9–8–8 Lifeline Cybersecurity Responsibility Act

Bill: 118-hr-498
Sponsor: full_name: Rep. Obernolte, Jay [R-CA-23]
Introduced: 2023-01-25
Policy area: Health
Subjects: Computer security and identity theft

Congressional oversight

Emergency communications systems

Government information and archives

Government studies and investigations

Mental health
Latest action: action_date: 2024-03-06
text: Received in the Senate and Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

Summaries:
action_date: 2023-01-25
action_desc: Introduced in House
text: <p><b>9-8-8 Lifeline Cybersecurity Responsibility Act</b></p> <p>This bill requires the Substance Abuse and Mental Health Services Administration (SAMHSA) to undertake efforts to protect the 9-8-8 Suicide &amp; Crisis Lifeline from cybersecurity threats. (The lifeline is a three-digit number that connects callers in suicidal crisis or mental health distress to a national network of crisis centers.)</p> <p>The bill also expands related reporting requirements. Specifically, the network administrator for the lifeline must report identified cybersecurity incidents and vulnerabilities to SAMHSA, and the Government Accountability Office must conduct a study that evaluates cybersecurity risks and vulnerabilities associated with the lifeline and report the findings to Congress.</p>

action_date: 2023-05-11
action_desc: Reported to House
text: <p><b>9-8-8 Lifeline Cybersecurity Responsibility Act</b></p> <p>This bill requires the Substance Abuse and Mental Health Services Administration (SAMHSA) to undertake efforts to protect the 9-8-8 Suicide &amp; Crisis Lifeline from cybersecurity threats. (The lifeline is a three-digit number that connects callers in suicidal crisis or mental health distress to a national network of crisis centers.)</p> <p>The bill also expands related reporting requirements. Specifically, the network administrator for the lifeline must report identified cybersecurity incidents and vulnerabilities to SAMHSA, and local and regional crisis centers that participate in the lifeline must report identified cybersecurity incidents and vulnerabilities to the administrator.</p> <p>Additionally, the Government Accountability Office must conduct a study that evaluates cybersecurity risks and vulnerabilities associated with the lifeline and report the findings to Congress.</p>

action_date: 2024-03-05
action_desc: Passed House
text: <p><b>9-8-8 Lifeline Cybersecurity Responsibility Act</b></p> <p>This bill requires the Substance Abuse and Mental Health Services Administration (SAMHSA) to undertake efforts to protect the 9-8-8 Suicide &amp; Crisis Lifeline from cybersecurity threats. (The lifeline is a three-digit number that connects callers in suicidal crisis or mental health distress to a national network of crisis centers.)</p> <p>The bill also expands related reporting requirements. Specifically, the network administrator for the lifeline must report identified cybersecurity incidents and vulnerabilities to SAMHSA, and local and regional crisis centers that participate in the lifeline must report identified cybersecurity incidents and vulnerabilities to the administrator.</p> <p>Additionally, the Government Accountability Office must conduct a study that evaluates cybersecurity risks and vulnerabilities associated with the lifeline and report the findings to Congress.</p>

tv_txt: IIB 118th CONGRESS 2d Session H. R. 498 IN THE SENATE OF THE UNITED STATES March 6, 2024 Received; read twice and referred to the Committee on Health, Education, Labor, and Pensions AN ACT To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.

1. Short title This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act . 2. Protecting suicide prevention lifeline from cybersecurity incidents (a) National suicide prevention lifeline program Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended— (1) in paragraph (4), by striking and at the end; (2) in paragraph (5), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (6) taking such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and to eliminate known cybersecurity vulnerabilities of such hotline. . (b) Reporting Section 520E–3 of the Public Health Service Act ( 42 U.S.C. 290bb–36c ) is amended— (1) by redesignating subsection (f) as subsection (g); and (2) by inserting after subsection (e) the following: (f) Cybersecurity reporting (1) Notification (A) In general The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and (ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident. (B) Local and regional crisis centers Local and regional crisis centers participating in the program shall report to the program’s network administrator receiving Federal funding pursuant to subsection (a), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and (ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident. (2) Notification If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary. (3) Clarification (A) Oversight (i) Local and regional crisis center Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program. (ii) Network administrator The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement. (B) Supplement, not supplant The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act . . (c) Study Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall— (1) conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and (2) submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.

Passed the House of Representatives March 5, 2024. Kevin F. McCumber, Clerk.

tv_txt: I 118th CONGRESS 2d Session H. R. 498 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.

1. Short title This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act . 2. Protecting suicide prevention lifeline from cybersecurity incidents (a) National suicide prevention lifeline program Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended— (1) in paragraph (4), by striking and at the end; (2) in paragraph (5), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (6) taking such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and to eliminate known cybersecurity vulnerabilities of such hotline. . (b) Reporting Section 520E–3 of the Public Health Service Act ( 42 U.S.C. 290bb–36c ) is amended— (1) by redesignating subsection (f) as subsection (g); and (2) by inserting after subsection (e) the following: (f) Cybersecurity reporting (1) Notification (A) In general The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and (ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident. (B) Local and regional crisis centers Local and regional crisis centers participating in the program shall report to the program’s network administrator receiving Federal funding pursuant to subsection (a), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and (ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident. (2) Notification If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary. (3) Clarification (A) Oversight (i) Local and regional crisis center Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program. (ii) Network administrator The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement. (B) Supplement, not supplant The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act . . (c) Study Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall— (1) conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and (2) submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.

Passed the House of Representatives March 5, 2024. Cheryl L. Johnson, Clerk.

tv_txt: IB Union Calendar No. 35 118th CONGRESS 1st Session H. R. 498 [Report No. 118–52] IN THE HOUSE OF REPRESENTATIVES January 25, 2023 Mr. Obernolte (for himself and Mr. Cárdenas ) introduced the following bill; which was referred to the Committee on Energy and Commerce May 11, 2023 Reported with an amendment; committed to the Committee of the Whole House on the State of the Union and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on January 25, 2023 A BILL To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.

1. Short title This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act . 2. Protecting suicide prevention lifeline from cybersecurity incidents (a) National suicide prevention lifeline program Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended— (1) in paragraph (4), by striking and at the end; (2) in paragraph (5), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (6) coordinating with the Chief Information Security Officer of the Department of Health and Human Services to take such steps as may be necessary to ensure the program is protected from cybersecurity incidents and eliminates known cybersecurity vulnerabilities. . (b) Reporting Section 520E–3 of the Public Health Service Act ( 42 U.S.C. 290bb–36c ) is amended— (1) by redesignating subsection (f) as subsection (g); and (2) by inserting after subsection (e) the following: (f) Cybersecurity reporting (1) In general (A) In general The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerabilities to the program immediately upon identification of such a vulnerability; and (ii) any identified cybersecurity incidents to the program immediately upon identification of such incident. (B) Local and regional crisis centers Local and regional crisis centers participating in the program shall report to the program’s network administrator identified in subparagraph (A), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerabilities to the program immediately upon identification of such vulnerability; and (ii) any identified cybersecurity incidents to the program immediately upon identification of such incident. (2) Notification If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, such entity shall immediately report that discovery to the Assistant Secretary. (3) Clarification (A) Oversight (i) Local and regional crisis center Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program. (ii) Network administrator The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement. (B) Supplement, not supplant The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act . . (c) Study Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall— (1) conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and (2) submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.

May 11, 2023 Reported with an amendment; committed to the Committee of the Whole House on the State of the Union and ordered to be printed

tv_txt: I 118th CONGRESS 1st Session H. R. 498 IN THE HOUSE OF REPRESENTATIVES January 25, 2023 Mr. Obernolte (for himself and Mr. Cárdenas ) introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.

1. Short title This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act . 2. Protecting suicide prevention lifeline from cybersecurity incidents (a) Suicide prevention lifeline Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended— (1) in paragraph (4), by striking and at the end; (2) in paragraph (5), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (6) coordinating with the Chief Information Security Officer of the Department of Health and Human Services to take such steps as may be necessary to ensure the program is protected from cybersecurity incidents and eliminates known cybersecurity vulnerabilities. . (b) Reporting Section 520E–3 of the Public Health Service Act ( 42 U.S.C. 290bb–36c ) is amended— (1) by redesignating subsection (f) as subsection (g); and (2) by inserting after subsection (e) the following: (f) Cybersecurity reporting (1) In general The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (A) any identified cybersecurity vulnerabilities to the National Suicide Prevention Lifeline; and (B) any identified cybersecurity incidents or potential incidents to the National Suicide Prevention Lifeline. (2) Notification If an entity described in paragraph (1) discovers a cybersecurity vulnerability, incident, or potential incident, such entity shall immediately report that discovery to the Assistant Secretary. (3) Clarification The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act . . (c) Study Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall— (1) conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and (2) submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.