‘‘(A) IN
GENERAL.—The program’s net-
work administrator receiving Federal funding 
pursuant to subsection (a) shall report to the 
Assistant Secretary, in a manner that protects 
personal privacy, consistent with applicable 
Federal and State privacy laws— 
‘‘(i) any identified cybersecurity vul-
nerability to the program within a reason-
able amount of time after identification of 
such a vulnerability; and 
‘‘(ii) any identified cybersecurity inci-
dent to the program within a reasonable 
amount of time after identification of such 
an incident. 
‘‘(B) LOCAL AND REGIONAL CRISIS CEN-
TERS.—Local and regional crisis centers par-
ticipating in the program shall report to the 
program’s network administrator receiving Fed-
eral funding pursuant to subsection (a), in a 
manner that protects personal privacy, con-
sistent with applicable Federal and State pri-
vacy laws— 
‘‘(i) any identified cybersecurity vul-
nerability to the program within a reason-
able amount of time after identification of 
such a vulnerability; and 
‘‘(ii) any identified cybersecurity inci-
dent to the program within a reasonable 
amount of time after identification of such 
an incident. 
‘‘(2) NOTIFICATION.—If the program’s network 
administrator receiving funding pursuant to sub-
section (a) discovers, or is informed by a local or re-
gional crisis center pursuant to paragraph (1)(B) of, 
a cybersecurity vulnerability or incident, within a 
reasonable amount of time after such discovery or 
receipt of information, such entity shall report the 
vulnerability or incident to the Assistant Secretary. 
‘‘(3) CLARIFICATION.— 
‘‘(A) OVERSIGHT.— 
‘‘(i) LOCAL
AND
REGIONAL
CRISIS 
CENTER.—Except as provided in clause 
(ii), local and regional crisis centers par-
ticipating in the program shall oversee all 
technology each center employs in the pro-
vision of services as a participant in the 
program. 
‘‘(ii) NETWORK
ADMINISTRATOR.— 
The program’s network administrator re-
ceiving Federal funding pursuant to sub-
section (a) shall oversee the technology 
each crisis center employs in the provision 
of services as a participant in the program 
if such oversight responsibilities are estab-
lished in the applicable network participa-
tion agreement. 
‘‘(B) SUPPLEMENT, NOT SUPPLANT.—The 
cybersecurity incident reporting requirements 
under this subsection shall supplement, and not 
supplant, cybersecurity incident reporting re-
quirements under other provisions of applicable 
Federal law that are in effect on the date of the 
enactment of the 9–8–8 Lifeline Cybersecurity 
Responsibility Act.’’. 
(c) STUDY.—Not later than 180 days after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall— 
(1) conduct and complete a study that evaluates 
cybersecurity risks and vulnerabilities associated 
with the 9–8–8 National Suicide Prevention Lifeline; 
and 
(2) submit a report of the findings of such 
study to the Committee on Energy and Commerce of 
the House of Representatives and the Committee on
Health, Education, Labor, and Pensions of the Sen-
ate. 
Passed the House of Representatives March 5, 
2024. 
Attest: 
Clerk.
118TH CONGRESS 
2D SESSION 
H. R. 498 
AN ACT 
To amend title V of the Public Health Service Act 
to secure the suicide prevention lifeline from cy-
bersecurity incidents, and for other purposes.