- GAO has issued 10 recommendations addressing cybersecurity gaps in the 988 Lifeline
- The review found gaps in password, incident response and contingency planning controls
- The 988 Lifeline’s network administrator oversees nearly 220 local crisis contact centers
The Department of Health and Human Services needs to address cybersecurity gaps affecting its 988 Suicide and Crisis Lifeline, according to a Government Accountability Office report published Thursday.
The 988 findings underscore the cybersecurity demands facing federal health programs. At the Potomac Officers Club’s 2026 Healthcare Summit on Dec. 3, senior leaders from HHS, DHA and VHA will discuss data privacy, digital tools, AI and other technology priorities shaping federal healthcare. Sign up now!
What Changes Did GAO Recommend?
The recommendations call on HHS to revise agreements governing the Lifeline’s network administrator and local crisis contact centers. GAO also wants HHS to ensure required cybersecurity compliance processes are followed.
Other recommendations call for implementing current password guidance and for HHS and the network administrator to set requirements for crisis contact centers’ incident response and contingency planning policies. GAO also called for training and testing tied to those plans and for the network administrator to include disaster recovery elements in its contingency plan.
HHS concurred with all 10 recommendations.
What Did GAO Find During Its Review?
HHS has established responsibilities for overseeing cybersecurity within the Lifeline, but did not include all of its designated cybersecurity control areas in agreements with the network administrator and crisis contact centers. The network administrator, who oversees nearly 220 crisis contact centers, had not implemented identity and access controls tied to updated password guidance and had partially implemented contingency plan controls. The centers also had partially implemented controls covering incident response and contingency planning.
GAO said the gaps could leave the Lifeline at risk of cybersecurity incidents that could disrupt access to its services.
GAO compared the cooperative and network agreements and related cybersecurity documentation against best practices and selected National Institute of Standards and Technology controls. It follows a December 2022 cyberattack that compromised critical 988 network infrastructure, causing a nationwide service disruption lasting several hours.
What Other Health Cybersecurity Gaps Has GAO Identified?
In June, GAO reported that the Federal Electronic Health Record Modernization office had facilitated cybersecurity and privacy coordination among partner agencies but had not fully adopted leading practices for interagency collaboration. GAO also found in 2024 that HHS faced challenges in exercising its cybersecurity responsibilities as the healthcare and public health sector lead agency and had yet to implement all related recommendations. The watchdog had previously found that HHS did not adequately monitor the implementation of cyber risk mitigation practices, including those outlined in NIST guidance.
