GAO issues 10 cybersecurity recommendations for HHS 988 Lifeline
The Department of Health and Human Services must adopt the GAO's recommendations to improve oversight and security controls for the 988 Suicide and Crisis Lifeline, effective immediately.
The Government Accountability Office released a report containing ten recommendations that require the Department of Health and Human Services (HHS) to strengthen oversight and security controls for the 988 Suicide and Crisis Lifeline. The recommendations bind the Secretary of HHS and the Assistant Secretary for Mental Health and Substance Abuse, who oversee the network administrator and the nearly 220 crisis contact centers that operate the Lifeline.
GAO found that HHS has only partially implemented cybersecurity oversight. While HHS defined oversight roles and responsibilities, it did not include all key HHS-defined cybersecurity control areas in the Lifeline cooperative agreement with the network administrator or in the network agreement between the administrator and crisis contact centers. The agency also established monitoring processes but has not consistently adhered to them.
The report notes that the network administrator has fully implemented selected continuous-monitoring controls but has not implemented identity and access controls related to updated password guidance and has only partially implemented contingency-plan controls. Crisis contact centers have partially implemented incident-response and contingency-planning controls, leaving the Lifeline vulnerable to service disruptions such as the December 2022 cyberattack that halted service for several hours.
GAO's ten recommendations direct the Secretary of HHS to have the Assistant Secretary for Mental Health and Substance Abuse incorporate seven missing cybersecurity control areas into the cooperative agreement, three missing areas into the network agreement, and to ensure full implementation of a compliance checklist, current NIST password guidance, incident-response policies, contingency-planning policies, disaster-recovery elements, and related training and testing.
All ten recommendations remain open, and HHS has concurred with the GAO's findings. The SUPPORT for Patients and Communities Reauthorization Act of 2025 mandated this review, underscoring congressional concern for the Lifeline's uninterrupted operation.
Further reading