What This Bill Does
This bill makes changes to the National Suicide Prevention Lifeline program to protect it from computer security attacks and breaches. The bill requires the program to take steps to prevent cybersecurity threats and to report any security problems that are discovered.
Who It Affects
- The network administrator (a government-funded organization) that runs the National Suicide Prevention Lifeline
- Local and regional crisis centers that participate in the program
- The Assistant Secretary for Health (a federal official overseeing the program)
- Congressional committees that receive reports about the program's security
Key Provisions
- The suicide prevention hotline must take necessary steps to protect itself from cybersecurity incidents (attacks or unauthorized access to computer systems) and to eliminate known security weaknesses (Sec. 2(a))
- The network administrator receiving federal funding must report any identified cybersecurity vulnerabilities (weaknesses in computer systems) and incidents to the Assistant Secretary within a reasonable amount of time while protecting people's privacy (Sec. 2(b)(1)(A))
- Local and regional crisis centers must report cybersecurity vulnerabilities and incidents to the network administrator within a reasonable amount of time while protecting people's privacy (Sec. 2(b)(1)(B))
- A government study must evaluate cybersecurity risks facing the lifeline and be completed within 180 days after the law takes effect (Sec. 2(c))
What Changes
If this becomes law, the suicide prevention lifeline program will be required to actively work to prevent computer security attacks and to report any security problems they find to federal officials. Local crisis centers will have to tell the main network administrator about security problems they discover.
Important Definitions
- Cybersecurity incident: A computer security attack or breach affecting the program
- Cybersecurity vulnerability: A weakness in computer systems that could be exploited
- Network administrator: The organization receiving federal funding that runs the lifeline program
Effective Date
Not specified in bill text
IIB
118TH CONGRESS
2D SESSION
H. R. 498
IN THE SENATE OF THE UNITED STATES
MARCH 6, 2024
Received; read twice and referred to the Committee on Health, Education,
Labor, and Pensions
AN ACT
To amend title V of the Public Health Service Act to secure
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB
2
HR 498 RFS
SECTION 1. SHORT TITLE.
1
This Act may be cited as the ‘‘9–8–8 Lifeline Cyber-
2
security Responsibility Act’’.
3
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE
4
FROM CYBERSECURITY INCIDENTS.
5
(a) NATIONAL SUICIDE PREVENTION LIFELINE PRO-
6
GRAM.—Section 520E–3(b) of the Public Health Service
7
Act (42 U.S.C. 290bb–36c(b)) is amended—
8
(1) in paragraph (4), by striking ‘‘and’’ at the
9
end;
10
(2) in paragraph (5), by striking the period at
11
the end and inserting ‘‘; and’’; and
12
(3) by adding at the end the following:
13
‘‘(6) taking such steps as may be necessary to
14
ensure the suicide prevention hotline is protected
15
from cybersecurity incidents and to eliminate known
16
cybersecurity vulnerabilities of such hotline.’’.
17
(b) REPORTING.—Section 520E–3 of the Public
18
Health Service Act (42 U.S.C. 290bb–36c) is amended—
19
(1) by redesignating subsection (f) as sub-
20
section (g); and
21
(2) by inserting after subsection (e) the fol-
22
lowing:
23
‘‘(f) CYBERSECURITY REPORTING.—
24
‘‘(1) NOTIFICATION.—
25
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB
3
HR 498 RFS
‘‘(A) IN
GENERAL.—The program’s net-
1
work administrator receiving Federal funding
2
pursuant to subsection (a) shall report to the
3
Assistant Secretary, in a manner that protects
4
personal privacy, consistent with applicable
5
Federal and State privacy laws—
6
‘‘(i) any identified cybersecurity vul-
7
nerability to the program within a reason-
8
able amount of time after identification of
9
such a vulnerability; and
10
‘‘(ii) any identified cybersecurity inci-
11
dent to the program within a reasonable
12
amount of time after identification of such
13
an incident.
14
‘‘(B) LOCAL AND REGIONAL CRISIS CEN-
15
TERS.—Local and regional crisis centers par-
16
ticipating in the program shall report to the
17
program’s network administrator receiving Fed-
18
eral funding pursuant to subsection (a), in a
19
manner that protects personal privacy, con-
20
sistent with applicable Federal and State pri-
21
vacy laws—
22
‘‘(i) any identified cybersecurity vul-
23
nerability to the program within a reason-
24
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB
4
HR 498 RFS
able amount of time after identification of
1
such a vulnerability; and
2
‘‘(ii) any identified cybersecurity inci-
3
dent to the program within a reasonable
4
amount of time after identification of such
5
an incident.
6
‘‘(2) NOTIFICATION.—If the program’s network
7
administrator receiving funding pursuant to sub-
8
section (a) discovers, or is informed by a local or re-
9
gional crisis center pursuant to paragraph (1)(B) of,
10
a cybersecurity vulnerability or incident, within a
11
reasonable amount of time after such discovery or
12
receipt of information, such entity shall report the
13
vulnerability or incident to the Assistant Secretary.
14
‘‘(3) CLARIFICATION.—
15
‘‘(A) OVERSIGHT.—
16
‘‘(i) LOCAL
AND
REGIONAL
CRISIS
17
CENTER.—Except as provided in clause
18
(ii), local and regional crisis centers par-
19
ticipating in the program shall oversee all
20
technology each center employs in the pro-
21
vision of services as a participant in the
22
program.
23
‘‘(ii) NETWORK
ADMINISTRATOR.—
24
The program’s network administrator re-
25
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB
5
HR 498 RFS
ceiving Federal funding pursuant to sub-
1
section (a) shall oversee the technology
2
each crisis center employs in the provision
3
of services as a participant in the program
4
if such oversight responsibilities are estab-
5
lished in the applicable network participa-
6
tion agreement.
7
‘‘(B) SUPPLEMENT, NOT SUPPLANT.—The
8
cybersecurity incident reporting requirements
9
under this subsection shall supplement, and not
10
supplant, cybersecurity incident reporting re-
11
quirements under other provisions of applicable
12
Federal law that are in effect on the date of the
13
enactment of the 9–8–8 Lifeline Cybersecurity
14
Responsibility Act.’’.
15
(c) STUDY.—Not later than 180 days after the date
16
of the enactment of this Act, the Comptroller General of
17
the United States shall—
18
(1) conduct and complete a study that evaluates
19
cybersecurity risks and vulnerabilities associated
20
with the 9–8–8 National Suicide Prevention Lifeline;
21
and
22
(2) submit a report of the findings of such
23
study to the Committee on Energy and Commerce of
24
the House of Representatives and the Committee on
25
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB
6
HR 498 RFS
Health, Education, Labor, and Pensions of the Sen-
1
ate.
2
Passed the House of Representatives March 5,
2024.
Attest:
KEVIN F. MCCUMBER,
Clerk.
VerDate Sep 11 2014
02:49 Mar 07, 2024
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H498.RFS
H498
kjohnson on DSK7ZCZBW3PROD with $$_JOB