I 
119TH CONGRESS 
1ST SESSION 
H. R. 912 
To amend title V of the Public Health Service Act to secure the suicide 
prevention lifeline from cybersecurity incidents, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 4, 2025 
Mr. OBERNOLTE (for himself and Mrs. DINGELL) introduced the following 
bill; which was referred to the Committee on Energy and Commerce 
A BILL 
To amend title V of the Public Health Service Act to secure 
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘9–8–8 Lifeline Cyber-
security Responsibility Act’’. 
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 
FROM CYBERSECURITY INCIDENTS. 
(a) NATIONAL SUICIDE PREVENTION LIFELINE PRO-
GRAM.—Section 520E–3(b) of the Public Health Service 
Act (42 U.S.C. 290bb–36c(b)) is amended— 
VerDate Sep 11 2014 
03:45 Mar 05, 2025
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H912.IH
H912
ssavage on LAPJG3WLY3PROD with BILLS
(1) in paragraph (4), by striking ‘‘and’’ at the 
end; 
(2) in paragraph (5), by striking the period at 
the end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(6) taking such steps as may be necessary to 
ensure the suicide prevention hotline is protected 
from cybersecurity incidents and eliminates known 
cybersecurity vulnerabilities.’’. 
(b) REPORTING.—Section 520E–3 of the Public 
Health Service Act (42 U.S.C. 290bb–36c) is amended— 
(1) by redesignating subsection (f) as sub-
section (g); and 
(2) by inserting after subsection (e) the fol-
lowing: 
‘‘(f) CYBERSECURITY REPORTING.— 
‘‘(1) NOTIFICATION.— 
‘‘(A) IN
GENERAL.—The program’s net-
work administrator receiving Federal funding 
pursuant to subsection (a) shall report to the 
Assistant Secretary, in a manner that protects 
personal privacy, consistent with applicable 
Federal and State privacy laws— 
‘‘(i) 
any 
identified 
cybersecurity 
vulnerabilities to the program within a rea-
VerDate Sep 11 2014 
03:45 Mar 05, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H912.IH
H912
ssavage on LAPJG3WLY3PROD with BILLS
sonable amount of time after identification 
of such a vulnerability; and 
‘‘(ii) any identified cybersecurity inci-
dents to the program within a reasonable 
amount of time after identification of such 
incident. 
‘‘(B) LOCAL AND REGIONAL CRISIS CEN-
TERS.—Local and regional crisis centers par-
ticipating in the program shall report to the 
program’s network administrator identified 
under subparagraph (A), in a manner that pro-
tects personal privacy, consistent with applica-
ble Federal and State privacy laws— 
‘‘(i) 
any 
identified 
cybersecurity 
vulnerabilities to the program within a rea-
sonable amount of time after identification 
of such vulnerability; and 
‘‘(ii) any identified cybersecurity inci-
dents to the program within a reasonable 
amount of time after identification of such 
incident. 
‘‘(2) NOTIFICATION.—If the program’s network 
administrator receiving funding pursuant to sub-
section (a) discovers, or is informed by a local or re-
gional crisis center pursuant to paragraph (1)(B) of, 
VerDate Sep 11 2014 
03:45 Mar 05, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H912.IH
H912
ssavage on LAPJG3WLY3PROD with BILLS
a cybersecurity vulnerability or incident, within a 
reasonable amount of time after such discovery or 
receipt of information, such entity shall report the 
vulnerability or incident to the Assistant Secretary. 
‘‘(3) CLARIFICATION.— 
‘‘(A) OVERSIGHT.— 
‘‘(i) LOCAL
AND
REGIONAL
CRISIS 
CENTERS.—Except as provided in clause 
(ii), local and regional crisis centers par-
ticipating in the program shall oversee all 
technology each center employs in the pro-
vision of services as a participant in the 
program. 
‘‘(ii) NETWORK
ADMINISTRATOR.— 
The program’s network administrator re-
ceiving Federal funding pursuant to sub-
section (a) shall oversee the technology 
each crisis center employs in the provision 
of services as a participant in the program 
if such oversight responsibilities are estab-
lished in the applicable network participa-
tion agreement. 
‘‘(B) SUPPLEMENT, NOT SUPPLANT.—The 
cybersecurity incident reporting requirements 
under this subsection shall supplement, and not 
VerDate Sep 11 2014 
03:45 Mar 05, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H912.IH
H912
ssavage on LAPJG3WLY3PROD with BILLS
supplant, cybersecurity incident reporting re-
quirements under other provisions of applicable 
Federal law that are in effect on the date of the 
enactment of the 9–8–8 Lifeline Cybersecurity 
Responsibility Act.’’. 
(c) STUDY.—Not later than 180 days after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall— 
(1) conduct and complete a study that evaluates 
cybersecurity risks and vulnerabilities associated 
with the 9–8–8 National Suicide Prevention Lifeline; 
and 
(2) submit a report on the findings of such 
study to the Committee on Health, Education, 
Labor, and Pensions of the Senate and the Com-
mittee on Energy and Commerce of the House of 
Representatives. 
Æ 
VerDate Sep 11 2014 
03:45 Mar 05, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H912.IH
H912
ssavage on LAPJG3WLY3PROD with BILLS