S. 1007 – 9–8–8 Lifeline Cybersecurity Responsibility Act

AI-Generated Summary

Updated November 24, 2025 at 1:59 AM UTC

The 9‑8‑8 Lifeline Cybersecurity Responsibility Act amends the Public Health Service Act to strengthen the National Suicide Prevention Lifeline’s defenses against cyber attacks. It creates new coordination duties with the HHS chief information security officer, sets rapid (within‑24‑hour) reporting requirements for cyber vulnerabilities and incidents by the program’s network administrator and participating crisis centers, and requires a federal study of the lifeline’s cyber risks. The bill targets the suicide‑prevention lifeline program, its network administrators, local and regional crisis centers, and HHS officials.

Key Provisions

Adds a new responsibility for the program to coordinate with the HHS Chief Information Security Officer to protect the 9‑8‑8 suicide‑prevention lifeline from cyber threats.
Requires the program’s federally funded network administrator to report any identified cybersecurity vulnerabilities or incidents to the Assistant Secretary within 24 hours, while protecting personal privacy.
Requires local and regional crisis centers that participate in the lifeline to report the same vulnerabilities or incidents to the network administrator within 24 hours, also protecting privacy.
Clarifies that crisis centers oversee their own technology, but the network administrator may also oversee crisis‑center technology if specified in participation agreements.
Mandates that these new reporting rules supplement, not replace, any existing federal cybersecurity reporting laws.
Orders the Comptroller General to study the lifeline’s cybersecurity risks and vulnerabilities within 180 days of enactment and report the findings to the relevant congressional committees.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

1 earlier action

SenateIntro Referral Latest Action

Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

Health, Education, Labor, and Pensions Committee

March 12, 2025

View full timeline

SenateIntro Referral

Introduced in Senate

March 12, 2025

SenateIntro Referral

Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

Health, Education, Labor, and Pensions Committee

March 12, 2025

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in SenateIssued March 12, 2025

II

119th CONGRESS

1st Session

S. 1007

IN THE SENATE OF THE UNITED STATES

March 12, 2025

Mr. Mullin (for himself and Mr. Padilla) introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions

A BILL

To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.

1.

Short title

This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act.

2.

Protecting suicide prevention lifeline from cybersecurity incidents

(a)

National suicide prevention lifeline program

Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended—

(1)

in paragraph (4), by striking and at the end;

(2)

in paragraph (5), by striking the period at the end and inserting ; and; and

(3)

by adding at the end the following:

(6)

coordinating with the Chief Information Security Officer of the Department of Health and Human Services to take such steps as may be necessary to ensure the program is protected from cybersecurity incidents and eliminates known cybersecurity vulnerabilities.

.

(b)

Reporting

Section 520E–3 of the Public Health Service Act (42 U.S.C. 290bb–36c) is amended—

(1)

by redesignating subsection (f) as subsection (g); and

(2)

by inserting after subsection (e) the following:

(f)

Cybersecurity reporting

(1)

In general

(A)

In general

The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

(i)

any identified cybersecurity vulnerabilities to the program within 24 hours of identification of such a vulnerability; and

(ii)

any identified cybersecurity incidents to the program within 24 hours of identification of such incident.

(B)

Local and regional crisis centers

Local and regional crisis centers participating in the program shall report to the program’s network administrator described in subparagraph (A), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

(i)

any identified cybersecurity vulnerabilities to the program within 24 hours of identification of such vulnerability; and

(ii)

any identified cybersecurity incidents to the program within 24 hours of identification of such incident.

(2)

Notification

If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident described in such paragraph, within 24 hours of such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary.

(3)

Clarification

(A)

Oversight

(i)

Local and regional crisis center

Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program.

(ii)

Network administrator

The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement.

(B)

Supplement, not supplant

The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act.

.

(c)

Study

Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall—

(1)

conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and

(2)

submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.