton Rose Fulbright, LLC Approval and Payment Authorization Emergency Act of 2023 be
adopted after a single reading.
Sec. 4. This resolution shall take effect immediately.