HHS Failed To Include Cybersecurity Controls In 988 Suicide Hotline Contracts
The security obligations were supposed to live in two contracts. HHS wrote the standard and defined the oversight roles, then never carried the required control areas into the instruments that would have made them enforceable, so there was nothing to audit against.
The security obligations were supposed to live in two contracts. HHS wrote the standard and defined the oversight roles, then never carried the required control areas into the instruments that would have made them enforceable, so there was nothing to audit against.
GAO reported on September 17, 2026 that HHS left seven required cybersecurity control areas out of the 988 Lifeline cooperative agreement and three more out of the crisis-center network agreement, and issued 10 recommendations.
Why it matters: 988 is the number people are told to call at the worst moment. The finding is about whether the line stays up during an attack and how fast it returns, not about privacy.
Date to watch: March 17, 2027 - the six-month mark to check whether any of the 10 recommendations have moved from open to closed on gao.gov.
Sources:
- GAO-26-108836: 988 Lifeline cybersecurity (2026-09-17)
https://www.gao.gov/products/gao-26-108836 - SAMHSA cooperative agreement FG-26-001 (2026-01-15)
https://www.samhsa.gov/grants/grant-announcements/fg-26-001 - SAMHSA 988 program page (2026-07-01)
https://www.samhsa.gov/mental-health/988 - SAMHSA 988 Lifeline timeline (2026-07-01)
https://www.samhsa.gov/mental-health/988/lifeline-timeline - GAO-26-108114: 988 Lifeline capacity (2026-07-15)
https://www.gao.gov/products/gao-26-108114 - GAO-26-107915: 988 reported funding (2026-06-10)
https://www.gao.gov/products/gao-26-107915 - FCC 988 Lifeline docket (2026-01-01)
https://www.fcc.gov/988-suicide-and-crisis-lifeline
The Throughline decodes today's headline — with receipts. Every claim is sourced; links below.
Subscribe and stand the watch. — Last Bastion