It's covered in 18 U.S. Code § 2258A - Reporting requirements of providers