Us Congress 2025-2026 Regular Session

Us Congress House Bill HB912 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	I
2	2	119THCONGRESS
3	3	1
4	4	STSESSION H. R. 912
5	5	To amend title V of the Public Health Service Act to secure the suicide
6	6	prevention lifeline from cybersecurity incidents, and for other purposes.
7	7	IN THE HOUSE OF REPRESENTATIVES
8	8	FEBRUARY4, 2025
9	9	Mr. O
10	10	BERNOLTE(for himself and Mrs. DINGELL) introduced the following
11	11	bill; which was referred to the Committee on Energy and Commerce
12	12	A BILL
13	13	To amend title V of the Public Health Service Act to secure
14	14	the suicide prevention lifeline from cybersecurity inci-
15	15	dents, and for other purposes.
16	16	Be it enacted by the Senate and House of Representa-1
17	17	tives of the United States of America in Congress assembled, 2
18	18	SECTION 1. SHORT TITLE. 3
19	19	This Act may be cited as the ‘‘9–8–8 Lifeline Cyber-4
20	20	security Responsibility Act’’. 5
21	21	SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 6
22	22	FROM CYBERSECURITY INCIDENTS. 7
23	23	(a) N
24	24	ATIONALSUICIDEPREVENTIONLIFELINEPRO-8
25	25	GRAM.—Section 520E–3(b) of the Public Health Service 9
26	26	Act (42 U.S.C. 290bb–36c(b)) is amended— 10
27	27	VerDate Sep 11 2014 03:45 Mar 05, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H912.IH H912
28	28	ssavage on LAPJG3WLY3PROD with BILLS 2
29	29	•HR 912 IH
30	30	(1) in paragraph (4), by striking ‘‘and’’ at the 1
31	31	end; 2
32	32	(2) in paragraph (5), by striking the period at 3
33	33	the end and inserting ‘‘; and’’; and 4
34	34	(3) by adding at the end the following: 5
35	35	‘‘(6) taking such steps as may be necessary to 6
36	36	ensure the suicide prevention hotline is protected 7
37	37	from cybersecurity incidents and eliminates known 8
38	38	cybersecurity vulnerabilities.’’. 9
39	39	(b) R
40	40	EPORTING.—Section 520E–3 of the Public 10
41	41	Health Service Act (42 U.S.C. 290bb–36c) is amended— 11
42	42	(1) by redesignating subsection (f) as sub-12
43	43	section (g); and 13
44	44	(2) by inserting after subsection (e) the fol-14
45	45	lowing: 15
46	46	‘‘(f) C
47	47	YBERSECURITYREPORTING.— 16
48	48	‘‘(1) N
49	49	OTIFICATION.— 17
50	50	‘‘(A) I
51	51	N GENERAL.—The program’s net-18
52	52	work administrator receiving Federal funding 19
53	53	pursuant to subsection (a) shall report to the 20
54	54	Assistant Secretary, in a manner that protects 21
55	55	personal privacy, consistent with applicable 22
56	56	Federal and State privacy laws— 23
57	57	‘‘(i) any identified cybersecurity 24
58	58	vulnerabilities to the program within a rea-25
59	59	VerDate Sep 11 2014 03:45 Mar 05, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H912.IH H912
60	60	ssavage on LAPJG3WLY3PROD with BILLS 3
61	61	•HR 912 IH
62	62	sonable amount of time after identification 1
63	63	of such a vulnerability; and 2
64	64	‘‘(ii) any identified cybersecurity inci-3
65	65	dents to the program within a reasonable 4
66	66	amount of time after identification of such 5
67	67	incident. 6
68	68	‘‘(B) L
69	69	OCAL AND REGIONAL CRISIS CEN -7
70	70	TERS.—Local and regional crisis centers par-8
71	71	ticipating in the program shall report to the 9
72	72	program’s network administrator identified 10
73	73	under subparagraph (A), in a manner that pro-11
74	74	tects personal privacy, consistent with applica-12
75	75	ble Federal and State privacy laws— 13
76	76	‘‘(i) any identified cybersecurity 14
77	77	vulnerabilities to the program within a rea-15
78	78	sonable amount of time after identification 16
79	79	of such vulnerability; and 17
80	80	‘‘(ii) any identified cybersecurity inci-18
81	81	dents to the program within a reasonable 19
82	82	amount of time after identification of such 20
83	83	incident. 21
84	84	‘‘(2) N
85	85	OTIFICATION.—If the program’s network 22
86	86	administrator receiving funding pursuant to sub-23
87	87	section (a) discovers, or is informed by a local or re-24
88	88	gional crisis center pursuant to paragraph (1)(B) of, 25
89	89	VerDate Sep 11 2014 03:45 Mar 05, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H912.IH H912
90	90	ssavage on LAPJG3WLY3PROD with BILLS 4
91	91	•HR 912 IH
92	92	a cybersecurity vulnerability or incident, within a 1
93	93	reasonable amount of time after such discovery or 2
94	94	receipt of information, such entity shall report the 3
95	95	vulnerability or incident to the Assistant Secretary. 4
96	96	‘‘(3) C
97	97	LARIFICATION.— 5
98	98	‘‘(A) O
99	99	VERSIGHT.— 6
100	100	‘‘(i) L
101	101	OCAL AND REGIONAL CRISIS 7
102	102	CENTERS.—Except as provided in clause 8
103	103	(ii), local and regional crisis centers par-9
104	104	ticipating in the program shall oversee all 10
105	105	technology each center employs in the pro-11
106	106	vision of services as a participant in the 12
107	107	program. 13
108	108	‘‘(ii) N
109	109	ETWORK ADMINISTRATOR .— 14
110	110	The program’s network administrator re-15
111	111	ceiving Federal funding pursuant to sub-16
112	112	section (a) shall oversee the technology 17
113	113	each crisis center employs in the provision 18
114	114	of services as a participant in the program 19
115	115	if such oversight responsibilities are estab-20
116	116	lished in the applicable network participa-21
117	117	tion agreement. 22
118	118	‘‘(B) S
119	119	UPPLEMENT, NOT SUPPLANT.—The 23
120	120	cybersecurity incident reporting requirements 24
121	121	under this subsection shall supplement, and not 25
122	122	VerDate Sep 11 2014 03:45 Mar 05, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H912.IH H912
123	123	ssavage on LAPJG3WLY3PROD with BILLS 5
124	124	•HR 912 IH
125	125	supplant, cybersecurity incident reporting re-1
126	126	quirements under other provisions of applicable 2
127	127	Federal law that are in effect on the date of the 3
128	128	enactment of the 9–8–8 Lifeline Cybersecurity 4
129	129	Responsibility Act.’’. 5
130	130	(c) S
131	131	TUDY.—Not later than 180 days after the date 6
132	132	of the enactment of this Act, the Comptroller General of 7
133	133	the United States shall— 8
134	134	(1) conduct and complete a study that evaluates 9
135	135	cybersecurity risks and vulnerabilities associated 10
136	136	with the 9–8–8 National Suicide Prevention Lifeline; 11
137	137	and 12
138	138	(2) submit a report on the findings of such 13
139	139	study to the Committee on Health, Education, 14
140	140	Labor, and Pensions of the Senate and the Com-15
141	141	mittee on Energy and Commerce of the House of 16
142	142	Representatives. 17
143	143	Æ
144	144	VerDate Sep 11 2014 03:45 Mar 05, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H912.IH H912
145	145	ssavage on LAPJG3WLY3PROD with BILLS