I 
118TH CONGRESS 
1ST SESSION 
H. R. 498 
To amend title V of the Public Health Service Act to secure the suicide 
prevention lifeline from cybersecurity incidents, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 25, 2023 
Mr. OBERNOLTE (for himself and Mr. CA´RDENAS) introduced the following 
bill; which was referred to the Committee on Energy and Commerce 
A BILL 
To amend title V of the Public Health Service Act to secure 
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘9–8–8 Lifeline Cyber-
security Responsibility Act’’. 
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 
FROM CYBERSECURITY INCIDENTS. 
(a) 
SUICIDE
PREVENTION
LIFELINE.—Section 
520E–3(b) of the Public Health Service Act (42 U.S.C. 
290bb–36c(b)) is amended— 
VerDate Sep 11 2014 
20:06 Feb 05, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H498.IH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) in paragraph (4), by striking ‘‘and’’ at the 
end; 
(2) in paragraph (5), by striking the period at 
the end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(6) coordinating with the Chief Information 
Security Officer of the Department of Health and 
Human Services to take such steps as may be nec-
essary to ensure the program is protected from cy-
bersecurity incidents and eliminates known cyberse-
curity vulnerabilities.’’. 
(b) REPORTING.—Section 520E–3 of the Public 
Health Service Act (42 U.S.C. 290bb–36c) is amended— 
(1) by redesignating subsection (f) as sub-
section (g); and 
(2) by inserting after subsection (e) the fol-
lowing: 
‘‘(f) CYBERSECURITY REPORTING.— 
‘‘(1) IN GENERAL.—The program’s network ad-
ministrator receiving Federal funding pursuant to 
subsection (a) shall report to the Assistant Sec-
retary, in a manner that protects personal privacy, 
consistent with applicable Federal and State privacy 
laws— 
VerDate Sep 11 2014 
20:06 Feb 05, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H498.IH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) 
any 
identified 
cybersecurity 
vulnerabilities to the National Suicide Preven-
tion Lifeline; and 
‘‘(B) any identified cybersecurity incidents 
or potential incidents to the National Suicide 
Prevention Lifeline. 
‘‘(2) NOTIFICATION.—If an entity described in 
paragraph (1) discovers a cybersecurity vulner-
ability, incident, or potential incident, such entity 
shall immediately report that discovery to the Assist-
ant Secretary. 
‘‘(3) CLARIFICATION.—The cybersecurity inci-
dent reporting requirements under this subsection 
shall supplement, and not supplant, cybersecurity in-
cident reporting requirements under other provisions 
of applicable Federal law that are in effect on the 
date of the enactment of the 9–8–8 Lifeline Cyberse-
curity Responsibility Act.’’. 
(c) STUDY.—Not later than 180 days after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall— 
(1) conduct and complete a study that evaluates 
cybersecurity risks and vulnerabilities associated 
with the 9–8–8 National Suicide Prevention Lifeline; 
and 
VerDate Sep 11 2014 
20:06 Feb 05, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H498.IH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) submit a report of the findings of such 
study to the Committee on Energy and Commerce of 
the House of Representatives and the Committee on 
Health, Education, Labor, and Pensions of the Sen-
ate. 
Æ 
VerDate Sep 11 2014 
20:06 Feb 05, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H498.IH
H498
pbinns on DSKJLVW7X2PROD with $$_JOB