Signed by President Trump Monday, the sweeping mental health bill incorporates the full text of the 988 Lifeline Cybersecurity Responsibility Act, which is bipartisan legislation that was first introduced after a December 2022 cyber attack on vendor Intrado caused a daylong outage of the national crisis hotline.
Reintroduced in the House as a standalone bill in February, it features language that directs the 988 network administrator to “take such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and eliminates known cybersecurity vulnerabilities.”
A subsection on incident reporting requires the network administrator — Vibrant Emotional Health— to report cybersecurity vulnerabilities and incidents. It also requires local and regional crisis centers to do the same, and it directs upward reporting to the U.S. Department of Health and Human Services. The language also clarifies crisis-center oversight, since there are about 200 public-sector and nonprofit centers within the network. The legislation is meant to supplement current reporting rules and regulations. It doesn’t give a hard deadline for reporting incidents.
The legislation also directs the Government Accountability Office to study cybersecurity risks across systems and to report its findings to the Senate Committee on Health, Education, Labor and Pensions and the House Energy and Commerce Committee. The report is due within 180 days of enactment.
The network averaged about 20,000 interactions per day in 2024, according to Vibrant. Interactions include telephone calls, texts and chat. Callers to the 988 Lifeline, known as help seekers, can be routed based on veteran status, Spanish-language preference or location.
State and local centers within the network include the Philadelphia Crisis Line; Harris Center for Mental Health and IDD in Harris County, Texas; Colorado Crisis Services; the Oregon Health Authority; and the Idaho Crisis and Suicide Hotline.
The SUPPORT Act reauthorizes programs related to substance use disorder prevention, treatment and recovery. Technology-wise, it also funds prescription drug monitoring programs that track controlled-substance prescriptions across the country. These programs rely on statewide databases that collect prescription histories, flag potentially dangerous combinations, identify prescribing patterns and support fraud investigations.
The passage signals that states may use their preferred database platforms while codifying cybersecurity for the 988 Lifeline, which is considered critical national health infrastructure.
