9–8–8 Lifeline Cybersecurity Responsibility Act

Subjects: Health, Computer security and identity theft, Congressional oversight, Emergency communications systems, Government information and archives, Government studies and investigations, Mental health

Summary:  <p><b>9-8-8 Lifeline Cybersecurity Responsibility Act</b></p> <p>This bill requires the Substance Abuse and Mental Health Services Administration (SAMHSA) to undertake efforts to protect the 9-8-8 Suicide &amp; Crisis Lifeline from cybersecurity threats. (The lifeline is a three-digit number that connects callers in suicidal crisis or mental health distress to a national network of crisis centers.)</p> <p>The bill also expands related reporting requirements. Specifically, the network administrator for the lifeline must report identified cybersecurity incidents and vulnerabilities to SAMHSA, and local and regional crisis centers that participate in the lifeline must report identified cybersecurity incidents and vulnerabilities to the administrator.</p> <p>Additionally, the Government Accountability Office must conduct a study that evaluates cybersecurity risks and vulnerabilities associated with the lifeline and report the findings to Congress.</p>

<html><body><pre>[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 498 Introduced in House (IH)]

&lt;DOC&gt;






118th CONGRESS
  1st Session
                                H. R. 498

To amend title V of the Public Health Service Act to secure the suicide 
    prevention lifeline from cybersecurity incidents, and for other 
                               purposes.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                            January 25, 2023

 Mr. Obernolte (for himself and Mr. Cardenas) introduced the following 
    bill; which was referred to the Committee on Energy and Commerce

_______________________________________________________________________

                                 A BILL


 
To amend title V of the Public Health Service Act to secure the suicide 
    prevention lifeline from cybersecurity incidents, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``9-8-8 Lifeline Cybersecurity 
Responsibility Act''.

SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM CYBERSECURITY 
              INCIDENTS.

    (a) Suicide Prevention Lifeline.--Section 520E-3(b) of the Public 
Health Service Act (42 U.S.C. 290bb-36c(b)) is amended--
            (1) in paragraph (4), by striking ``and'' at the end;
            (2) in paragraph (5), by striking the period at the end and 
        inserting ``; and''; and
            (3) by adding at the end the following:
            ``(6) coordinating with the Chief Information Security 
        Officer of the Department of Health and Human Services to take 
        such steps as may be necessary to ensure the program is 
        protected from cybersecurity incidents and eliminates known 
        cybersecurity vulnerabilities.''.
    (b) Reporting.--Section 520E-3 of the Public Health Service Act (42 
U.S.C. 290bb-36c) is amended--
            (1) by redesignating subsection (f) as subsection (g); and
            (2) by inserting after subsection (e) the following:
    ``(f) Cybersecurity Reporting.--
            ``(1) In general.--The program's network administrator 
        receiving Federal funding pursuant to subsection (a) shall 
        report to the Assistant Secretary, in a manner that protects 
        personal privacy, consistent with applicable Federal and State 
        privacy laws--
                    ``(A) any identified cybersecurity vulnerabilities 
                to the National Suicide Prevention Lifeline; and
                    ``(B) any identified cybersecurity incidents or 
                potential incidents to the National Suicide Prevention 
                Lifeline.
            ``(2) Notification.--If an entity described in paragraph 
        (1) discovers a cybersecurity vulnerability, incident, or 
        potential incident, such entity shall immediately report that 
        discovery to the Assistant Secretary.
            ``(3) Clarification.--The cybersecurity incident reporting 
        requirements under this subsection shall supplement, and not 
        supplant, cybersecurity incident reporting requirements under 
        other provisions of applicable Federal law that are in effect 
        on the date of the enactment of the 9-8-8 Lifeline 
        Cybersecurity Responsibility Act.''.
    (c) Study.--Not later than 180 days after the date of the enactment 
of this Act, the Comptroller General of the United States shall--
            (1) conduct and complete a study that evaluates 
        cybersecurity risks and vulnerabilities associated with the 9-
        8-8 National Suicide Prevention Lifeline; and
            (2) submit a report of the findings of such study to the 
        Committee on Energy and Commerce of the House of 
        Representatives and the Committee on Health, Education, Labor, 
        and Pensions of the Senate.
                                 &lt;all&gt;
</pre></body></html>