IIB 

118TH CONGRESS 

2D SESSION H. R. 498 

IN THE SENATE OF THE UNITED STATES 

MARCH 6, 2024 

Received; read twice and referred to the Committee on Health, Education, 

Labor, and Pensions 

AN ACT 

To amend title V of the Public Health Service Act to secure 

the suicide prevention lifeline from cybersecurity incidents, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

HR 498 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘9–8–8 Lifeline Cyber3 security Responsibility Act’’. 

4 SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 

5 FROM CYBERSECURITY INCIDENTS. 

6 (a) NATIONAL SUICIDE PREVENTION LIFELINE PRO7 GRAM.—Section 520E–3(b) of the Public Health Service 

8 Act (42 U.S.C. 290bb–36c(b)) is amended— 

9 (1) in paragraph (4), by striking ‘‘and’’ at the 

10 end; 

11 (2) in paragraph (5), by striking the period at 

12 the end and inserting ‘‘; and’’; and 

13 (3) by adding at the end the following: 

14 ‘‘(6) taking such steps as may be necessary to 

15 ensure the suicide prevention hotline is protected 

16 from cybersecurity incidents and to eliminate known 

17 cybersecurity vulnerabilities of such hotline.’’. 

18 (b) REPORTING.—Section 520E–3 of the Public 

19 Health Service Act (42 U.S.C. 290bb–36c) is amended— 

20 (1) by redesignating subsection (f) as sub21 section (g); and 

22 (2) by inserting after subsection (e) the fol23 lowing: 

24 ‘‘(f) CYBERSECURITY REPORTING.— 

25 ‘‘(1) NOTIFICATION.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

HR 498 RFS

1 ‘‘(A) IN GENERAL.—The program’s net2 work administrator receiving Federal funding 

3 pursuant to subsection (a) shall report to the 

4 Assistant Secretary, in a manner that protects 

5 personal privacy, consistent with applicable 

6 Federal and State privacy laws— 

7 ‘‘(i) any identified cybersecurity vul8 nerability to the program within a reason9 able amount of time after identification of 

10 such a vulnerability; and 

11 ‘‘(ii) any identified cybersecurity inci12 dent to the program within a reasonable 

13 amount of time after identification of such 

14 an incident. 

15 ‘‘(B) LOCAL AND REGIONAL CRISIS CEN16 TERS.—Local and regional crisis centers par17 ticipating in the program shall report to the 

18 program’s network administrator receiving Fed19 eral funding pursuant to subsection (a), in a 

20 manner that protects personal privacy, con21 sistent with applicable Federal and State pri22 vacy laws— 

23 ‘‘(i) any identified cybersecurity vul24 nerability to the program within a reasonVerDate Sep 11 2014 02:49 Mar 07, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H498.RFS H498

kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

HR 498 RFS

1 able amount of time after identification of 

2 such a vulnerability; and 

3 ‘‘(ii) any identified cybersecurity inci4 dent to the program within a reasonable 

5 amount of time after identification of such 

6 an incident. 

7 ‘‘(2) NOTIFICATION.—If the program’s network 

8 administrator receiving funding pursuant to sub9 section (a) discovers, or is informed by a local or re10 gional crisis center pursuant to paragraph (1)(B) of, 

11 a cybersecurity vulnerability or incident, within a 

12 reasonable amount of time after such discovery or 

13 receipt of information, such entity shall report the 

14 vulnerability or incident to the Assistant Secretary. 

15 ‘‘(3) CLARIFICATION.— 

16 ‘‘(A) OVERSIGHT.— 

17 ‘‘(i) LOCAL AND REGIONAL CRISIS

18 CENTER.—Except as provided in clause 

19 (ii), local and regional crisis centers par20 ticipating in the program shall oversee all 

21 technology each center employs in the pro22 vision of services as a participant in the 

23 program. 

24 ‘‘(ii) NETWORK ADMINISTRATOR.— 

25 The program’s network administrator reVerDate Sep 11 2014 02:49 Mar 07, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H498.RFS H498

kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

HR 498 RFS

1 ceiving Federal funding pursuant to sub2 section (a) shall oversee the technology 

3 each crisis center employs in the provision 

4 of services as a participant in the program 

5 if such oversight responsibilities are estab6 lished in the applicable network participa7 tion agreement. 

8 ‘‘(B) SUPPLEMENT, NOT SUPPLANT.—The 

9 cybersecurity incident reporting requirements 

10 under this subsection shall supplement, and not 

11 supplant, cybersecurity incident reporting re12 quirements under other provisions of applicable 

13 Federal law that are in effect on the date of the 

14 enactment of the 9–8–8 Lifeline Cybersecurity 

15 Responsibility Act.’’. 

16 (c) STUDY.—Not later than 180 days after the date 

17 of the enactment of this Act, the Comptroller General of 

18 the United States shall— 

19 (1) conduct and complete a study that evaluates 

20 cybersecurity risks and vulnerabilities associated 

21 with the 9–8–8 National Suicide Prevention Lifeline; 

22 and 

23 (2) submit a report of the findings of such 

24 study to the Committee on Energy and Commerce of 

25 the House of Representatives and the Committee on 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

HR 498 RFS

1 Health, Education, Labor, and Pensions of the Sen2 ate. 

Passed the House of Representatives March 5, 

2024. 

Attest: KEVIN F. MCCUMBER, 

Clerk. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB