9–8–8 Lifeline Cybersecurity Responsibility Act
The 9-8-8 Lifeline Cybersecurity Responsibility Act is a Senate bill introduced in the 119th Congress that would strengthen the cybersecurity of the 9-8-8 National Suicide Prevention Lifeline by amending the Public Health Service Act. Its core aim is to protect the lifeline from cyber threats, ensure rapid reporting of vulnerabilities and incidents, and require a government study to assess risks. The bill would add responsibilities for coordinating with the Department of Health and Human Services’ Chief Information Security Officer, mandate 24-hour reporting for identified cybersecurity vulnerabilities and incidents, and clarify oversight roles among local crisis centers and the program’s network administrator. It also directs a Comptroller General study within 180 days to evaluate cybersecurity risks and vulnerabilities. If enacted, the measure could lead to more robust cyber defenses for the lifeline, faster detection and disclosure of cyber events, and stronger privacy safeguards in reporting. However, it would also increase compliance obligations for network administrators and local crisis centers participating in the lifeline network, and would mandate a government review to inform future cybersecurity policy for the program.
Key Points
- 1Amends the Public Health Service Act to secure the 9-8-8 Lifeline from cybersecurity incidents, including coordination with the Department of Health and Human Services Chief Information Security Officer (CISO) to address vulnerabilities.
- 2Adds a Cybersecurity Reporting requirement requiring network administrators receiving federal funding to report identified vulnerabilities and incidents to the Assistant Secretary within 24 hours, and requires local/regional crisis centers to report to the network administrator within 24 hours.
- 3Establishes a notification process: once a vulnerability or incident is discovered, the relevant entity must report it to the Assistant Secretary within 24 hours.
- 4Clarifies oversight roles: local/regional crisis centers typically oversee the technology they use, with potential oversight by the network administrator if specified in agreements; emphasizes that reporting requirements supplement, not replace, other federal cybersecurity laws.
- 5Requires a Comptroller General study within 180 days evaluating cybersecurity risks and vulnerabilities of the 9-8-8 Lifeline, with a report to Congress.