IB 
Union Calendar No. 35 
118TH CONGRESS 
1ST SESSION 
H. R. 498 
[Report No. 118–52] 
To amend title V of the Public Health Service Act to secure the suicide 
prevention lifeline from cybersecurity incidents, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 25, 2023 
Mr. OBERNOLTE (for himself and Mr. CA´RDENAS) introduced the following 
bill; which was referred to the Committee on Energy and Commerce 
MAY 11, 2023 
Reported with an amendment; committed to the Committee of the Whole 
House on the State of the Union and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on January 25, 2023] 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
A BILL 
To amend title V of the Public Health Service Act to secure 
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes. 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘9–8–8 Lifeline Cyberse-
curity Responsibility Act’’. 
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM 
CYBERSECURITY INCIDENTS. 
(a) NATIONAL SUICIDE PREVENTION LIFELINE PRO-
GRAM.—Section 520E–3(b) of the Public Health Service Act 
(42 U.S.C. 290bb–36c(b)) is amended— 
(1) in paragraph (4), by striking ‘‘and’’ at the 
end; 
(2) in paragraph (5), by striking the period at 
the end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(6) coordinating with the Chief Information Se-
curity Officer of the Department of Health and 
Human Services to take such steps as may be nec-
essary to ensure the program is protected from cyber-
security incidents and eliminates known cybersecurity 
vulnerabilities.’’. 
(b) REPORTING.—Section 520E–3 of the Public Health 
Service Act (42 U.S.C. 290bb–36c) is amended— 
(1) by redesignating subsection (f) as subsection 
(g); and 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) by inserting after subsection (e) the following: 
‘‘(f) CYBERSECURITY REPORTING.— 
‘‘(1) IN GENERAL.— 
‘‘(A) IN GENERAL.—The program’s network 
administrator receiving Federal funding pursu-
ant to subsection (a) shall report to the Assistant 
Secretary, in a manner that protects personal 
privacy, consistent with applicable Federal and 
State privacy laws— 
‘‘(i) 
any 
identified 
cybersecurity 
vulnerabilities to the program immediately 
upon identification of such a vulnerability; 
and 
‘‘(ii) any identified cybersecurity inci-
dents to the program immediately upon 
identification of such incident. 
‘‘(B) LOCAL
AND
REGIONAL
CRISIS
CEN-
TERS.—Local and regional crisis centers partici-
pating in the program shall report to the pro-
gram’s network administrator identified in sub-
paragraph (A), in a manner that protects per-
sonal privacy, consistent with applicable Federal 
and State privacy laws— 
‘‘(i) 
any 
identified 
cybersecurity 
vulnerabilities to the program immediately 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
upon identification of such vulnerability; 
and 
‘‘(ii) any identified cybersecurity inci-
dents to the program immediately upon 
identification of such incident. 
‘‘(2) NOTIFICATION.—If the program’s network 
administrator receiving funding pursuant to sub-
section (a) discovers, or is informed by a local or re-
gional crisis center pursuant to paragraph (1)(B) of, 
a cybersecurity vulnerability or incident, such entity 
shall immediately report that discovery to the Assist-
ant Secretary. 
‘‘(3) CLARIFICATION.— 
‘‘(A) OVERSIGHT.— 
‘‘(i) LOCAL AND REGIONAL CRISIS CEN-
TER.—Except as provided in clause (ii), 
local and regional crisis centers partici-
pating in the program shall oversee all tech-
nology each center employs in the provision 
of services as a participant in the program. 
‘‘(ii) NETWORK ADMINISTRATOR.— The 
program’s network administrator receiving 
Federal funding pursuant to subsection (a) 
shall oversee the technology each crisis cen-
ter employs in the provision of services as 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
a participant in the program if such over-
sight responsibilities are established in the 
applicable network participation agreement. 
‘‘(B) SUPPLEMENT, NOT
SUPPLANT.—The 
cybersecurity incident reporting requirements 
under this subsection shall supplement, and not 
supplant, cybersecurity incident reporting re-
quirements under other provisions of applicable 
Federal law that are in effect on the date of the 
enactment of the 9–8–8 Lifeline Cybersecurity 
Responsibility Act.’’. 
(c) STUDY.—Not later than 180 days after the date 
of the enactment of this Act, the Comptroller General of the 
United States shall— 
(1) conduct and complete a study that evaluates 
cybersecurity risks and vulnerabilities associated with 
the 9–8–8 National Suicide Prevention Lifeline; and 
(2) submit a report of the findings of such study 
to the Committee on Energy and Commerce of the 
House of Representatives and the Committee on 
Health, Education, Labor, and Pensions of the Sen-
ate. 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
Union Calendar No. 35 
118TH CONGRESS 
1ST SESSION 
H. R. 498 
[Report No. 118–52] 
A BILL 
To amend title V of the Public Health Service Act 
to secure the suicide prevention lifeline from cy-
bersecurity incidents, and for other purposes. 
MAY 11, 2023 
Reported with an amendment; committed to the Com-
mittee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
00:11 May 12, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H498.RH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB