H.R. 498House118th Congress (2023-2025)Passed House

9–8–8 Lifeline Cybersecurity Responsibility Act

Introduced January 25, 2023

AI-Generated Summary

Updated January 20, 2026 at 2:30 AM UTC

The 9‑8‑8 Lifeline Cybersecurity Responsibility Act updates the Public Health Service Act to better protect the National Suicide Prevention Lifeline from cyber threats. It requires the program’s network administrator and participating crisis centers to report any cybersecurity vulnerabilities or incidents promptly, and it orders a study of the lifeline’s cyber risks. The bill affects the federal agencies overseeing the lifeline and the local crisis centers that provide its services.

Key Provisions

  • Adds a new duty for the suicide‑prevention hotline to take steps needed to protect it from cybersecurity incidents and fix known vulnerabilities.
  • Requires the network administrator and each participating crisis center to notify the Assistant Secretary of any identified cybersecurity vulnerability or incident within a reasonable time, while protecting personal privacy.
  • Specifies that crisis centers oversee their own technology and that the network administrator may also oversee crisis‑center technology if required by participation agreements.
  • Mandates the Comptroller General to conduct a study of the lifeline’s cybersecurity risks within 180 days and report the findings to the relevant House and Senate committees.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

15 earlier actions
SenateIntro Referral Latest Action

Received in the Senate and Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

March 6, 2024

View full timeline
HouseIntro Referral

Introduced in House

January 25, 2023

HouseIntro Referral

Referred to the House Committee on Energy and Commerce.

January 25, 2023

HouseCommittee

Referred to the Subcommittee on Health.

January 25, 2023

HouseCommittee

Subcommittee Consideration and Mark-up Session Held.

March 8, 2023

HouseCommittee

Forwarded by Subcommittee to Full Committee (Amended) by the Yeas and Nays: 27 - 0 .

March 8, 2023

HouseCommittee

Committee Consideration and Mark-up Session Held.

March 23, 2023

HouseCommittee

Ordered to be Reported (Amended) by the Yeas and Nays: 46 - 0.

March 24, 2023

HouseCommittee

Reported (Amended) by the Committee on Energy and Commerce. H. Rept. 118-52.

May 11, 2023

HouseCalendars

Placed on the Union Calendar, Calendar No. 35.

May 11, 2023

HouseFloor

Mr. Guthrie moved to suspend the rules and pass the bill, as amended.

March 5, 2024 • 4:20 PM

HouseFloor

Considered under suspension of the rules. (consideration: CR H797-798)

March 5, 2024 • 4:20 PM

HouseFloor

DEBATE - The House proceeded with forty minutes of debate on H.R. 498.

March 5, 2024 • 4:20 PM

HouseFloor

Passed/agreed to in House: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H797)

March 5, 2024 • 4:32 PM

HouseFloor

On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H797)

March 5, 2024 • 4:32 PM

HouseFloor

Motion to reconsider laid on the table Agreed to without objection.

March 5, 2024 • 4:32 PM

SenateIntro Referral

Received in the Senate and Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

March 6, 2024

Floor Debate

5 members

What members said about H.R. 498 on the floor

3 Republicans2 Democrats
Brett Guthrie
Rep. Brett GuthrieR-KY-2 · Mar 5, 2024

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 498) to amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for…

Kim Schrier
Rep. Kim SchrierD-WA-8 · Mar 5, 2024

Mr. Speaker, I yield myself such time as I may consume. Mr. Speaker, I rise today in support of H.R. 498, the 9-8-8 Lifeline Cybersecurity Responsibility Act, sponsored by my colleagues,…

Tony Cárdenas
Rep. Tony CárdenasD-CA-29 · Mar 5, 2024

Mr. Speaker, I thank the gentlewoman for yielding. Mr. Speaker, I rise today--actually, I ran over here--as a proud partner with my colleague, Representative Obernolte, to support the passage of the…

Jay Obernolte
Rep. Jay ObernolteR-CA-23 · Mar 5, 2024

Mr. Speaker, I thank the gentleman from Kentucky, my friend and colleague, for the opportunity to present my bill, H.R. 498, the 9-8-8 Lifeline Cybersecurity Responsibility Act. Mr. Speaker,…

Cathy McMorris Rodgers
Rep. Cathy McMorris RodgersR-WA-5 · May 11, 2023

Under clause 2 of rule XIII, reports of committees were delivered to the Clerk for printing and reference to the proper calendar, as follows: Mrs. RODGERS of Washington: Committee on Energy and…

Bill Text

4 versions available

Reading Mode
Latest
Referred in SenateIssued March 6, 2024

IIB

118th CONGRESS

2d Session

H. R. 498

IN THE SENATE OF THE UNITED STATES

March 6, 2024

Received; read twice and referred to the Committee on Health, Education, Labor, and Pensions

AN ACT

To amend title V of the Public Health Service Act to secure the suicide prevention lifeline from cybersecurity incidents, and for other purposes.


1.

Short title

This Act may be cited as the 9–8–8 Lifeline Cybersecurity Responsibility Act.

2.

Protecting suicide prevention lifeline from cybersecurity incidents

(a)

National suicide prevention lifeline program

Section 520E–3(b) of the Public Health Service Act (42 U.S.C. 290bb–36c(b)) is amended—

(1)

in paragraph (4), by striking and at the end;

(2)

in paragraph (5), by striking the period at the end and inserting ; and; and

(3)

by adding at the end the following:

(6)

taking such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and to eliminate known cybersecurity vulnerabilities of such hotline.

.

(b)

Reporting

Section 520E–3 of the Public Health Service Act (42 U.S.C. 290bb–36c) is amended—

(1)

by redesignating subsection (f) as subsection (g); and

(2)

by inserting after subsection (e) the following:

(f)

Cybersecurity reporting

(1)

Notification

(A)

In general

The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

(i)

any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and

(ii)

any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident.

(B)

Local and regional crisis centers

Local and regional crisis centers participating in the program shall report to the program’s network administrator receiving Federal funding pursuant to subsection (a), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws—

(i)

any identified cybersecurity vulnerability to the program within a reasonable amount of time after identification of such a vulnerability; and

(ii)

any identified cybersecurity incident to the program within a reasonable amount of time after identification of such an incident.

(2)

Notification

If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary.

(3)

Clarification

(A)

Oversight

(i)

Local and regional crisis center

Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program.

(ii)

Network administrator

The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement.

(B)

Supplement, not supplant

The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on the date of the enactment of the 9–8–8 Lifeline Cybersecurity Responsibility Act.

.

(c)

Study

Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall—

(1)

conduct and complete a study that evaluates cybersecurity risks and vulnerabilities associated with the 9–8–8 National Suicide Prevention Lifeline; and

(2)

submit a report of the findings of such study to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor, and Pensions of the Senate.

Passed the House of Representatives March 5, 2024.

Kevin F. McCumber,

Clerk.