9–8–8 Lifeline Cybersecurity Responsibility Act

Subjects: Health

Summary:  <p><b>9-8-8 Lifeline Cybersecurity Responsibility Act</b></p> <p>This bill requires the Substance Abuse and Mental Health Services Administration (SAMHSA) to undertake efforts to protect the 9-8-8 Suicide &amp; Crisis Lifeline from cybersecurity threats. (The lifeline is a three-digit number that connects callers in suicidal crisis or mental health distress to a national network of crisis centers.)</p> <p>The bill also expands related reporting requirements. Specifically, the network administrator for the lifeline must report identified cybersecurity incidents and vulnerabilities to SAMHSA, and local and regional crisis centers that participate in the lifeline must report identified cybersecurity incidents and vulnerabilities to the administrator.</p> <p>Additionally, the Government Accountability Office must conduct a study that evaluates cybersecurity risks and vulnerabilities associated with the lifeline and report the findings to Congress.</p>

<html><body><pre>[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1493 Introduced in Senate (IS)]

&lt;DOC&gt;






118th CONGRESS
  1st Session
                                S. 1493

To amend title V of the Public Health Service Act to secure the suicide 
    prevention lifeline from cybersecurity incidents, and for other 
                               purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                              May 9, 2023

Ms. Sinema (for herself and Mr. Mullin) introduced the following bill; 
     which was read twice and referred to the Committee on Health, 
                     Education, Labor, and Pensions

_______________________________________________________________________

                                 A BILL


 
To amend title V of the Public Health Service Act to secure the suicide 
    prevention lifeline from cybersecurity incidents, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``9-8-8 Lifeline Cybersecurity 
Responsibility Act''.

SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM CYBERSECURITY 
              INCIDENTS.

    (a) National Suicide Prevention Lifeline Program.--Section 520E-
3(b) of the Public Health Service Act (42 U.S.C. 290bb-36c(b)) is 
amended--
            (1) in paragraph (4), by striking ``and'' at the end;
            (2) in paragraph (5), by striking the period at the end and 
        inserting ``; and''; and
            (3) by adding at the end the following:
            ``(6) coordinating with the Chief Information Security 
        Officer of the Department of Health and Human Services to take 
        such steps as may be necessary to ensure the program is 
        protected from cybersecurity incidents and eliminates known 
        cybersecurity vulnerabilities.''.
    (b) Reporting.--Section 520E-3 of the Public Health Service Act (42 
U.S.C. 290bb-36c) is amended--
            (1) by redesignating subsection (f) as subsection (g); and
            (2) by inserting after subsection (e) the following:
    ``(f) Cybersecurity Reporting.--
            ``(1) In general.--
                    ``(A) In general.--The program's network 
                administrator receiving Federal funding pursuant to 
                subsection (a) shall report to the Assistant Secretary, 
                in a manner that protects personal privacy, consistent 
                with applicable Federal and State privacy laws--
                            ``(i) any identified cybersecurity 
                        vulnerabilities to the program within 24 hours 
                        of identification of such a vulnerability; and
                            ``(ii) any identified cybersecurity 
                        incidents to the program within 24 hours of 
                        identification of such incident.
                    ``(B) Local and regional crisis centers.--Local and 
                regional crisis centers participating in the program 
                shall report to the program's network administrator 
                identified in subparagraph (A), in a manner that 
                protects personal privacy, consistent with applicable 
                Federal and State privacy laws--
                            ``(i) any identified cybersecurity 
                        vulnerabilities to the program within 24 hours 
                        of identification of such vulnerability; and
                            ``(ii) any identified cybersecurity 
                        incidents to the program within 24 hours of 
                        identification of such incident.
            ``(2) Notification.--If the program's network administrator 
        receiving funding pursuant to subsection (a) discovers, or is 
        informed by a local or regional crisis center pursuant to 
        paragraph (1)(B) of, a cybersecurity vulnerability or incident, 
        within 24 hours of such discovery or receipt of information, 
        such entity shall report the vulnerability or incident to the 
        Assistant Secretary.
            ``(3) Clarification.--
                    ``(A) Oversight.--
                            ``(i) Local and regional crisis center.--
                        Except as provided in clause (ii), local and 
                        regional crisis centers participating in the 
                        program shall oversee all technology each 
                        center employs in the provision of services as 
                        a participant in the program.
                            ``(ii) Network administrator.-- The 
                        program's network administrator receiving 
                        Federal funding pursuant to subsection (a) 
                        shall oversee the technology each crisis center 
                        employs in the provision of services as a 
                        participant in the program if such oversight 
                        responsibilities are established in the 
                        applicable network participation agreement.
                    ``(B) Supplement, not supplant.--The cybersecurity 
                incident reporting requirements under this subsection 
                shall supplement, and not supplant, cybersecurity 
                incident reporting requirements under other provisions 
                of applicable Federal law that are in effect on the 
                date of the enactment of the 9-8-8 Lifeline 
                Cybersecurity Responsibility Act.''.
    (c) Study.--Not later than 180 days after the date of the enactment 
of this Act, the Comptroller General of the United States shall--
            (1) conduct and complete a study that evaluates 
        cybersecurity risks and vulnerabilities associated with the 9-
        8-8 National Suicide Prevention Lifeline; and
            (2) submit a report of the findings of such study to the 
        Committee on Energy and Commerce of the House of 
        Representatives and the Committee on Health, Education, Labor, 
        and Pensions of the Senate.
                                 &lt;all&gt;
</pre></body></html>