Policy documents and bill actions

Detail checked 2026-10-12T09:21:44.661162+00:00.

• 2025-10-08: Introduced in Office of the Secretary
• 2025-10-17: Notice of Intent to Act on B26-0427 Published in the DC Register
• 2025-10-21: Referred to Committee on Business and Economic Development
• 2026-02-27: Referred to Committee on Health
• 2026-03-03: Referred to Committee on Health
• 2026-05-04: Notice of Public Hearing Published in the DC Register
• 2026-05-08: Notice of Public Hearing Published in the DC Register
• 2026-06-02: Notice of Public Hearing Published in the DC Register
• 2026-06-05: Notice of Public Hearing Published in the DC Register
• 2026-06-15: Public Hearing Held
• 2026-07-08: Committee Mark-up of B26-0427
• 2026-07-14: First Reading, CC
• 2026-09-22: Postponed to 10/6/26 Legislative Meeting
• 2026-10-06: Amendment (Mendelson)
• 2026-10-06: Final Reading

• 2025-10-08 Introduced: Official bill text
• 2026-07-14 Engrossed: Official bill text

Observed 2026-10-04T00:40:57.725502+00:00.

ENGROSSED ORIGINAL



1

A BILL 1
2
26-427 3
4
5
IN THE COUNIL OF THE DISTRICT OF COLUMBIA 6
7
________________________ 8
9
10
To require that insurance licensees establish standards for data security, investigating 11
cybersecurity events, and notifying the Commissioner of the Department of Insurance, 12
Securities and Banking of cybersecurity events; and to amend the Freedom of 13
Information Act of 1976 to make a conforming change. 14
15
BE IT ENACTED BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this 16
act may be cited as the “Cybersecurity and Accountability Amendment Act of 2026”. 17
TITLE I. CYBERSECURITY AND ACCOUNTABILITY REQUIREMENTS. 18
Sec. 101. Short title. 19
This title may be known as the “Cybersecurity and Accountability Act of 2026”. 20
Sec. 102. Definitions. 21
For the purposes of this title, the term: 22
(1) “Authorized individual” means an individual known to, and screened by, the 23
licensee, and to whom the licensee has determined access to the nonpublic information held 24
by the licensee and its information systems is necessary and appropriate. 25
(2) “Commissioner” means the Commissioner of the Department of Insurance, 26
Securities, and Banking. 27

ENGROSSED ORIGINAL



2

(3) “Consumer” means a person, including an applicant, policyholder, insured, 28
beneficiary, claimant, or certificate holder who is a resident of the District and whose nonpublic 29
information is in a licensee’s possession, custody, or control. 30
(4) “Cybersecurity event” means an event resulting in unauthorized access to, or 31
disruption or misuse of, an information system or nonpublic information stored on the 32
information system but does not include: 33
(A) The unauthorized acquisition of encrypted nonpublic information if 34
the encryption, process, or key is not also acquired, released, or used without authorization; or 35
(B) An event where the licensee has determined that the nonpublic 36
information accessed by an unauthorized person has not been used or released and has been 37
returned or destroyed. 38
(5) “Department” means the Department of Insurance, Securities, and Banking. 39
(6) “Encrypted” means the transformation of data into a form which results in a 40
low probability of assigning meaning to the data without the use of a protective process or key. 41
(7) “Information security program” means the administrative, technical, and 42
physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, 43
transmit, dispose of, or otherwise handle nonpublic information. 44
(8) “Information system” means a discrete set of electronic information resources 45
organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition 46
of electronic information, as well as any specialized system, such as an industrial or process 47

ENGROSSED ORIGINAL



3

controls system, telephone switching and private branch exchange system, or environmental 48
control system. 49
(9) “Licensee” means any person licensed, authorized to operate, or registered, or 50
required to be licensed, authorized, or registered by the Department, as an insurance producer or 51
insurer, as those terms are defined under section 2(6) and (7) of the Producer Licensing Act of 52
2002, effective March 27, 2003 (D.C. Law 14-264; D.C. Official Code § 31-1131.02(6) and (7)); 53
except, that the term “licensee” shall not include a purchasing or a risk retention group chartered 54
and licensed in a jurisdiction other than the District or a person acting as an assuming insurer that 55
is domiciled in another state or jurisdiction. 56
(10) “Multi-factor authentication” means authentication through verification of at 57
least 2 of the following types of authentication factors: 58
(A) Knowledge factors, such as a password; 59
(B) Possession factors, such as a token or text message on a mobile phone; 60
or 61
(C) Inherence factors, such as a biometric characteristic. 62
(11) “Nonpublic information” means information that is not publicly available 63
information and is: 64
(A) Business-related information of a licensee, the tampering with, or 65
unauthorized disclosure, access, or use of which, would cause a material adverse impact to the 66
business, operations, or security of the licensee; 67

ENGROSSED ORIGINAL



4

(B) Any information concerning a consumer that, because of name, 68
number, personal mark, or other identifier, can be used to identify the consumer, in combination 69
with at least one of the following data elements: 70
(i) Social Security number; 71
(ii) Driver’s license number or non-driver identification card 72
number; 73
(iii) Bank account number or credit or debit card number; 74
(iv) Any security code, access code, or password that would permit 75
access to a consumer’s financial account; or 76
(v) Biometric records; or 77
(C) Any information or data, except age or gender, in any form or medium 78
created by, or derived from, a health care provider or a consumer and that relates to the: 79
(i) Past, present, or future physical, mental, or behavioral health or 80
condition of a consumer or a member of the consumer’s family; 81
(ii) Provision of health care to a consumer; or 82
(iii) Payment for the provision of health care to a consumer. 83
(12)(A) “Publicly available information” means any information that a licensee 84
has a reasonable basis to believe is lawfully made available to the general public from: 85
(i) Federal, state, or local government records; 86
(ii) Widely distributed media; or 87

ENGROSSED ORIGINAL



5

(iii) Disclosures to the general public that are required to be made 88
by federal, state, or local law. 89
(B) For purposes of this paragraph, a licensee has a reasonable basis to 90
believe that information is lawfully made available to the general public if the licensee has taken 91
steps to determine: 92
(i) That the information is of the type that is available to the 93
general public; and 94
(ii) Whether a consumer can direct that the information not be 95
made available to the general public and, if so, that the consumer has chosen not to do so. 96
(13) “Risk assessment” means the assessment that a licensee is required to 97
conduct under section 103(b). 98
(14) “Third-Party service provider” means a person that is not a licensee and that 99
contracts with a licensee to maintain, process, or store nonpublic information, or otherwise is 100
permitted access to nonpublic information through its provision of services to the licensee. 101
Sec. 103. Information security program. 102
(a) Each licensee shall develop, implement, and maintain a comprehensive written 103
information security program based on the licensee’s risk assessment, which shall include 104
administrative, technical, and physical safeguards for the protection of nonpublic information 105
and the licensee’s information system. The information security program shall: 106

ENGROSSED ORIGINAL



6

(1) Be designed to protect the security and confidentiality of nonpublic 107
information and the security of the information system; 108
(2) Be designed to protect against any threats or hazards to the security or 109
integrity of nonpublic information and the information system; 110
(3) Be designed to protect against unauthorized access to, or use of, nonpublic 111
information, and minimize the likelihood of harm to any consumer; and 112
(4) Define and periodically reevaluate a schedule for the retention of nonpublic 113
information and a mechanism for its destruction when no longer needed. 114
(b) The licensee shall conduct a risk assessment as part of its obligations to establish an 115
information security system, which shall: 116
(…

Oct. 12, 2026, 9:22 a.m.: date, status, change_hash, history changed since Oct. 5, 2026, 9:21 a.m..

{'date': '2026-09-22', 'status': 'Postponed to 10/6/26 Legislative Meeting', 'history': [{'date': '2025-10-08', 'action': 'Introduced in Office of the Secretary', 'chamber': 'C', 'importance': 1}, {'date': '2025-10-17', 'action': 'Notice of Intent to Act on B26-0427 Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2025-10-21', 'action': 'Referred to Committee on Business and Economic Development', 'chamber': 'C', 'importance': 1}, {'date': '2026-02-27', 'action': 'Referred to Committee on Health', 'chamber': 'C', 'importance': 1}, {'date': '2026-03-03', 'action': 'Referred to Committee on Health', 'chamber': 'C', 'importance': 1}, {'date': '2026-05-04', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-05-08', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-02', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-05', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-15', 'action': 'Public Hearing Held', 'chamber': 'C', 'importance': 0}, {'date': '2026-07-08', 'action': 'Committee Mark-up of B26-0427', 'chamber': 'C', 'importance': 0}, {'date': '2026-07-14', 'action': 'First Reading, CC', 'chamber': 'C', 'importance': 1}, {'date': '2026-09-22', 'action': 'Postponed to 10/6/26 Legislative Meeting', 'chamber': 'C', 'importance': 0}], 'change_hash': '200b6f3006ac01739c6d0dcfa505e805'}

{'date': '2026-10-06', 'status': 'Final Reading', 'history': [{'date': '2025-10-08', 'action': 'Introduced in Office of the Secretary', 'chamber': 'C', 'importance': 1}, {'date': '2025-10-17', 'action': 'Notice of Intent to Act on B26-0427 Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2025-10-21', 'action': 'Referred to Committee on Business and Economic Development', 'chamber': 'C', 'importance': 1}, {'date': '2026-02-27', 'action': 'Referred to Committee on Health', 'chamber': 'C', 'importance': 1}, {'date': '2026-03-03', 'action': 'Referred to Committee on Health', 'chamber': 'C', 'importance': 1}, {'date': '2026-05-04', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-05-08', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-02', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-05', 'action': 'Notice of Public Hearing Published in the DC Register', 'chamber': 'C', 'importance': 0}, {'date': '2026-06-15', 'action': 'Public Hearing Held', 'chamber': 'C', 'importance': 0}, {'date': '2026-07-08', 'action': 'Committee Mark-up of B26-0427', 'chamber': 'C', 'importance': 0}, {'date': '2026-07-14', 'action': 'First Reading, CC', 'chamber': 'C', 'importance': 1}, {'date': '2026-09-22', 'action': 'Postponed to 10/6/26 Legislative Meeting', 'chamber': 'C', 'importance': 0}, {'date': '2026-10-06', 'action': 'Amendment (Mendelson)', 'chamber': 'C', 'importance': 0}, {'date': '2026-10-06', 'action': 'Final Reading', 'chamber': 'C', 'importance': 0}], 'change_hash': '3d0a0a294711c0c96efa44a9045ffb40'}

Oct. 4, 2026, 12:40 a.m.: selected_text changed since Oct. 4, 2026, 12:36 a.m..

{'selected_text': None}

{'selected_text': {'text': 'ENGROSSED ORIGINAL \n \n \n \n1 \n \nA BILL 1 \n 2 \n26-427 3 \n 4 \n 5 \nIN THE COUNIL OF THE DISTRICT OF COLUMBIA 6 \n 7 \n________________________ 8 \n 9 \n 10 \nTo require that insurance licensees establish standards for data security, investigating 11 \ncybersecurity events, and notifying the Commissioner of the Department of Insurance, 12 \nSecurities and Banking of cybersecurity events; and to amend the Freedom of 13 \nInformation Act of 1976 to make a conforming change. 14 \n 15 \n BE IT ENACTED BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this 16 \nact may be cited as the “Cybersecurity and Accountability Amendment Act of 2026”.  17 \n TITLE I. CYBERSECURITY AND ACCOUNTABILITY REQUIREMENTS. 18 \n Sec. 101. Short title. 19 \n This title may be known as the “Cybersecurity and Accountability Act of 2026”.  20 \n Sec. 102. Definitions. 21 \nFor the purposes of this title, the term: 22 \n (1) “Authorized individual” means an individual known to, and screened by, the 23 \nlicensee, and to whom the licensee has determined access to the nonpublic information held 24 \nby the licensee and its information systems is necessary and appropriate. 25 \n  (2) “Commissioner” means the Commissioner of the Department of Insurance, 26 \nSecurities, and Banking. 27 \n\nENGROSSED ORIGINAL \n \n \n \n2 \n \n  (3) “Consumer” means a person, including an applicant, policyholder, insured, 28 \nbeneficiary, claimant, or certificate holder who is a resident of the District and whose nonpublic 29 \ninformation is in a licensee’s possession, custody, or control.  30 \n  (4) “Cybersecurity event” means an event resulting in unauthorized access to, or 31 \ndisruption or misuse of, an information system or nonpublic information stored on the 32 \ninformation system but does not include: 33 \n   (A) The unauthorized acquisition of encrypted nonpublic information if 34 \nthe encryption, process, or key is not also acquired, released, or used without authorization; or 35 \n   (B) An event where the licensee has determined that the nonpublic 36 \ninformation accessed by an unauthorized person has not been used or released and has been 37 \nreturned or destroyed. 38 \n  (5) “Department” means the Department of Insurance, Securities, and Banking. 39 \n  (6) “Encrypted” means the transformation of data into a form which results in a 40 \nlow probability of assigning meaning to the data without the use of a protective process or key. 41 \n  (7) “Information security program” means the administrative, technical, and 42 \nphysical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, 43 \ntransmit, dispose of, or otherwise handle nonpublic information. 44 \n  (8) “Information system” means a discrete set of electronic information resources 45 \norganized for the collection, processing, maintenance, use, sharing, dissemination, or disposition 46 \nof electronic information, as well as any specialized system, such as an industrial or process 47 \n\nENGROSSED ORIGINAL \n \n \n \n3 \n \ncontrols system, telephone switching and private branch exchange system, or environmental 48 \ncontrol system. 49 \n  (9) “Licensee” means any person licensed, authorized to operate, or registered, or 50 \nrequired to be licensed, authorized, or registered by the Department, as an insurance producer or 51 \ninsurer, as those terms are defined under section 2(6) and (7) of the Producer Licensing Act of 52 \n2002, effective March 27, 2003 (D.C. Law 14-264; D.C. Official Code § 31-1131.02(6) and (7)); 53 \nexcept, that the term “licensee” shall not include a purchasing or a risk retention group chartered 54 \nand licensed in a jurisdiction other than the District or a person acting as an assuming insurer that 55 \nis domiciled in another state or jurisdiction. 56 \n  (10) “Multi-factor authentication” means authentication through verification of at 57 \nleast 2 of the following types of authentication factors: 58 \n   (A) Knowledge factors, such as a password; 59 \n   (B) Possession factors, such as a token or text message on a mobile phone; 60 \nor 61 \n   (C) Inherence factors, such as a biometric characteristic. 62 \n  (11) “Nonpublic information” means information that is not publicly available 63 \ninformation and is: 64 \n   (A) Business-related information of a licensee, the tampering with, or 65 \nunauthorized disclosure, access, or use of which, would cause a material adverse impact to the 66 \nbusiness, operations, or security of the licensee; 67 \n\nENGROSSED ORIGINAL \n \n \n \n4 \n \n   (B) Any information concerning a consumer that, because of name, 68 \nnumber, personal mark, or other identifier, can be used to identify the consumer, in combination 69 \nwith at least one of the following data elements: 70 \n    (i) Social Security number; 71 \n    (ii) Driver’s license number or non-driver identification card 72 \nnumber; 73 \n    (iii) Bank account number or credit or debit card number; 74 \n    (iv) Any security code, access code, or password that would permit 75 \naccess to a consumer’s financial account; or 76 \n    (v) Biometric records; or 77 \n   (C) Any information or data, except age or gender, in any form or medium 78 \ncreated by, or derived from, a health care provider or a consumer and that relates to the: 79 \n    (i) Past, present, or future physical, mental, or behavioral health or 80 \ncondition of a consumer or a member of the consumer’s family; 81 \n    (ii) Provision of health care to a consumer; or 82 \n    (iii) Payment for the provision of health care to a consumer. 83 \n  (12)(A) “Publicly available information” means any information that a licensee 84 \nhas a reasonable basis to believe is lawfully made available to the general public from: 85 \n    (i) Federal, state, or local government records; 86 \n    (ii) Widely distributed media; or 87 \n\nENGROSSED ORIGINAL \n \n \n \n5 \n \n    (iii) Disclosures to the general public that are required to be made 88 \nby federal, state, or local law. 89 \n   (B) For purposes of this paragraph, a licensee has a reasonable basis to 90 \nbelieve that information is lawfully made available to the general public if the licensee has taken 91 \nsteps to determine: 92 \n    (i) That the information is of the type that is available to the 93 \ngeneral public; and 94 \n    (ii) Whether a consumer can direct that the information not be 95 \nmade available to the general public and, if so, that the consumer has chosen not to do so.  96 \n  (13) “Risk assessment” means the assessment that a licensee is required to 97 \nconduct under section 103(b). 98 \n  (14) “Third-Party service provider” means a person that is not a licensee and that 99 \ncontracts with a licensee to maintain, process, or store nonpublic information, or otherwise is 100 \npermitted access to nonpublic information through its provision of services to the licensee. 101 \n Sec. 103. Information security program. 102 \n (a) Each licensee shall develop, implement, and maintain a comprehensive written 103 \ninformation security program based on the licensee’s risk assessment, which shall include 104 \nadministrative, technical, and physical safeguards for the protection of nonpublic information 105 \nand the licensee’s information system. The information security program shall: 106 \n\nENGROSSED ORIGINAL \n \n \n \n6 \n \n  (1) Be designed to protect the security and confidentiality of nonpublic 107 \ninformation and the security of the information system; 108 \n  (2) Be designed to protect against any threats or hazards to the security or 109 \nintegrity of nonpublic information and the information system; 110 \n  (3) Be designed to protect against unauthorized access to, or use of, nonpublic 111 \ninformation, and minimize the likelihood of harm to any consumer; and 112 \n  (4) Define and periodically reevaluate a schedule for the retention of nonpublic 113 \ninformation and a mechanism for its destruction when no longer needed. 114 \n (b) The licensee shall conduct a risk assessment as part of its obligations to establish an 115 \ninformation security system, which shall: 116 \n  (1) Designate one or more employees, an affiliate, or an outside vendor 117 \ndesignated to act on behalf of the licensee who is responsible for the licensee’s information 118 \nsecurity program; 119 \n  (2) Identify reasonably foreseeable internal or external threats that could result in 120 \nunauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic 121 \ninformation, including the security of information systems and nonpublic information that are 122 \naccessible to, or held by, third-party service providers; 123 \n  (3) Assess the likelihood and potential damage of these threats, taking into 124 \nconsideration the sensitivity of the nonpublic information; 125 \n\nENGROSSED ORIGINAL \n \n \n \n7 \n \n  (4) Assess the sufficiency of policies, procedures, information systems, and other 126 \nsafeguards in place to manage these threats, including consideration of threats in each relevant 127 \narea of the licensee’s operations, including: 128 \n   (A) Employee training and management; 129 \n   (B) Information systems, including network and software design, 130 \ninformation classification, governance, processing, storage, transmission, and disposal; and 131 \n   (C) Detecting, preventing, and responding to attacks, intrusions, or other 132 \nsystems failures; and 133 \n  (5) Implement information safeguards to manage the threats identified under 134 \nparagraph (2) of this subsection in an operative continuous assessment, and, on an annual basis, 135 \nassess the effectiveness of the safeguards’ key controls, systems, and procedures. 136 \n (c) Based on its risk assessment, the licensee’s information security system shall: 137 \n  (1) Be designed to mitigate the identified risks, commensurate with the size and 138 \ncomplexity of the licensee’s activities, including its use of third-party service providers and the 139 \nsensitivity of the nonpublic information and certain public information, including personally 140 \nidentifiable information, used by the licensee or in the licensee’s possession, custody, or control; 141 \n  (2) Assess which of the following security measures are appropriate and 142 \nimplement such security measures: 143 \n   (A) Place access controls on information systems, including controls to 144 \nauthenticate and permit access only by authorized individuals; 145 \n\nENGROSSED ORIGINAL \n \n \n \n8 \n \n   (B) Identify and manage the data, personnel, devices, systems, and 146 \nfacilities that enable the licensee to achieve business purposes in accordance with their relative 147 \nimportance to business objectives and the licensee’s risk assessment; 148 \n   (C) Restrict access at physical locations containing nonpublic information 149 \nonly to authorized individuals; 150 \n   (D) Protect by encryption or other appropriate means all nonpublic 151 \ninformation while being transmitted over an external network and all nonpublic information 152 \nstored on a laptop computer or other portable computing or storage device or media; 153 \n   (E) Adopt secure development practices for in-house developed 154 \napplications utilized by the licensee and procedures for evaluating, assessing, or testing the 155 \nsecurity of externally developed applications utilized by the licensee; 156 \n   (F) Modify the information system in accordance with the licensee’s 157 \ninformation security program; 158 \n   (G) Utilize effective controls, which may include multi-factor 159 \nauthentication procedures, for any individual accessing nonpublic information; 160 \n   (H) Regularly test and monitor systems and procedures to detect actual 161 \nand attempted attacks on, or intrusion into, information systems; 162 \n   (I) Include audit trails within the information security program designed to 163 \ndetect and respond to cybersecurity events and to reconstruct material financial transactions 164 \nsufficient to support normal operations and obligations of the licensee; 165 \n\nENGROSSED ORIGINAL \n \n \n \n9 \n \n   (J) Implement measures to protect against destruction, loss, or damage of 166 \nnonpublic information due to environmental hazards, such as fire and water damage or other 167 \ncatastrophes or technological failures; and 168 \n   (K) Develop, implement, and maintain procedures for the secure disposal 169 \nof nonpublic information in any format; 170 \n  (3) Include cybersecurity risks in the licensee’s enterprise risk management 171 \nprocess; 172 \n  (4) Stay informed on emerging threats or vulnerabilities and utilize reasonable 173 \nsecurity measures when sharing information relative to the character of the sharing and the type 174 \nof information shared; and 175 \n  (5) Provide personnel with cybersecurity awareness training that is updated as 176 \nnecessary to reflect risks identified by the licensee in the risk assessment. 177 \n (d) Notwithstanding subsection (c)(2) of this section, the Commissioner may issue 178 \nadditional security measures through rulemaking. 179 \n (e)(1) Beginning on February 15 of the year after the effective date of this title, and 180 \nannually thereafter, each licensee shall submit a written statement to the Commissioner 181 \nconfirming that the insurer is in compliance with the requirements of this section.  182 \n(2) Each licensee shall maintain for examination by the Department all records, 183 \nschedules, and data supporting its annual written statement for a period of 5 years. To the extent 184 \nthe licensee has identified areas, systems, or processes that require material improvement, 185 \n\nENGROSSED ORIGINAL \n \n \n \n10 \n \nupdating, or redesign, it shall document the identification and the remedial efforts planned and 186 \nunderway to address those areas, systems, or processes, which shall be available for inspection 187 \nby the Commissioner.    188 \n Sec. 104. Investigation and notification of a cybersecurity event. 189 \n (a) If the licensee learns that a cybersecurity event has or may have occurred in its 190 \ninformation system or a system maintained by a third-party service provider, the licensee, an 191 \noutside vendor or service provider designated to act on behalf of the licensee, or the third-party 192 \nservice provider shall conduct a prompt investigation, which shall at a minimum and to the 193 \nextent possible: 194 \n  (1) Determine whether a cybersecurity event has occurred; 195 \n  (2) Assess the nature and scope of the cybersecurity event; 196 \n  (3) Identify any nonpublic information that may have been involved in the 197 \ncybersecurity event; and 198 \n  (4) Perform or oversee reasonable measures to restore the security of the 199 \ninformation system compromised in the cybersecurity event to prevent further unauthorized 200 \nacquisition, release, or use of nonpublic information in the licensee’s possession, custody, or 201 \ncontrol. 202 \n (b) The licensee shall maintain records concerning each cybersecurity event for a period 203 \nof at least 5 years from the date of cybersecurity event and shall produce those records to the 204 \nCommissioner upon request. 205 \n\nENGROSSED ORIGINAL \n \n \n \n11 \n \n (c) A licensee shall notify the Commissioner of a cybersecurity event no later than 3 206 \nbusiness days after a determination that a cybersecurity event has occurred, if: 207 \n  (1) The District is the licensee’s jurisdiction of domicile in the case of an insurer 208 \nor the District is the licensee’s home jurisdiction in the case of an insurance producer, as those 209 \nterms are defined in section 2(7) and (6) of the Producer Licensing Act of 2002, effective March 210 \n27, 2003 (D.C. Law 14-264; D.C. Official Code § 31-1131.02(7) and (6)), respectively; or 211 \n  (2) The licensee reasonably believes that the nonpublic information involves 250 212 \nor more consumers residing in the District and the cybersecurity event: 213 \n   (A) Requires notice to a government body, self-regulatory agency, or any 214 \nother supervisory body pursuant to any state or federal law; or 215 \n   (B) Has a reasonable likelihood of materially harming:  216 \n    (i) A consumer residing in the District; or 217 \n    (ii) Any material part of the normal operations of the licensee.  218 \n (d) Notwithstanding subsection (c) of this section, if the cybersecurity event occurs in a 219 \nsystem maintained by a third-party service provider, the licensee shall notify the Commissioner 220 \nno later than 3 days after the third-party service provider notifies the licensee of the 221 \ncybersecurity event or the licensee has actual knowledge of the cybersecurity event, whichever is 222 \nsooner;  223 \n (e)(1)(A) In the case of a cybersecurity event involving nonpublic information that is 224 \nused by or is in the possession, custody, or control of a licensee that is acting as an assuming 225 \n\nENGROSSED ORIGINAL \n \n \n \n12 \n \ninsurer and that does not have a direct contractual relationship with the affected consumers, the 226 \nassuming insurer shall notify its affected ceding insurers and the insurance regulatory agency of 227 \nits jurisdiction of domicile within 3 business days of determining that a cybersecurity event has 228 \noccurred; and 229 \n   (B) The ceding insurers that have a direct contractual relationship with 230 \naffected consumers shall fulfill the consumer notification requirements imposed under D.C. 231 \nOfficial Code § 28-3852, and any other notification requirements relating to a cybersecurity 232 \nevent imposed under this section. 233 \n  (2)(A) In the case of a cybersecurity event involving nonpublic information that is 234 \nin the possession, custody, or control of a third-party service provider of a licensee that is an 235 \nassuming insurer, the assuming insurer shall notify its affected ceding insurers and the insurance 236 \nregulatory agency of its jurisdiction of domicile within 3 business days of receiving notice from 237 \nits third-party service provider that a cybersecurity event has occurred; 238 \n   (B) The ceding insurers that have a direct contractual relationship with 239 \naffected consumers shall fulfill the consumer notification requirements imposed under D.C. 240 \nOfficial Code § 28-3852, and any other notification requirements relating to a cybersecurity 241 \nevent imposed under this section. 242 \n (f) In the case of a cybersecurity event involving nonpublic information that is in the 243 \npossession, custody, or control of a licensee that is an insurer or its third-party service provider 244 \nfor which a consumer accesses the insurer’s services through an independent insurance producer, 245 \n\nENGROSSED ORIGINAL \n \n \n \n13 \n \nthe insurer shall notify the producers of record of all affected consumers as soon as practicable as 246 \ndirected by the Commissioner. The licensee is excused from the obligation to provide notice to 247 \nindividual consumers where the licensee does not have the current producer of record 248 \ninformation for those consumers. 249 \n Sec. 105. Powers of the Commissioner and penalties. 250 \n (a) The Commissioner shall have the power to examine and investigate the affairs of any 251 \nlicensee to determine whether the licensee has or is engaged in conduct in violation of this title, 252 \nin accordance with the Law on Examinations Act of 1993, effective October 21, 1993 (D.C. Law 253 \n10-49; D.C. Official Code § 31-1401 et seq.). 254 \n (b) An insurer found, without just cause as defined by the Commissioner by rule, to be in 255 \nviolation of this title, after notice and hearing conducted according to the rules for contested 256 \ncases set forth in Chapter 38 of Title 26A of the District of Columbia Municipal Regulations, 257 \nshall pay a penalty in an amount not to exceed $1,000 per day; except, that the maximum penalty 258 \nassessed shall be no more than $25,000. 259 \n (c) The Commissioner may, through rulemaking, establish other penalties for violations 260 \nof this title. 261 \n  262 \n Sec. 106. Confidentiality. 263 \n (a)(1) Documents, materials, or other information in the control or possession of the 264 \nDepartment that are furnished by a licensee, or agent acting on behalf of a licensee, pursuant to 265 \n\nENGROSSED ORIGINAL \n \n \n \n14 \n \nsections 103 and 104, or that are obtained by the Commissioner in an investigation or 266 \nexamination pursuant to section 105, are confidential and privileged and shall not be subject to:  267 \n(A) Disclosure under the Freedom of Information Act of 1976, effective 268 \nMarch 25, 1977 (D.C. Law 1-96; D.C. Official Code § 2-531 et seq.); 269 \n(B) Subpoena; or  270 \n(C) Discovery or be admissible in evidence in a private civil action; 271 \nexcept, that the Commissioner may use the documents, materials, or other information in the 272 \nfurtherance of an action brought as part of the Commissioner’s duties. 273 \n (2) Neither the Commissioner nor any person who receives documents, materials, 274 \nor other information while acting under the authority of the Commissioner shall be permitted to 275 \ntestify in any private civil action concerning any confidential documents, materials, or 276 \ninformation received pursuant to subsection (a) of this section. 277 \n (b) The Commissioner may: 278 \n  (1) Share documents, materials, or other information, including the confidential 279 \nand privileged documents, materials, or information subject to subsection (a) of this section with 280 \nother state, federal, and international regulatory agencies, with the National Association of 281 \nInsurance Commissioners (“NAIC”), its affiliates or subsidiaries, and with state, federal, and 282 \ninternational law enforcement authorities; provided, that the recipient agrees in writing to 283 \nmaintain the confidentiality and privileged status of the document, material, or other information;  284 \n  (2) Receive documents, materials, or information, including otherwise 285 \n\nENGROSSED ORIGINAL \n \n \n \n15 \n \nconfidential and privileged documents, materials, or information, from the NAIC, its affiliates or 286 \nsubsidiaries, and from regulatory and law enforcement officials of other foreign or domestic 287 \njurisdictions, and shall maintain as confidential or privileged any document, material, or 288 \ninformation received with notice or the understanding that it is confidential or privileged under 289 \nthe laws of the jurisdiction that is the source of the document, material, or information; 290 \n  (3) Share documents, materials, or other information subject to subsection (a) of 291 \nthis section, with a third-party consultant or vendor; provided, that the consultant agrees in 292 \nwriting to maintain the confidentiality and the privileged status of the document, material, or 293 \nother information; and 294 \n  (4) Enter into an agreement governing sharing and use of information consistent 295 \nwith this subsection. 296 \n (c) No waiver of any applicable privilege or claim of confidentiality in the documents, 297 \nmaterials, or information shall occur as a result of disclosure to the Commissioner under this 298 \nsection or as a result of sharing as authorized in subsection (c) of this section. 299 \n (e) Nothing in this title shall be construed to prohibit the Commissioner from sharing 300 \nfinal orders of adjudicated actions otherwise open to public inspection pursuant to the Freedom 301 \nof Information Act of 1976, effective March 25, 1977 (D.C. Law 1-96; D.C. Official Code § 2-302 \n531 et seq.), to a database or other clearinghouse service maintained by the NAIC, its affiliates, 303 \nor subsidiaries. 304 \n Sec. 107. Exemptions. 305 \n\nENGROSSED ORIGINAL \n \n \n \n16 \n \n (a) The following licensees shall be exempt from the requirements of section 103: 306 \n  (1) A licensee with fewer than 10 employees, including any independent 307 \ncontractors; 308 \n  (2) A licensee subject to the Health Insurance Portability and Accountability Act 309 \nof 1996, approved August 21, 1996 (110 Stat. 1936; 42 U.S.C. § 1320d et seq.) (“HIPAA”), that 310 \nhas established and maintains an information security program pursuant to HIPAA and the rules, 311 \nregulations, procedures, or guidelines established thereunder; provided, that the licensee submits 312 \na written statement to the Commissioner certifying its compliance with HIPAA; 313 \n  (3) A licensee having less than $5 million in annual written premiums in each of 314 \nthe last 3 calendar years from its District of Columbia business operations; 315 \n  (4) A licensee having less than $10 million in year-end admitted assets, calculated 316 \nin accordance with the NAIC’s statutory accounting principles, including admitted assets of all 317 \naffiliates; and 318 \n  (5) An employee, agent, representative, or designee of a licensee, who is also a 319 \nlicensee, to the extent that the employee, agent, representative, or designee is covered by the 320 \ninformation security program of the other licensee. 321 \n (b) A licensee claiming an exemption under subsection (a) of this section shall file a 322 \nrequest for an exemption in accordance with the rules prescribed by the Commissioner. 323 \n (c) In the event that a licensee ceases to qualify for an exception, the licensee shall have 324 \n180 days to comply with the requirements of this title. 325 \n\nENGROSSED ORIGINAL \n \n \n \n17 \n \n  326 \n Sec. 108. Rulemaking. 327 \n The Commissioner, pursuant to Title I of the District of Columbia Administrative 328 \nProcedure Act, approved October 21, 1968 (82 Stat. 1204; D.C. Official Code § 2-501 et seq.), 329 \nshall promulgate rules necessary to implement the provisions of this title, including establishing: 330 \n(1) Standards and practices that shall be incorporated in a licensee’s information 331 \nsecurity program, including risk assessments, the role of the licensee’s board of directors, 332 \noversight of third-party service providers, and the requirement for written incident response 333 \nplans; and 334 \n(2) Guidance addressing the form and contents of the information that shall be 335 \nincluded in any initial, updated, or supplemental notification to the Commissioner concerning a 336 \ncybersecurity event; provided, that a licensee shall provide the Commissioner with a copy of the 337 \nnotification of security breach sent to consumers as required by D.C. Official Code § 28-3852. 338 \n Sec. 109. No private right of action. 339 \n Nothing in this title shall be construed to create or imply a private cause of action or 340 \ncurtail an existing private cause of action under another law. 341 \nTITLE II. CONFORMING AMENDMENT; FISCAL IMPACT; EFFECTIVE 342 \nDATE. 343 \n Sec. 201. Section 204(a) of the Freedom of Information Act of 1976, effective March 31, 344 \n1977 (D.C. Law 1-96; D.C. Official Code § 2-534(a)), is amended as follows: 345 \n\nENGROSSED ORIGINAL \n \n \n \n18 \n \n(a) Paragraph (23) is amended by striking the phrase “; and” and inserting a semicolon in 346 \nits place. 347 \n(b) Paragraph (24) is amended by striking the period and inserting the phrase “; and” in 348 \nits place. 349 \n(c) A new paragraph (25) is added to read as follows: 350 \n “(25) Information exempt from disclosure under the Cybersecurity and 351 \nAccountability Act of 2026, as approved by the Committee on Health on July 8, 2026 352 \n(Committee print of Bill 26-427).”. 353 \n Sec. 202. Fiscal Impact Statement. 354 \n The Council adopts the fiscal impact statement in the committee report as the fiscal 355 \nimpact statement required by section 4a of the General Legislative Procedures Act of 1975, 356 \napproved October 16, 2006 (120 Stat. 2038; D.C. Official Code § 1-301.47a). 357 \n Sec. 203. Effective Date. 358 \n This act shall take effect following approval by the Mayor (or in the event of veto by the 359 \nMayor, action by the Council to override the veto) and a 30-day period of congressional review 360 \nas provided in section 602(c)(1) of the District of Columbia Home Rule Act, approved December 361 \n24, 1973 (87 Stat. 813; D.C. Code § 1-206.02(c)(1)).  362 ', 'pages': 18, 'doc_id': '3453628', 'truncated': False, 'extraction': 'source-pdf-text', 'source_url': 'https://lims.dccouncil.gov/downloads/LIMS/60494/Meeting1/Engrossment/B26-0427-Engrossment1.pdf', 'observed_at': '2026-10-04T00:40:57.725502+00:00', 'content_hash': '14e4e78bec7d930716d5b5ec48d07caff05748c90edfc13bb16935888262d2a1'}}

Collection history starts with our observations; it is not complete legislative amendment history.

Detail checked 2026-10-03T23:54:21.904362+00:00.

• 2025-04-30: Introduced
• 2025-05-07: Referred to committee: Transportation
• 2025-10-29: Reported - Substitute: Transportation
• 2025-11-12: Passed
• 2025-11-18: Introduced
• 2025-11-19: Referred to committee: Armed Services, Veterans Affairs and Public Safety
• 2026-06-10: Reported - Substitute: Armed Services, Veterans Affairs and Public Safety
• 2026-06-10: Passed
• 2026-06-10: Concurred in Senate amendments
• 2026-07-01: Sent To The Governor
• 2026-07-07: Signed By The Governor
• 2026-10-06: Effective Certain provisions effective October 6, 2030

• 0000-00-00 Introduced: Official bill text
• 0000-00-00 Comm Sub: Official bill text
• 0000-00-00 Engrossed: Official bill text
• 0000-00-00 Comm Sub: Official bill text
• 0000-00-00 Engrossed: Official bill text
• 0000-00-00 Enrolled: Official bill text

Observed 2026-10-04T00:16:19.133094+00:00.

(136th General Assembly)
(Substitute House Bill Number 251)
AN ACT
To amend sections 4561.01 and 4561.11 and to enact sections 4561.60, 4561.61,
4561.62, 4561.63, 4561.64, and 5501.84 of the Revised Code to establish
requirements related to the use and purchase of an unmanned aerial vehicle by
law enforcement and other public entities and to expressly incorporate additional
aviation facilities into the Aeronautics Law.
Be it enacted by the General Assembly of the State of Ohio:
SECTION 1. That sections 4561.01 and 4561.11 be amended and sections 4561.60, 4561.61,
4561.62, 4561.63, 4561.64, and 5501.84 of the Revised Code be enacted to read as follows:
Sec. 4561.01. As used in sections 4561.01 to 4561.27 of the Revised Code:
(A) "Aviation" means transportation by aircraft; operation of aircraft; the establishment,
operation, maintenance, repair, and improvement of airports, seaplane bases, heliports, vertiports,
spaceports, landing fields, and other air navigation facilities; and all other activities connected
therewith or incidental thereto.
(B) "Aircraft" means any manned device used or intended for flight in the air. "Aircraft"
does not include an ultralight vehicle as defined by 14 C.F.R. part 103.
(C) "Airport" means any location either on land or water which is used for the landing and
taking off of aircraft.
(D) "Landing field" means any location either on land or water of such size and nature as to
permit the landing or taking off of aircraft with safety, and used for that purpose but not equipped to
provide for the shelter, supply, or care of aircraft.
(E) "Air navigation facility" means any facility used, available for use, or designed for use in
aid of navigation of aircraft, including airports, landing fields, facilities for the servicing of aircraft
or for the comfort and accommodation of air travelers, and any structures, mechanisms, lights,
beacons, marks, communicating systems, or other instrumentalities or devices used or useful as an
aid to the safe taking off, navigation, and landing of aircraft, or to the safe and efficient operation or
maintenance of an airport or landing field, and any combination of such facilities.
(F) "Air navigation hazard" means any structure, object of natural growth, or use of land,
that obstructs the air space required for the flight of aircraft in landing or taking off at any airport or
landing field, or that otherwise is hazardous to such landing or taking off.
(G) "Air navigation," "navigation of aircraft," or "navigate aircraft" means the operation of
aircraft in the air space over this state.
(H) "Airperson" means any individual who, as the person in command, or as pilot, mechanic,

Sub. H. B. No. 251 136th G.A.
2
or member of the crew, engages in the navigation of aircraft.
(I) "Airway" means a route in the air space over and above the lands or waters of this state,
designated by the Ohio aviation board as a route suitable for the navigation of aircraft.
(J) "Person" means any individual, firm, partnership, corporation, company, association,
joint stock association, or body politic, and includes any trustee, receiver, assignee, or other similar
representative thereof.
(K) "Government agency" means a state agency, state institution of higher education,
regional port authority, or any other political subdivision of the state, or the federal government or
other states.
(L) "Heliport" means the area of land, water, or a structure that is used or intended to be used
for the landing and takeoff of helicopters, including any appurtenant buildings and facilities.
(M) "Vertiport" means the identifiable ground or elevated areas, including the facilities
thereon, that are designed to be used for the landing and takeoff of rotorcraft, tilt-rotor aircraft, or
other powered lift aircraft.
(N) "Spaceport" means any facility in the state at which space vehicles may be landed or
launched, including all facilities and support infrastructure related to the launch, landing, and
payload processing.
(O) "Seaplane base" means a designated area of water used or intended to be used for the
landing and takeoff of seaplanes including shore side access and any appurtenant buildings and
facilities.
Sec. 4561.11. (A) All airports, seaplane bases, heliports, vertiports, spaceports, landing
fields, and landing areas shall be approved by the department of transportation before being used for
commercial purposes. The department may issue a certificate of approval in each case. The
department shall require that a complete plan of such airport, seaplane base, heliport, vertiport,
spaceport, landing field, or landing area be filed with it before granting or issuing such approval;
provided that in no case in which the department licenses or certifies an airport, seaplane base,
heliport, vertiport, spaceport, landing field, or landing area constructed, maintained, or supported, in
whole or in part, by public funds, under sections 4561.01 to 4561.151 of the Revised Code, shall the
public be deprived of the use thereof or its facilities for aviation purposes as fully and equally as all
other parties.
(B) In any case in which the department rejects or disapproves an application to operate an
airport, seaplane base, heliport, vertiport, spaceport, landing field, or landing area, or in any case in
which the department issues an order requiring certain things to be done before approval, it shall set
forth its reasons therefor and shall state the requirements to be met before such approval will be
given or such order modified or changed. In any case in which the department considers it necessary,
it may order the closing of any airport, seaplane base, heliport, vertiport, spaceport, landing field, or
landing area for commercial purposes until the requirements of the order made by the department are
complied with.

Sub. H. B. No. 251 136th G.A.
3
(C) Appeal from any action or decision of the department in any such matter shall be made
in accordance with sections 119.01 to 119.13 of the Revised Code.
(D)(1) The department shall require that any person engaged within this state in operating
aircraft, in any form of navigation, shall be the holder of a currently effective aviator's license as
required and issued by the civil aeronautics administrationfederal aviation administration.
(2) The aviator's license , when required by this section , shall be kept in the personal
possession of the pilot when the pilot is operating aircraft within this state, and shall be presented for
inspection upon the request of any passenger, any authorized representative of the department, or
any official manager or person in charge of any airport, seaplane base, heliport, vertiport, spaceport,
landing field, or area in this state upon which the pilot lands.
(B) (E) Whoever violates this section shall be fined not more than five hundred dollars,
imprisoned not more than ninety days, or both.
Sec. 4561.60. As used in sections 4561.60 to 4561.64 of the Revised Code:
(A) "Surveillance data" means the data collected by an unmanned aerial vehicle during its
flight, including images, videos, or other forms of observation recording.
(B) "Flight data" means the data pertaining to an unmanned aerial vehicle's flight from both
the original plan for the flight and the actual flight that was taken, including the flight's duration,
path, and mission objectives.
(C) "Law enforcement agency" means a government entity that employs peace officers to
perform law enforcement duties.
(D) "Peace officer" has the same meaning as in section 2935.01 of the Revised Code.
(E) "Unmanned aerial vehicle" and "unmanned aerial vehicle system" have the same
meanings as in section 4561.50 of the Revised Code.
Sec. 4561.61. (A) If a peace officer would otherwise be required to obtain a search warrant
to physically enter a house or a place in person to conduct a search, the …