HHS suicide, crisis lifeline needs cybersecurity improvements, watchdog finds

The Department of Health and Health and Human Services’ 988 suicide and crisis hotline needs to further implement cybersecurity controls to protect the lifeline from service disruptions caused by potential hacks, a congressional watchdog reported.

In a recent report, the Government Accountability Office found the 988 hotline had not implemented updated identity and access controls with respect to updated password guidance and should make improvements related to cybersecurity contingency plans. The findings come after the 988 line experienced a ransomware attack in 2022 that interrupted service for several hours.

“Without the full implementation of these controls, the 988 Lifeline faces increased risk of cybersecurity incidents, which could result in prolonged service disruptions and potentially prevent individuals in crisis access to timely mental health support,” the report said.

Created in 2005 by HHS’s Substance Abuse and Mental Health Services Administration and the Mental Health Association of New York City, the 988 Lifeline has gradually grown into a nationwide program serving millions. 

In 2007, SAMHSA partnered with the Department of Veterans Affairs to create a specific veterans crisis line, and in 2022, the services eventually became a nationwide three-digit number for sudicide prevention. The service is currently overseen by a network administrator on behalf of the health agency. That administrator manages a federated system that includes nearly 220 local contact centers across the country. 

According to GAO, the demand for the free service continues to grow. In 2025 alone, the 24/7 number received 8 million contacts via call, text, or chat, per the report.

As a result, the outage in 2022 raised concerns about the security of the service. Last year, Congress passed legislation that requires the line to report cybersecurity incidents and vulnerabilities. That law, called the SUPPORT for Patients and Communities Reauthorization Act of 2025, also tasked the GAO with reviewing the cybersecurity posture of the service.

While GAO auditors found that HHS implemented some oversight actions for the lifeline, it said the agency still needs to take further action.

HHS defined cybersecurity controls, for example, but it didn’t include many of them as requirements in its fiscal 2026 cooperative agreement with the network administrator or the administrator’s agreement with the contact centers, the report said. The agency also didn’t always adhere to its own cybersecurity monitoring practices, GAO found.

The health agency’s agreement with the 988 network administrator only included three of HHS’s own 10 essential cybersecurity control areas that align with National Institute of Standards and Technology guidance. Additionally, controls to protect against email-based attacks and to require separate accounts for common users and administrators were not included in either type of agreement, per the report. 

With respect to monitoring, HHS and the network administrator each had two processes to monitor the compliance, but they didn’t always follow those processes. Specifically, GAO found that of compliance checklists it reviewed for a dozen crisis contact centers, none provided all the required documentation to the administrator before the deadline — and five still hadn’t submitted all the required documents as of March.

In many areas, GAO found the agency and the administrator made progress but could go further to protect the service. For example, the administrator implemented multifactor authentication for contact centers, requiring two-factor authentication for the platforms it manages. But it hadn’t yet updated password guidance. Instead, it continues to require password changes and special characters.

The report also found that while the administrator implemented incident response controls, the centers struggled to do so themselves. That included partial implementation developing a plan for incident response and conducting incident response training and testing. 

GAO made 10 recommendations to HHS to improve security. While the agency said it supported those recommendations, it noted that there are constraints. 

In response to GAO’s findings, agency officials said they lack the authority to require all of the cybersecurity controls in nonfederal systems but that the network administrator can include them in its agreement with contact centers. Those officials said the controls will be included in future versions of that agreement.

They also stated that enforcement of cybersecurity requirements for crisis contact centers is difficult given the voluntary nature of each center’s relationship with the network administrator. While the agency can recommend the controls, the agency said, the implementation is up to the centers. 

The HHS officials again underscored those difficulties in response to the monitoring concerns. Per the report, the agency’s “primary recourse for noncompliance, such as failing to submit required compliance documentation, is to remove a crisis contact center from the 988 Lifeline network.”

GAO also included comments from a VA official who said the agency “strongly supports” all of the recommendations for HHS. That letter provided detail on its own cybersecurity efforts for its Veterans Crisis Line, including adherence to NIST guidance. The official noted that there is risk to its crisis line if 988 experiences an attack, and said the agency stands ready to share practices and lessons from its own cybersecurity efforts as needed.

Spokespeople for HHS and the VA didn’t immediately provide responses for additional comment on the report.