,,ii  #aaith ,,congress  #ast ,session  
,s4 #ajjg  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,march #ab1    
#bjbe,mr4 ,mullin 7for himself and ,mr4 
,padilla7 introduced the following bill2
 which was read twice and referred to   
the ,committee on ,health1 ,education1  
,labor1 and ,pensions  ,a ,,bill  ,to   
amend title ,v of the ,public ,health   
,service ,act to secure the suicide     
prevention lifeline from cybersecurity  
incidents1 and for other purposes4  #a4 
,short title ,this ,act may be cited as 
the #i-h-h ,lifeline ,cybersecurity     
,responsibility ,act4  #b4 ,protecting  
suicide prevention lifeline from        
cybersecurity incidents  7a7 ,national  
suicide prevention lifeline program     
,section #ebj;,e-#c7;b7 of the ,public  
,health ,service ,act 7#db ,u4,s4,c4    
#bij;bb-#cf;c7b77 is amended-- 7#a7 in  
paragraph 7#d71 by striking and at the  
end2  7#b7 in paragraph 7#e71 by        
striking the period at the end and      
inserting 2 and2 and  7#c7 by adding at 

the end the following3  7#f7            
coordinating with the ,chief            
,information ,security ,officer of the  
,department of ,health and ,human       
,services to take such steps as may be  
necessary to ensure the program is      
protected from cybersecurity incidents  
and eliminates known cybersecurity      
vulnerabilities4  4  7b7 ,reporting     
,section #ebj;,e-#c of the ,public      
,health ,service ,act 7#db ,u4,s4,c4    
#bij;bb-#cf;c7 is amended-- 7#a7 by     
redesignating subsection 7f7 as         
subsection 7g72 and  7#b7 by inserting  
after subsection 7e7 the following3  7f7
 ,cybersecurity reporting  7#a7 ,in     
general  7,a7 ,in general ,the program's
 network administrator receiving        
,federal funding pursuant to subsection 
7a7 shall report to the ,assistant      
,secretary1 in a manner that protects   
personal privacy1 consistent with       
applicable ,federal and ,state privacy  
laws-- 7i7 any identified cybersecurity 
vulnerabilities to the program within   

#bd hours of identification of such a   
vulnerability2 and  7ii7 any identified 
cybersecurity incidents to the program  
within #bd hours of identification of   
such incident4  7,b7 ,local and regional
 crisis centers ,local and regional     
crisis centers participating in the     
program shall report to the program's   
network administrator described in      
subparagraph 7,a71 in a manner that     
protects personal privacy1 consistent   
with applicable ,federal and ,state     
privacy laws-- 7i7 any identified       
cybersecurity vulnerabilities to the    
program within #bd hours of             
identification of such vulnerability2   
and  7ii7 any identified cybersecurity  
incidents to the program within #bd     
hours of identification of such         
incident4  7#b7 ,notification ,if the   
program's network administrator         
receiving funding pursuant to subsection
 7a7 discovers1 or is informed by a     
local or regional crisis center pursuant
 to paragraph 7#a77;,b7 of1 a           

cybersecurity vulnerability or incident 
described in such paragraph1 within #bd 
hours of such discovery or receipt of   
information1 such entity shall report   
the vulnerability or incident to the    
,assistant ,secretary4  7#c7            
,clarification  7,a7 ,oversight  7i7    
,local and regional crisis center       
,except as provided in clause 7ii71     
local and regional crisis centers       
participating in the program shall      
oversee all technology each center      
employs in the provision of services as 
a participant in the program4  7ii7     
,network administrator ,the program's   
network administrator receiving ,federal
 funding pursuant to subsection 7a7     
shall oversee the technology each crisis
 center employs in the provision of     
services as a participant in the program
 if such oversight responsibilities are 
established in the applicable network   
participation agreement4  7,b7          
,supplement1 not supplant ,the          
cybersecurity incident reporting        

requirements under this subsection shall
 supplement1 and not supplant1          
cybersecurity incident reporting        
requirements under other provisions of  
applicable ,federal law that are in     
effect on the date of the enactment of  
the #i-h-h ,lifeline ,cybersecurity     
,responsibility ,act4  4  7c7 ,study    
,not later than #ahj days after the date
 of the enactment of this ,act1 the     
,comptroller ,general of the ,united    
,states shall-- 7#a7 conduct and        
complete a study that evaluates         
cybersecurity risks and vulnerabilities 
associated with the #i-h-h ,national    
,suicide ,prevention ,lifeline2 and     
7#b7 submit a report of the findings of 
such study to the ,committee on ,energy 
and ,commerce of the ,house of          
,representatives and the ,committee on  
,health1 ,education1 ,labor1 and        
,pensions of the ,senate4