IB 

Union Calendar No. 35 

118TH CONGRESS 

1ST SESSION H. R. 498 

[Report No. 118–52] 

To amend title V of the Public Health Service Act to secure the suicide 

prevention lifeline from cybersecurity incidents, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 25, 2023 

Mr. OBERNOLTE (for himself and Mr. CA ́RDENAS) introduced the following 

bill; which was referred to the Committee on Energy and Commerce 

MAY 11, 2023 

Reported with an amendment; committed to the Committee of the Whole 

House on the State of the Union and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on January 25, 2023] 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•HR 498 RH

A BILL 

To amend title V of the Public Health Service Act to secure 

the suicide prevention lifeline from cybersecurity incidents, and for other purposes. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•HR 498 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘9–8–8 Lifeline Cyberse5 curity Responsibility Act’’. 

6 SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM 

7 CYBERSECURITY INCIDENTS. 

8 (a) NATIONAL SUICIDE PREVENTION LIFELINE PRO9 GRAM.—Section 520E–3(b) of the Public Health Service Act 

10 (42 U.S.C. 290bb–36c(b)) is amended— 

11 (1) in paragraph (4), by striking ‘‘and’’ at the 

12 end; 

13 (2) in paragraph (5), by striking the period at 

14 the end and inserting ‘‘; and’’; and 

15 (3) by adding at the end the following: 

16 ‘‘(6) coordinating with the Chief Information Se17 curity Officer of the Department of Health and 

18 Human Services to take such steps as may be nec19 essary to ensure the program is protected from cyber20 security incidents and eliminates known cybersecurity 

21 vulnerabilities.’’. 

22 (b) REPORTING.—Section 520E–3 of the Public Health 

23 Service Act (42 U.S.C. 290bb–36c) is amended— 

24 (1) by redesignating subsection (f) as subsection 

25 (g); and 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•HR 498 RH

1 (2) by inserting after subsection (e) the following: 

2 ‘‘(f) CYBERSECURITY REPORTING.— 

3 ‘‘(1) IN GENERAL.— 

4 ‘‘(A) IN GENERAL.—The program’s network 

5 administrator receiving Federal funding pursu6 ant to subsection (a) shall report to the Assistant 

7 Secretary, in a manner that protects personal 

8 privacy, consistent with applicable Federal and 

9 State privacy laws— 

10 ‘‘(i) any identified cybersecurity 

11 vulnerabilities to the program immediately 

12 upon identification of such a vulnerability; 

13 and 

14 ‘‘(ii) any identified cybersecurity inci15 dents to the program immediately upon 

16 identification of such incident. 

17 ‘‘(B) LOCAL AND REGIONAL CRISIS CEN18 TERS.—Local and regional crisis centers partici19 pating in the program shall report to the pro20 gram’s network administrator identified in sub21 paragraph (A), in a manner that protects per22 sonal privacy, consistent with applicable Federal 

23 and State privacy laws— 

24 ‘‘(i) any identified cybersecurity 

25 vulnerabilities to the program immediately 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•HR 498 RH

1 upon identification of such vulnerability; 

2 and 

3 ‘‘(ii) any identified cybersecurity inci4 dents to the program immediately upon 

5 identification of such incident. 

6 ‘‘(2) NOTIFICATION.—If the program’s network 

7 administrator receiving funding pursuant to sub8 section (a) discovers, or is informed by a local or re9 gional crisis center pursuant to paragraph (1)(B) of, 

10 a cybersecurity vulnerability or incident, such entity 

11 shall immediately report that discovery to the Assist12 ant Secretary. 

13 ‘‘(3) CLARIFICATION.— 

14 ‘‘(A) OVERSIGHT.— 

15 ‘‘(i) LOCAL AND REGIONAL CRISIS CEN16 TER.—Except as provided in clause (ii), 

17 local and regional crisis centers partici18 pating in the program shall oversee all tech19 nology each center employs in the provision 

20 of services as a participant in the program. 

21 ‘‘(ii) NETWORK ADMINISTRATOR.— The 

22 program’s network administrator receiving 

23 Federal funding pursuant to subsection (a) 

24 shall oversee the technology each crisis cen25 ter employs in the provision of services as 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•HR 498 RH

1 a participant in the program if such over2 sight responsibilities are established in the 

3 applicable network participation agreement. 

4 ‘‘(B) SUPPLEMENT, NOT SUPPLANT.—The 

5 cybersecurity incident reporting requirements 

6 under this subsection shall supplement, and not 

7 supplant, cybersecurity incident reporting re8 quirements under other provisions of applicable 

9 Federal law that are in effect on the date of the 

10 enactment of the 9–8–8 Lifeline Cybersecurity 

11 Responsibility Act.’’. 

12 (c) STUDY.—Not later than 180 days after the date 

13 of the enactment of this Act, the Comptroller General of the 

14 United States shall— 

15 (1) conduct and complete a study that evaluates 

16 cybersecurity risks and vulnerabilities associated with 

17 the 9–8–8 National Suicide Prevention Lifeline; and 

18 (2) submit a report of the findings of such study 

19 to the Committee on Energy and Commerce of the 

20 House of Representatives and the Committee on 

21 Health, Education, Labor, and Pensions of the Sen22 ate. 


pbinns on DSKJLVW7X2PROD with $$_JOB

pbinns on DSKJLVW7X2PROD with $$_JOB
Union Calendar No. 35 

118TH CONGRESS 

1ST SESSION H. R. 498 

[Report No. 118–52] 

A BILL 

To amend title V of the Public Health Service Act 

bersecurity incidents, and for other purposes. to secure the suicide prevention lifeline from cyMAY 11, 2023 

Reported with an amendment; committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union 


pbinns on DSKJLVW7X2PROD with $$_JOB