I 

118TH CONGRESS 

1ST SESSION H. R. 498 

To amend title V of the Public Health Service Act to secure the suicide 

prevention lifeline from cybersecurity incidents, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 25, 2023 

Mr. OBERNOLTE (for himself and Mr. CA ́RDENAS) introduced the following 

bill; which was referred to the Committee on Energy and Commerce 

A BILL 

To amend title V of the Public Health Service Act to secure 

the suicide prevention lifeline from cybersecurity incidents, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘9–8–8 Lifeline Cyber5 security Responsibility Act’’. 

6 SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 

7 FROM CYBERSECURITY INCIDENTS. 

8 (a) SUICIDE PREVENTION LIFELINE.—Section 

9 520E–3(b) of the Public Health Service Act (42 U.S.C. 

10 290bb–36c(b)) is amended— 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•HR 498 IH

1 (1) in paragraph (4), by striking ‘‘and’’ at the 

2 end; 

3 (2) in paragraph (5), by striking the period at 

4 the end and inserting ‘‘; and’’; and 

5 (3) by adding at the end the following: 

6 ‘‘(6) coordinating with the Chief Information 

7 Security Officer of the Department of Health and 

8 Human Services to take such steps as may be nec9 essary to ensure the program is protected from cy10 bersecurity incidents and eliminates known cyberse11 curity vulnerabilities.’’. 

12 (b) REPORTING.—Section 520E–3 of the Public 

13 Health Service Act (42 U.S.C. 290bb–36c) is amended— 

14 (1) by redesignating subsection (f) as sub15 section (g); and 

16 (2) by inserting after subsection (e) the fol17 lowing: 

18 ‘‘(f) CYBERSECURITY REPORTING.— 

19 ‘‘(1) IN GENERAL.—The program’s network ad20 ministrator receiving Federal funding pursuant to 

21 subsection (a) shall report to the Assistant Sec22 retary, in a manner that protects personal privacy, 

23 consistent with applicable Federal and State privacy 

24 laws— 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•HR 498 IH

1 ‘‘(A) any identified cybersecurity 

2 vulnerabilities to the National Suicide Preven3 tion Lifeline; and 

4 ‘‘(B) any identified cybersecurity incidents 

5 or potential incidents to the National Suicide 

6 Prevention Lifeline. 

7 ‘‘(2) NOTIFICATION.—If an entity described in 

8 paragraph (1) discovers a cybersecurity vulner9 ability, incident, or potential incident, such entity 

10 shall immediately report that discovery to the Assist11 ant Secretary. 

12 ‘‘(3) CLARIFICATION.—The cybersecurity inci13 dent reporting requirements under this subsection 

14 shall supplement, and not supplant, cybersecurity in15 cident reporting requirements under other provisions 

16 of applicable Federal law that are in effect on the 

17 date of the enactment of the 9–8–8 Lifeline Cyberse18 curity Responsibility Act.’’. 

19 (c) STUDY.—Not later than 180 days after the date 

20 of the enactment of this Act, the Comptroller General of 

21 the United States shall— 

22 (1) conduct and complete a study that evaluates 

23 cybersecurity risks and vulnerabilities associated 

24 with the 9–8–8 National Suicide Prevention Lifeline; 

25 and 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•HR 498 IH

1 (2) submit a report of the findings of such 

2 study to the Committee on Energy and Commerce of 

3 the House of Representatives and the Committee on 

4 Health, Education, Labor, and Pensions of the Sen5 ate. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB