IB
Union Calendar No. 35
118THCONGRESS
1
STSESSION H. R. 498
[Report No. 118–52]
To amend title V of the Public Health Service Act to secure the suicide
prevention lifeline from cybersecurity incidents, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JANUARY25, 2023
Mr. O
BERNOLTE(for himself and Mr. CA´RDENAS) introduced the following
bill; which was referred to the Committee on Energy and Commerce
M
AY11, 2023
Reported with an amendment; committed to the Committee of the Whole
House on the State of the Union and ordered to be printed
[Strike out all after the enacting clause and insert the part printed in italic]
[For text of introduced bill, see copy of bill as introduced on January 25, 2023]
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB 2
•HR 498 RH
A BILL
To amend title V of the Public Health Service Act to secure
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes.
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB 3
•HR 498 RH
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘9–8–8 Lifeline Cyberse-4
curity Responsibility Act’’. 5
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE FROM 6
CYBERSECURITY INCIDENTS. 7
(a) N
ATIONALSUICIDEPREVENTIONLIFELINEPRO-8
GRAM.—Section 520E–3(b) of the Public Health Service Act 9
(42 U.S.C. 290bb–36c(b)) is amended— 10
(1) in paragraph (4), by striking ‘‘and’’ at the 11
end; 12
(2) in paragraph (5), by striking the period at 13
the end and inserting ‘‘; and’’; and 14
(3) by adding at the end the following: 15
‘‘(6) coordinating with the Chief Information Se-16
curity Officer of the Department of Health and 17
Human Services to take such steps as may be nec-18
essary to ensure the program is protected from cyber-19
security incidents and eliminates known cybersecurity 20
vulnerabilities.’’. 21
(b) R
EPORTING.—Section 520E–3 of the Public Health 22
Service Act (42 U.S.C. 290bb–36c) is amended— 23
(1) by redesignating subsection (f) as subsection 24
(g); and 25
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB 4
•HR 498 RH
(2) by inserting after subsection (e) the following: 1
‘‘(f) C
YBERSECURITYREPORTING.— 2
‘‘(1) I
N GENERAL.— 3
‘‘(A) I
N GENERAL.—The program’s network 4
administrator receiving Federal funding pursu-5
ant to subsection (a) shall report to the Assistant 6
Secretary, in a manner that protects personal 7
privacy, consistent with applicable Federal and 8
State privacy laws— 9
‘‘(i) any identified cybersecurity 10
vulnerabilities to the program immediately 11
upon identification of such a vulnerability; 12
and 13
‘‘(ii) any identified cybersecurity inci-14
dents to the program immediately upon 15
identification of such incident. 16
‘‘(B) L
OCAL AND REGIONAL CRISIS CEN -17
TERS.—Local and regional crisis centers partici-18
pating in the program shall report to the pro-19
gram’s network administrator identified in sub-20
paragraph (A), in a manner that protects per-21
sonal privacy, consistent with applicable Federal 22
and State privacy laws— 23
‘‘(i) any identified cybersecurity 24
vulnerabilities to the program immediately 25
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB 5
•HR 498 RH
upon identification of such vulnerability; 1
and 2
‘‘(ii) any identified cybersecurity inci-3
dents to the program immediately upon 4
identification of such incident. 5
‘‘(2) N
OTIFICATION.—If the program’s network 6
administrator receiving funding pursuant to sub-7
section (a) discovers, or is informed by a local or re-8
gional crisis center pursuant to paragraph (1)(B) of, 9
a cybersecurity vulnerability or incident, such entity 10
shall immediately report that discovery to the Assist-11
ant Secretary. 12
‘‘(3) C
LARIFICATION.— 13
‘‘(A) O
VERSIGHT.— 14
‘‘(i) L
OCAL AND REGIONAL CRISIS CEN -15
TER.—Except as provided in clause (ii), 16
local and regional crisis centers partici-17
pating in the program shall oversee all tech-18
nology each center employs in the provision 19
of services as a participant in the program. 20
‘‘(ii) N
ETWORK ADMINISTRATOR .— The 21
program’s network administrator receiving 22
Federal funding pursuant to subsection (a) 23
shall oversee the technology each crisis cen-24
ter employs in the provision of services as 25
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB 6
•HR 498 RH
a participant in the program if such over-1
sight responsibilities are established in the 2
applicable network participation agreement. 3
‘‘(B) S
UPPLEMENT, NOT SUPPLANT.—The 4
cybersecurity incident reporting requirements 5
under this subsection shall supplement, and not 6
supplant, cybersecurity incident reporting re-7
quirements under other provisions of applicable 8
Federal law that are in effect on the date of the 9
enactment of the 9–8–8 Lifeline Cybersecurity 10
Responsibility Act.’’. 11
(c) S
TUDY.—Not later than 180 days after the date 12
of the enactment of this Act, the Comptroller General of the 13
United States shall— 14
(1) conduct and complete a study that evaluates 15
cybersecurity risks and vulnerabilities associated with 16
the 9–8–8 National Suicide Prevention Lifeline; and 17
(2) submit a report of the findings of such study 18
to the Committee on Energy and Commerce of the 19
House of Representatives and the Committee on 20
Health, Education, Labor, and Pensions of the Sen-21
ate. 22
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB Union Calendar No.
35
118
TH
CONGRESS
1
ST
S
ESSION
H. R. 498
[Report No. 118–52]
A BILL
To amend title V of the Public Health Service Act
to secure the suicide prevention lifeline from cy-
bersecurity incidents, and for other purposes.
M
AY
11, 2023
Reported with an amendment; committed to the Com-
mittee of the Whole House on the State of the Union
and ordered to be printed
VerDate Sep 11 2014 00:11 May 12, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6651 Sfmt 6651 E:\BILLS\H498.RH H498
pbinns on DSKJLVW7X2PROD with $$_JOB