H.R. 498 — what changed

changed “(6) coordinating with the Chief Information Security Officer of the Department of Health and Human Services to take taking such steps as may be necessary to ensure the program suicide prevention hotline is protected from cybersecurity incidents and eliminates to eliminate known cybersecurity vulnerabilities.”vulnerabilities of such hotline.”

“(f) Cybersecurity reporting

changed “(1) In generalNotification

“(A) In general—The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

changed “(i) any identified cybersecurity vulnerabilities vulnerability to the program immediately upon within a reasonable amount of time after identification of such a vulnerability; and

changed “(ii) any identified cybersecurity incidents incident to the program immediately upon within a reasonable amount of time after identification of such an incident.

changed “(B) Local and regional crisis centers—Local and regional crisis centers participating in the program shall report to the program’s network administrator identified in subparagraph (A), receiving Federal funding pursuant to subsection (a), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

changed “(i) any identified cybersecurity vulnerabilities vulnerability to the program immediately upon within a reasonable amount of time after identification of such a vulnerability; and

changed “(ii) any identified cybersecurity incidents incident to the program immediately upon within a reasonable amount of time after identification of such an incident.

changed “(2) Notification—If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall immediately report that discovery the vulnerability or incident to the Assistant Secretary.

“(3) Clarification

“(A) Oversight

“(i) Local and regional crisis center—Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program.

“(ii) Network administrator—The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement.

“(B) Supplement, not supplant—The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act.”