Lifeline Cybersecurity Responsibility Act
Floor Speech
BREAK IN TRANSCRIPT
Mr. GUTHRIE. Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 498) to amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes, as amended.
The Clerk read the title of the bill.
The text of the bill is as follows: H.R. 498
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. SHORT TITLE.
This Act may be cited as the ``9-8-8 Lifeline Cybersecurity Responsibility Act''. SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM CYBERSECURITY INCIDENTS.
(a) National Suicide Prevention Lifeline Program.--Section 520E-3(b) of the Public Health Service Act (42 U.S.C. 290bb- 36c(b)) is amended--
(1) in paragraph (4), by striking ``and'' at the end;
(2) in paragraph (5), by striking the period at the end and inserting ``; and''; and
(3) by adding at the end the following:
``(6) taking such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and to eliminate known cybersecurity vulnerabilities of such hotline.''.
(b) Reporting.--Section 520E-3 of the Public Health Service Act (42 U.S.C. 290bb-36c) is amended--
(1) by redesignating subsection (f) as subsection (g); and
(2) by inserting after subsection (e) the following:
``(f) Cybersecurity Reporting.--
``(1) Notification.--
``(A) In general.--The program's network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws--
``(i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and
``(ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident.
``(B) Local and regional crisis centers.--Local and regional crisis centers participating in the program shall report to the program's network administrator receiving Federal funding pursuant to subsection (a), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws--
``(i) any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and
``(ii) any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident.
``(2) Notification.--If the program's network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary.
``(3) Clarification.--
``(A) Oversight.--
``(i) Local and regional crisis center.--Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program.
``(ii) Network administrator.--The program's network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement.
``(B) Supplement, not supplant.--The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9-8-8 Lifeline Cybersecurity Responsibility Act.''.
(c) Study.--Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall--
(1) conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9-8-8 National Suicide Prevention Lifeline; and
(2) submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.
Mr. Speaker, I rise in support of H.R. 498, the 9-8-8 Lifeline Cybersecurity Responsibility Act, led by Mr. Obernolte.
In 2021, more than 48,000 people died by suicide in the United States. That equates to 132 people every day. These are our family members, our neighbors, and our friends. This number is staggering, and unfortunately, suicide deaths are continuing to rise. People need hope and healing.
The 988 Suicide & Crisis Lifeline is a national network of local crisis centers used to support people in suicidal crisis or emotional distress. This has proven to be a vital resource, especially during the COVID-19 pandemic when government-imposed lockdowns led to increased social isolation and loneliness.
The lifeline suffered a cybersecurity attack in December 2022 and was proactively taken offline for several hours. It is unknown how many individuals were hurt by the outage, but we do know that individuals in emotional distress or suicide crisis were unable to utilize the lifeline for hours.
H.R. 498 would improve the lifeline's cybersecurity protections by requiring coordination between SAMHSA and the chief information security officer within HHS.
Additionally, this bill would require the lifeline administrator and local call centers to report any cybersecurity incidents and vulnerabilities to SAMHSA as soon as they are identified. My hope is that this bill would help prevent future cyberattacks and disruption of services so individuals in crisis can access this resource and get the help they need.
Mr. Speaker, I urge my colleagues to support the bill, and I reserve the balance of my time.
BREAK IN TRANSCRIPT
Mr. GUTHRIE. Mr. Speaker, this is an important bill. We have our two good friends from California working together across the aisle in a bipartisan way in the Energy and Commerce Committee. This is an important bill to move forward.
Mr. Speaker, in closing, I urge my colleagues to support it, and I yield back the balance of my time.
BREAK IN TRANSCRIPT
Source