Cybersecurity Policy Report, GAO REPORTS: HHS only partially implemented defined oversight activities related to cybersecurity for 988 Lifeline in its network agreements, (Sep 24, 2026)

By Jeffrey H. Brochin, J.D.

Although HHS defined cybersecurity oversight roles and responsibilities to monitor the implementation of cybersecurity controls, it failed to establish them as requirements in the fiscal year 2026 cooperative agreement and the network administrator’s current network agreement with crisis contact centers.

The U.S. Government Accountability Office (GAO) has issued its congressionally mandated report on the 988 Suicide and Crisis Lifeline’s (988 Lifeline) cybersecurity risks and vulnerabilities. The report found that HHS did not include all key HHS-defined cybersecurity control areas in the 988 Lifeline cooperative agreement with its network administrator (or for the network agreement between the administrator and crisis contact centers) and in addition, HHS established processes to monitor security control implementation--but did not always adhere to them. As a result of the findings the GAO made 10 recommendations to HHS to update the cooperative and network agreements and to fully implement key cybersecurity controls (GAO Report, No. GAO-26-108836 (Sept. 17, 2026)).

988 Lifeline background. The Substance Abuse and Mental Health Services Administration (SAMHSA) is an agency within HHS that oversees the 988 Suicide and Crisis Lifeline (first called the National Suicide Prevention Lifeline), which, as of March 2026, includes around 218 crisis contact centers and has provided free, confidential 24/7 emotional support and crisis counseling nationwide since 2005. In 2023, one person in the United States died by suicide every 11 minutes on average, making it the second leading cause of death for those under the age of 45.

In 2007, the Lifeline integrated with VA’s Veterans Crisis Line to provide access to veterans in suicidal crisis. In July 2022, following a rulemaking by FCC and enactment of the National Suicide Hotline Designation Act of 2020, 9-8-8 became the nationwide three-digit number for suicide prevention and mental health crisis counseling. Since transitioning to the 988 number, the 988 Lifeline has continued to grow, receiving more than 25 million contacts, 8 million of which took place in 2025 alone.

Cyberattack and reporting requirements. In December 2022, the 988 Lifeline experienced a ransomware attack that resulted in a nationwide outage lasting several hours. This outage raised public concern about the cybersecurity of 988 Lifeline information systems and exposed a significant vulnerability in its operation. Subsequently, Congress passed the SUPPORT for Patients and Communities Reauthorization Act of 2025, which requires, among other things, the timely reporting of cybersecurity incidents and vulnerabilities affecting the 988 Lifeline. It also includes a provision for the GAO to review the cybersecurity risks and vulnerabilities of the 988 Lifeline.

Why the GAO did the study. Through the cooperative agreements, SAMHSA provides funding, policy direction, and oversight of the network administrator, while the network administrator is responsible for implementation of the 988 Lifeline. In this role, the network administrator manages the vendors, operations, infrastructure, and support for the crisis contact centers through an annual network agreement that establishes requirements for crisis contact center participation in the network, including cybersecurity standards.

National Institute of Standards and Technology (NIST) has published standards and guidelines that include guidance related to protecting the confidentiality, integrity, and availability of systems and data. The guidelines provide information security related guidance for federal information systems in the form of a catalog of security and privacy controls. The objectives of the instant study were to determine (1) to what extent HHS has provided oversight of cybersecurity controls for the 988 Lifeline and (2) to what extent the 988 Lifeline network administrator and crisis contact centers have implemented selected cybersecurity controls.

How the study was conducted. The GAO used their Cybersecurity Program Audit Guide (CPAG) to facilitate their methodology, selecting control areas and control objectives from their guide based on their relevance to the availability of 988 Lifeline information and information systems. They then selected NIST Special Publication (SP) 800-53 revision 5 cybersecurity controls related to the CPAG components of: asset and risk management, identity and access management, continuous monitoring and logging, incident response, and contingency planning and recovery.

To address the first objective, the GAO evaluated SAMHSA’s 988 Lifeline cooperative agreement and the network administrator’s network agreement with crisis contact centers for inclusion of cybersecurity controls against HHS’s public health sector-specific cybersecurity best practices, and, also assessed documentation of the oversight roles, responsibilities, and activities of SAMHSA and its network administrator against NIST cybersecurity controls related to the CPAG asset and risk management component.

What the study found. The study found that HHS only partially implemented oversight activities related to cybersecurity for the 988 Lifeline. Specifically, HHS defined oversight roles and responsibilities to monitor cybersecurity control implementation, however, HHS did not include all key HHS-defined cybersecurity control areas in the 988 Lifeline cooperative agreement with its network administrator or for the network agreement between the administrator and crisis contact centers. In addition, HHS established processes to monitor security control implementation but did not always adhere to them.

Recommendations going forward. As a result of the study, the GAO made 10 recommendations to HHS to update the cooperative and network agreements and to fully implement key cybersecurity controls, including but not limited to multifactor authentication by 988 Lifeline users as well as continuous monitoring and logging, incident response, and contingency planning and recovery.

HHS concurred with all 10 of the recommendations and further stated that it recognized the importance of making the 988 Lifeline more secure, but also noted that its authority to mandate specific cybersecurity controls might be constrained by the organizational independence of the states, territories, and local entities that operate the crisis contact centers. As such, the implementation of best practices and standards would depend on the cooperation of those independent entities.

ReportsLetters: GAOReports CMSNews CyberPrivacyFeed GeneralNews DataPrivacy DataSecurity