[Congressional Record Volume 170, Number 39 (Tuesday, March 5, 2024)]
[House]
[Pages H797-H798]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




            9-8-8 LIFELINE CYBERSECURITY RESPONSIBILITY ACT

  Mr. GUTHRIE. Mr. Speaker, I move to suspend the rules and pass the 
bill (H.R. 498) to amend title V of the Public Health Service Act to 
secure the suicide prevention lifeline from cybersecurity incidents, 
and for other purposes, as amended.
  The Clerk read the title of the bill.
  The text of the bill is as follows:

                                H.R. 498

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``9-8-8 Lifeline Cybersecurity 
     Responsibility Act''.

     SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM 
                   CYBERSECURITY INCIDENTS.

       (a) National Suicide Prevention Lifeline Program.--Section 
     520E-3(b) of the Public Health Service Act (42 U.S.C. 290bb-
     36c(b)) is amended--
       (1) in paragraph (4), by striking ``and'' at the end;
       (2) in paragraph (5), by striking the period at the end and 
     inserting ``; and''; and
       (3) by adding at the end the following:
       ``(6) taking such steps as may be necessary to ensure the 
     suicide prevention hotline is protected from cybersecurity 
     incidents and to eliminate known cybersecurity 
     vulnerabilities of such hotline.''.
       (b) Reporting.--Section 520E-3 of the Public Health Service 
     Act (42 U.S.C. 290bb-36c) is amended--
       (1) by redesignating subsection (f) as subsection (g); and
       (2) by inserting after subsection (e) the following:
       ``(f) Cybersecurity Reporting.--
       ``(1) Notification.--
       ``(A) In general.--The program's network administrator 
     receiving Federal funding pursuant to subsection (a) shall 
     report to the Assistant Secretary, in a manner that protects 
     personal privacy, consistent with applicable Federal and 
     State privacy laws--
       ``(i) any identified cybersecurity vulnerability to the 
     program within a reasonable amount of time after 
     identification of such a vulnerability; and
       ``(ii) any identified cybersecurity incident to the program 
     within a reasonable amount of time after identification of 
     such an incident.
       ``(B) Local and regional crisis centers.--Local and 
     regional crisis centers participating in the program shall 
     report to the program's network administrator receiving 
     Federal funding pursuant to subsection (a), in a manner that 
     protects personal privacy, consistent with applicable Federal 
     and State privacy laws--
       ``(i) any identified cybersecurity vulnerability to the 
     program within a reasonable amount of time after 
     identification of such a vulnerability; and
       ``(ii) any identified cybersecurity incident to the program 
     within a reasonable amount of time after identification of 
     such an incident.
       ``(2) Notification.--If the program's network administrator 
     receiving funding pursuant to subsection (a) discovers, or is 
     informed by a local or regional crisis center pursuant to 
     paragraph (1)(B) of, a cybersecurity vulnerability or 
     incident, within a reasonable amount of time after such 
     discovery or receipt of information, such entity shall report 
     the vulnerability or incident to the Assistant Secretary.
       ``(3) Clarification.--
       ``(A) Oversight.--
       ``(i) Local and regional crisis center.--Except as provided 
     in clause (ii), local and regional crisis centers 
     participating in the program shall oversee all technology 
     each center employs in the provision of services as a 
     participant in the program.
       ``(ii) Network administrator.--The program's network 
     administrator receiving Federal funding pursuant to 
     subsection (a) shall oversee the technology each crisis 
     center employs in the provision of services as a participant 
     in the program if such oversight responsibilities are 
     established in the applicable network participation 
     agreement.
       ``(B) Supplement, not supplant.--The cybersecurity incident 
     reporting requirements under this subsection shall 
     supplement, and not supplant, cybersecurity incident 
     reporting requirements under other provisions of applicable 
     Federal law that are in effect on the date of the enactment 
     of the 9-8-8 Lifeline Cybersecurity Responsibility Act.''.
       (c) Study.--Not later than 180 days after the date of the 
     enactment of this Act, the Comptroller General of the United 
     States shall--
       (1) conduct and complete a study that evaluates 
     cybersecurity risks and vulnerabilities associated with the 
     9-8-8 National Suicide Prevention Lifeline; and
       (2) submit a report of the findings of such study to the 
     Committee on Energy and Commerce of the House of 
     Representatives and the Committee on Health, Education, 
     Labor, and Pensions of the Senate.

  The SPEAKER pro tempore. Pursuant to the rule, the gentleman from 
Kentucky (Mr. Guthrie) and the gentlewoman from Washington (Ms. 
Schrier) each will control 20 minutes.
  The Chair recognizes the gentleman from Kentucky.


                             General Leave

  Mr. GUTHRIE. Mr. Speaker, I ask unanimous consent that all Members 
may have 5 legislative days in which to revise and extend their remarks 
and include extraneous material in the Record on the bill.
  The SPEAKER pro tempore. Is there objection to the request of the 
gentleman from Kentucky?
  There was no objection.
  Mr. GUTHRIE. Mr. Speaker, I yield myself such time as I may consume.
  Mr. Speaker, I rise in support of H.R. 498, the 9-8-8 Lifeline 
Cybersecurity Responsibility Act, led by Mr. Obernolte.
  In 2021, more than 48,000 people died by suicide in the United 
States. That equates to 132 people every day. These are our family 
members, our neighbors, and our friends. This number is staggering, and 
unfortunately, suicide deaths are continuing to rise. People need hope 
and healing.
  The 988 Suicide & Crisis Lifeline is a national network of local 
crisis centers used to support people in suicidal crisis or emotional 
distress. This has proven to be a vital resource, especially during the 
COVID-19 pandemic when government-imposed lockdowns led to increased 
social isolation and loneliness.
  The lifeline suffered a cybersecurity attack in December 2022 and was 
proactively taken offline for several hours. It is unknown how many 
individuals were hurt by the outage, but we do know that individuals in 
emotional distress or suicide crisis were unable to utilize the 
lifeline for hours.
  H.R. 498 would improve the lifeline's cybersecurity protections by 
requiring coordination between SAMHSA and the chief information 
security officer within HHS.
  Additionally, this bill would require the lifeline administrator and 
local call centers to report any cybersecurity incidents and 
vulnerabilities to SAMHSA as soon as they are identified. My hope is 
that this bill would help prevent future cyberattacks and disruption of 
services so individuals in crisis can access this resource and get the 
help they need.
  Mr. Speaker, I urge my colleagues to support the bill, and I reserve 
the balance of my time.
  Ms. SCHRIER. Mr. Speaker, I yield myself such time as I may consume.
  Mr. Speaker, I rise today in support of H.R. 498, the 9-8-8 Lifeline 
Cybersecurity Responsibility Act, sponsored by my colleagues, 
Representatives Cardenas and Obernolte.
  On July 16, 2022, the 988 lifeline became available to all landline 
and cell phone users to access a network of over 200 local- and State-
funded crisis centers. The suicide and crisis lifeline is there for 
anyone who is struggling with anxiety, depression, or suicidal 
ideation.
  Since its launch, according to data from the Kaiser Family 
Foundation,

[[Page H798]]

the 988 lifeline has received almost 5 million contacts. Nearly 1 
million are from the Veterans Crisis Line, a designated part of 988. 
The others have consisted of 2.6 million calls, almost three-quarters 
of a million chats, and more than 600,000 texts.
  In December 2022, the 988 lifeline experienced a cybersecurity 
breach, which resulted in a daylong outage across the country. This 
lifeline is imperative to suicide prevention and utilized by 
constituents in every one of our districts.
  The legislation on the floor today would require better coordination 
and reporting on potential cybersecurity vulnerabilities within the 988 
lifeline with the goal of preventing future cyberattacks and disruption 
of services. The bill would require coordination between the lifeline 
and the chief information security officer at the Department of Health 
and Human Services to prevent cybersecurity attacks. The suicide 
hotline's regional and local network administrators would also be 
required to notify the government of cybersecurity vulnerabilities and 
incidents. Finally, the Government Accountability Office would be 
required to conduct a study evaluating cybersecurity risks and 
vulnerabilities in the 988 lifeline system.
  Mr. Speaker, I encourage all of my colleagues to vote ``yes'' on this 
important bill, and I reserve the balance of my time.
  Mr. GUTHRIE. Mr. Speaker, I yield 3 minutes to the gentleman from 
California (Mr. Obernolte), who is a leader of cybersecurity in this 
Congress and a member of the Energy and Commerce Committee.
  Mr. OBERNOLTE. Mr. Speaker, I thank the gentleman from Kentucky, my 
friend and colleague, for the opportunity to present my bill, H.R. 498, 
the 9-8-8 Lifeline Cybersecurity Responsibility Act.
  Mr. Speaker, according to the CDC, in 2022, nearly 50,000 Americans 
took their own lives. This is a shocking and, frankly, shameful 
commentary on the state of mental health in this country. Mr. Speaker, 
that amounts to over 100 suicides a day.
  In response to this growing crisis, in 2005, Congress authorized the 
988 lifeline. 988 is a 24-hour, 7-day-a-week hotline that anyone with 
suicidal thoughts can call to be connected to counseling and resources.
  In the first year of operation, the 988 lifeline received nearly 
50,000 calls, and it has continued to grow in the years since then. It 
has undoubtedly saved thousands of American lives.
  Unfortunately, 14 months ago, the 988 lifeline was taken down by a 
cyberattack on its systems operator.
  Mr. Speaker, every minute that lifeline is offline is the potential 
for the loss of American lives because those resources are not 
available to them. This bill is an attempt to solve that problem.
  H.R. 498 would require 988 systems operators to report cybersecurity 
vulnerabilities and would require the Department of Health and Human 
Services to coordinate in addressing those vulnerabilities.
  The bill would also require the Comptroller General to create a study 
of the cybersecurity vulnerabilities on the hotline and the ways that 
those vulnerabilities can be addressed.
  Mr. Speaker, the 988 lifeline is a vital resource for Americans who 
might be having suicidal thoughts or contemplating the irrevocable act 
of taking their own lives. This bill is a small step in making sure 
that that lifeline remains available to the Americans who are depending 
on it.
  Mr. Speaker, I thank the gentleman from Kentucky for bringing this 
bill forward to the floor, and I respectfully urge my colleagues to 
vote ``yes'' and pass this bill to the Senate.
  Ms. SCHRIER. Mr. Speaker, I yield such time as he may consume to the 
gentleman from the State of California (Mr. Cardenas) to discuss this 
bill.
  Mr. CARDENAS. Mr. Speaker, I thank the gentlewoman for yielding.
  Mr. Speaker, I rise today--actually, I ran over here--as a proud 
partner with my colleague, Representative Obernolte, to support the 
passage of the 9-8-8 Lifeline Cybersecurity Responsibility Act, which 
would help to protect the 988 lifeline from any future cyber 
interference.
  Unfortunately, suicide is the second leading cause of death among our 
young people in America. Prior to the COVID-19 pandemic, it was the 
10th leading cause of death in our Nation. We need to treat this as the 
legitimate health crisis that it is.
  This is one of the reasons why I believe there is so much promise in 
the 988 Suicide & Crisis Lifeline. Not only does the three-digit 
calling code provide a 24/7 lifeline to individuals in crisis from 
anywhere in the United States, but it also represents a change in the 
way we think and respond to mental illness as something that warrants 
help and support, just like other kinds of health conditions.

                              {time}  1630

  Mr. Speaker, 988, in its fullest form, is not just a number, but a 
connection to a full mental health crisis response.
  Since I know that I have limited time, there is much more to be said, 
but let me tell my colleagues: This is a perfect example why the people 
of America send us to Washington, D.C.--to come together, to recognize 
what we need to fix, and to come together as Republicans and Democrats 
from both sides of the aisle to work together to create one of the best 
systems this country and this world will ever know.
  Mr. Speaker, 911 is something that any American can take for granted, 
because we created that almost 70 years ago, where people will call 
911, and they know somebody is going to come and save a life.
  So 988 is exactly what we need to do for the American people. That is 
why I am so proud to work with my colleague, Congressman Obernolte, to 
make sure that we move this forward and put our children, our country, 
our families, and our communities in a better place in any moment of a 
mental health crisis.
  Ms. SCHRIER. Mr. Speaker, I yield myself the balance of my time to 
close.
  Mr. Speaker, I have visited the 988 center in my area and seen the 
dedication of the providers, and we need to make sure that we protect 
this lifeline from cybersecurity risks.
  Mr. Speaker, I encourage my colleagues to vote for this bill, and I 
yield back the balance of my time.
  Mr. GUTHRIE. Mr. Speaker, this is an important bill. We have our two 
good friends from California working together across the aisle in a 
bipartisan way in the Energy and Commerce Committee. This is an 
important bill to move forward.
  Mr. Speaker, in closing, I urge my colleagues to support it, and I 
yield back the balance of my time.
  The SPEAKER pro tempore (Mr. Meuser). The question is on the motion 
offered by the gentleman from Kentucky (Mr. Guthrie) that the House 
suspend the rules and pass the bill, H.R. 498, as amended.
  The question was taken; and (two-thirds being in the affirmative) the 
rules were suspended and the bill, as amended, was passed.
  A motion to reconsider was laid on the table.

                          ____________________