118THCONGRESS
2
DSESSION H. R. 498
AN ACT
To amend title V of the Public Health Service Act to secure
the suicide prevention lifeline from cybersecurity inci-
dents, and for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2 2
•HR 498 EH
SECTION 1. SHORT TITLE. 1
This Act may be cited as the ‘‘9–8–8 Lifeline Cyber-2
security Responsibility Act’’. 3
SEC. 2. PROTECTING SUICIDE PREVENTION LIFELINE 4
FROM CYBERSECURITY INCIDENTS. 5
(a) N
ATIONALSUICIDEPREVENTIONLIFELINEPRO-6
GRAM.—Section 520E–3(b) of the Public Health Service 7
Act (42 U.S.C. 290bb–36c(b)) is amended— 8
(1) in paragraph (4), by striking ‘‘and’’ at the 9
end; 10
(2) in paragraph (5), by striking the period at 11
the end and inserting ‘‘; and’’; and 12
(3) by adding at the end the following: 13
‘‘(6) taking such steps as may be necessary to 14
ensure the suicide prevention hotline is protected 15
from cybersecurity incidents and to eliminate known 16
cybersecurity vulnerabilities of such hotline.’’. 17
(b) R
EPORTING.—Section 520E–3 of the Public 18
Health Service Act (42 U.S.C. 290bb–36c) is amended— 19
(1) by redesignating subsection (f) as sub-20
section (g); and 21
(2) by inserting after subsection (e) the fol-22
lowing: 23
‘‘(f) C
YBERSECURITYREPORTING.— 24
‘‘(1) N
OTIFICATION.— 25 3
•HR 498 EH
‘‘(A) IN GENERAL.—The program’s net-1
work administrator receiving Federal funding 2
pursuant to subsection (a) shall report to the 3
Assistant Secretary, in a manner that protects 4
personal privacy, consistent with applicable 5
Federal and State privacy laws— 6
‘‘(i) any identified cybersecurity vul-7
nerability to the program within a reason-8
able amount of time after identification of 9
such a vulnerability; and 10
‘‘(ii) any identified cybersecurity inci-11
dent to the program within a reasonable 12
amount of time after identification of such 13
an incident. 14
‘‘(B) L
OCAL AND REGIONAL CRISIS CEN -15
TERS.—Local and regional crisis centers par-16
ticipating in the program shall report to the 17
program’s network administrator receiving Fed-18
eral funding pursuant to subsection (a), in a 19
manner that protects personal privacy, con-20
sistent with applicable Federal and State pri-21
vacy laws— 22
‘‘(i) any identified cybersecurity vul-23
nerability to the program within a reason-24 4
•HR 498 EH
able amount of time after identification of 1
such a vulnerability; and 2
‘‘(ii) any identified cybersecurity inci-3
dent to the program within a reasonable 4
amount of time after identification of such 5
an incident. 6
‘‘(2) N
OTIFICATION.—If the program’s network 7
administrator receiving funding pursuant to sub-8
section (a) discovers, or is informed by a local or re-9
gional crisis center pursuant to paragraph (1)(B) of, 10
a cybersecurity vulnerability or incident, within a 11
reasonable amount of time after such discovery or 12
receipt of information, such entity shall report the 13
vulnerability or incident to the Assistant Secretary. 14
‘‘(3) C
LARIFICATION.— 15
‘‘(A) O
VERSIGHT.— 16
‘‘(i) L
OCAL AND REGIONAL CRISIS 17
CENTER.—Except as provided in clause 18
(ii), local and regional crisis centers par-19
ticipating in the program shall oversee all 20
technology each center employs in the pro-21
vision of services as a participant in the 22
program. 23
‘‘(ii) N
ETWORK ADMINISTRATOR .— 24
The program’s network administrator re-25 5
•HR 498 EH
ceiving Federal funding pursuant to sub-1
section (a) shall oversee the technology 2
each crisis center employs in the provision 3
of services as a participant in the program 4
if such oversight responsibilities are estab-5
lished in the applicable network participa-6
tion agreement. 7
‘‘(B) S
UPPLEMENT, NOT SUPPLANT.—The 8
cybersecurity incident reporting requirements 9
under this subsection shall supplement, and not 10
supplant, cybersecurity incident reporting re-11
quirements under other provisions of applicable 12
Federal law that are in effect on the date of the 13
enactment of the 9–8–8 Lifeline Cybersecurity 14
Responsibility Act.’’. 15
(c) S
TUDY.—Not later than 180 days after the date 16
of the enactment of this Act, the Comptroller General of 17
the United States shall— 18
(1) conduct and complete a study that evaluates 19
cybersecurity risks and vulnerabilities associated 20
with the 9–8–8 National Suicide Prevention Lifeline; 21
and 22
(2) submit a report of the findings of such 23
study to the Committee on Energy and Commerce of 24
the House of Representatives and the Committee on 25 6
•HR 498 EH
Health, Education, Labor, and Pensions of the Sen-1
ate. 2
Passed the House of Representatives March 5,
2024.
Attest:
Clerk. 118
TH
CONGRESS
2
D
S
ESSION
H. R. 498
AN ACT
To amend title V of the Public Health Service Act
to secure the suicide prevention lifeline from cy-
bersecurity incidents, and for other purposes.