[Congressional Record Volume 170, Number 39 (Tuesday, March 5, 2024)]
[House]
[Pages H797-H798]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
9-8-8 LIFELINE CYBERSECURITY RESPONSIBILITY ACT
Mr. GUTHRIE. Mr. Speaker, I move to suspend the rules and pass the
bill (H.R. 498) to amend title V of the Public Health Service Act to
secure the suicide prevention lifeline from cybersecurity incidents,
and for other purposes, as amended.
The Clerk read the title of the bill.
The text of the bill is as follows:
H.R. 498
Be it enacted by the Senate and House of Representatives of
the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``9-8-8 Lifeline Cybersecurity
Responsibility Act''.
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM
CYBERSECURITY INCIDENTS.
(a) National Suicide Prevention Lifeline Program.--Section
520E-3(b) of the Public Health Service Act (42 U.S.C. 290bb-
36c(b)) is amended--
(1) in paragraph (4), by striking ``and'' at the end;
(2) in paragraph (5), by striking the period at the end and
inserting ``; and''; and
(3) by adding at the end the following:
``(6) taking such steps as may be necessary to ensure the
suicide prevention hotline is protected from cybersecurity
incidents and to eliminate known cybersecurity
vulnerabilities of such hotline.''.
(b) Reporting.--Section 520E-3 of the Public Health Service
Act (42 U.S.C. 290bb-36c) is amended--
(1) by redesignating subsection (f) as subsection (g); and
(2) by inserting after subsection (e) the following:
``(f) Cybersecurity Reporting.--
``(1) Notification.--
``(A) In general.--The program's network administrator
receiving Federal funding pursuant to subsection (a) shall
report to the Assistant Secretary, in a manner that protects
personal privacy, consistent with applicable Federal and
State privacy laws--
``(i) any identified cybersecurity vulnerability to the
program within a reasonable amount of time after
identification of such a vulnerability; and
``(ii) any identified cybersecurity incident to the program
within a reasonable amount of time after identification of
such an incident.
``(B) Local and regional crisis centers.--Local and
regional crisis centers participating in the program shall
report to the program's network administrator receiving
Federal funding pursuant to subsection (a), in a manner that
protects personal privacy, consistent with applicable Federal
and State privacy laws--
``(i) any identified cybersecurity vulnerability to the
program within a reasonable amount of time after
identification of such a vulnerability; and
``(ii) any identified cybersecurity incident to the program
within a reasonable amount of time after identification of
such an incident.
``(2) Notification.--If the program's network administrator
receiving funding pursuant to subsection (a) discovers, or is
informed by a local or regional crisis center pursuant to
paragraph (1)(B) of, a cybersecurity vulnerability or
incident, within a reasonable amount of time after such
discovery or receipt of information, such entity shall report
the vulnerability or incident to the Assistant Secretary.
``(3) Clarification.--
``(A) Oversight.--
``(i) Local and regional crisis center.--Except as provided
in clause (ii), local and regional crisis centers
participating in the program shall oversee all technology
each center employs in the provision of services as a
participant in the program.
``(ii) Network administrator.--The program's network
administrator receiving Federal funding pursuant to
subsection (a) shall oversee the technology each crisis
center employs in the provision of services as a participant
in the program if such oversight responsibilities are
established in the applicable network participation
agreement.
``(B) Supplement, not supplant.--The cybersecurity incident
reporting requirements under this subsection shall
supplement, and not supplant, cybersecurity incident
reporting requirements under other provisions of applicable
Federal law that are in effect on the date of the enactment
of the 9-8-8 Lifeline Cybersecurity Responsibility Act.''.
(c) Study.--Not later than 180 days after the date of the
enactment of this Act, the Comptroller General of the United
States shall--
(1) conduct and complete a study that evaluates
cybersecurity risks and vulnerabilities associated with the
9-8-8 National Suicide Prevention Lifeline; and
(2) submit a report of the findings of such study to the
Committee on Energy and Commerce of the House of
Representatives and the Committee on Health, Education,
Labor, and Pensions of the Senate.
The SPEAKER pro tempore. Pursuant to the rule, the gentleman from
Kentucky (Mr. Guthrie) and the gentlewoman from Washington (Ms.
Schrier) each will control 20 minutes.
The Chair recognizes the gentleman from Kentucky.
General Leave
Mr. GUTHRIE. Mr. Speaker, I ask unanimous consent that all Members
may have 5 legislative days in which to revise and extend their remarks
and include extraneous material in the Record on the bill.
The SPEAKER pro tempore. Is there objection to the request of the
gentleman from Kentucky?
There was no objection.
Mr. GUTHRIE. Mr. Speaker, I yield myself such time as I may consume.
Mr. Speaker, I rise in support of H.R. 498, the 9-8-8 Lifeline
Cybersecurity Responsibility Act, led by Mr. Obernolte.
In 2021, more than 48,000 people died by suicide in the United
States. That equates to 132 people every day. These are our family
members, our neighbors, and our friends. This number is staggering, and
unfortunately, suicide deaths are continuing to rise. People need hope
and healing.
The 988 Suicide & Crisis Lifeline is a national network of local
crisis centers used to support people in suicidal crisis or emotional
distress. This has proven to be a vital resource, especially during the
COVID-19 pandemic when government-imposed lockdowns led to increased
social isolation and loneliness.
The lifeline suffered a cybersecurity attack in December 2022 and was
proactively taken offline for several hours. It is unknown how many
individuals were hurt by the outage, but we do know that individuals in
emotional distress or suicide crisis were unable to utilize the
lifeline for hours.
H.R. 498 would improve the lifeline's cybersecurity protections by
requiring coordination between SAMHSA and the chief information
security officer within HHS.
Additionally, this bill would require the lifeline administrator and
local call centers to report any cybersecurity incidents and
vulnerabilities to SAMHSA as soon as they are identified. My hope is
that this bill would help prevent future cyberattacks and disruption of
services so individuals in crisis can access this resource and get the
help they need.
Mr. Speaker, I urge my colleagues to support the bill, and I reserve
the balance of my time.
Ms. SCHRIER. Mr. Speaker, I yield myself such time as I may consume.
Mr. Speaker, I rise today in support of H.R. 498, the 9-8-8 Lifeline
Cybersecurity Responsibility Act, sponsored by my colleagues,
Representatives Cardenas and Obernolte.
On July 16, 2022, the 988 lifeline became available to all landline
and cell phone users to access a network of over 200 local- and State-
funded crisis centers. The suicide and crisis lifeline is there for
anyone who is struggling with anxiety, depression, or suicidal
ideation.
Since its launch, according to data from the Kaiser Family
Foundation,
[[Page H798]]
the 988 lifeline has received almost 5 million contacts. Nearly 1
million are from the Veterans Crisis Line, a designated part of 988.
The others have consisted of 2.6 million calls, almost three-quarters
of a million chats, and more than 600,000 texts.
In December 2022, the 988 lifeline experienced a cybersecurity
breach, which resulted in a daylong outage across the country. This
lifeline is imperative to suicide prevention and utilized by
constituents in every one of our districts.
The legislation on the floor today would require better coordination
and reporting on potential cybersecurity vulnerabilities within the 988
lifeline with the goal of preventing future cyberattacks and disruption
of services. The bill would require coordination between the lifeline
and the chief information security officer at the Department of Health
and Human Services to prevent cybersecurity attacks. The suicide
hotline's regional and local network administrators would also be
required to notify the government of cybersecurity vulnerabilities and
incidents. Finally, the Government Accountability Office would be
required to conduct a study evaluating cybersecurity risks and
vulnerabilities in the 988 lifeline system.
Mr. Speaker, I encourage all of my colleagues to vote ``yes'' on this
important bill, and I reserve the balance of my time.
Mr. GUTHRIE. Mr. Speaker, I yield 3 minutes to the gentleman from
California (Mr. Obernolte), who is a leader of cybersecurity in this
Congress and a member of the Energy and Commerce Committee.
Mr. OBERNOLTE. Mr. Speaker, I thank the gentleman from Kentucky, my
friend and colleague, for the opportunity to present my bill, H.R. 498,
the 9-8-8 Lifeline Cybersecurity Responsibility Act.
Mr. Speaker, according to the CDC, in 2022, nearly 50,000 Americans
took their own lives. This is a shocking and, frankly, shameful
commentary on the state of mental health in this country. Mr. Speaker,
that amounts to over 100 suicides a day.
In response to this growing crisis, in 2005, Congress authorized the
988 lifeline. 988 is a 24-hour, 7-day-a-week hotline that anyone with
suicidal thoughts can call to be connected to counseling and resources.
In the first year of operation, the 988 lifeline received nearly
50,000 calls, and it has continued to grow in the years since then. It
has undoubtedly saved thousands of American lives.
Unfortunately, 14 months ago, the 988 lifeline was taken down by a
cyberattack on its systems operator.
Mr. Speaker, every minute that lifeline is offline is the potential
for the loss of American lives because those resources are not
available to them. This bill is an attempt to solve that problem.
H.R. 498 would require 988 systems operators to report cybersecurity
vulnerabilities and would require the Department of Health and Human
Services to coordinate in addressing those vulnerabilities.
The bill would also require the Comptroller General to create a study
of the cybersecurity vulnerabilities on the hotline and the ways that
those vulnerabilities can be addressed.
Mr. Speaker, the 988 lifeline is a vital resource for Americans who
might be having suicidal thoughts or contemplating the irrevocable act
of taking their own lives. This bill is a small step in making sure
that that lifeline remains available to the Americans who are depending
on it.
Mr. Speaker, I thank the gentleman from Kentucky for bringing this
bill forward to the floor, and I respectfully urge my colleagues to
vote ``yes'' and pass this bill to the Senate.
Ms. SCHRIER. Mr. Speaker, I yield such time as he may consume to the
gentleman from the State of California (Mr. Cardenas) to discuss this
bill.
Mr. CARDENAS. Mr. Speaker, I thank the gentlewoman for yielding.
Mr. Speaker, I rise today--actually, I ran over here--as a proud
partner with my colleague, Representative Obernolte, to support the
passage of the 9-8-8 Lifeline Cybersecurity Responsibility Act, which
would help to protect the 988 lifeline from any future cyber
interference.
Unfortunately, suicide is the second leading cause of death among our
young people in America. Prior to the COVID-19 pandemic, it was the
10th leading cause of death in our Nation. We need to treat this as the
legitimate health crisis that it is.
This is one of the reasons why I believe there is so much promise in
the 988 Suicide & Crisis Lifeline. Not only does the three-digit
calling code provide a 24/7 lifeline to individuals in crisis from
anywhere in the United States, but it also represents a change in the
way we think and respond to mental illness as something that warrants
help and support, just like other kinds of health conditions.
{time} 1630
Mr. Speaker, 988, in its fullest form, is not just a number, but a
connection to a full mental health crisis response.
Since I know that I have limited time, there is much more to be said,
but let me tell my colleagues: This is a perfect example why the people
of America send us to Washington, D.C.--to come together, to recognize
what we need to fix, and to come together as Republicans and Democrats
from both sides of the aisle to work together to create one of the best
systems this country and this world will ever know.
Mr. Speaker, 911 is something that any American can take for granted,
because we created that almost 70 years ago, where people will call
911, and they know somebody is going to come and save a life.
So 988 is exactly what we need to do for the American people. That is
why I am so proud to work with my colleague, Congressman Obernolte, to
make sure that we move this forward and put our children, our country,
our families, and our communities in a better place in any moment of a
mental health crisis.
Ms. SCHRIER. Mr. Speaker, I yield myself the balance of my time to
close.
Mr. Speaker, I have visited the 988 center in my area and seen the
dedication of the providers, and we need to make sure that we protect
this lifeline from cybersecurity risks.
Mr. Speaker, I encourage my colleagues to vote for this bill, and I
yield back the balance of my time.
Mr. GUTHRIE. Mr. Speaker, this is an important bill. We have our two
good friends from California working together across the aisle in a
bipartisan way in the Energy and Commerce Committee. This is an
important bill to move forward.
Mr. Speaker, in closing, I urge my colleagues to support it, and I
yield back the balance of my time.
The SPEAKER pro tempore (Mr. Meuser). The question is on the motion
offered by the gentleman from Kentucky (Mr. Guthrie) that the House
suspend the rules and pass the bill, H.R. 498, as amended.
The question was taken; and (two-thirds being in the affirmative) the
rules were suspended and the bill, as amended, was passed.
A motion to reconsider was laid on the table.
____________________