42 U.S.C. § 290bb–36c — National Suicide Prevention Lifeline program

(a) In general The Secretary, through the Assistant Secretary, must maintain the National Suicide Prevention Lifeline program (the "program"), authorized under section 290bb–32 and in effect before December 13, 2016. (b) Activities Maintaining the program must include: (1) supporting and coordinating a nationwide network of crisis centers that provide suicide prevention and mental health crisis intervention services, including follow-up, to anyone seeking help at any time, day or night; (2) maintaining a suicide prevention hotline that connects callers to local emergency, mental health, and social services; (3) consulting the Secretary of Veterans Affairs so veterans calling the hotline can reach a specialized veterans' suicide prevention hotline; (4) improving awareness of the program through an awareness initiative and ongoing public outreach; (5) improving how demographic information is collected and analyzed, in a privacy-protecting way consistent with applicable federal and state law, to understand disparities in who accesses the program; and (6) taking steps needed to protect the hotline from cybersecurity incidents and eliminate known vulnerabilities. (c) Plan (1) To support the crisis centers and hotline, the Secretary must develop and carry out a plan to ensure high-quality service. (2) That plan must include: (A) program evaluation, with performance measures to track progress toward program goals and improve the hotline's responsiveness and performance, including at backup call centers; (B) requirements crisis centers and backup centers must meet (i) to join the network, and (ii) to make sure each call and other communication — including at backup centers — is answered promptly, consistent with evidence-based or other best-practice guidance; (C) specific recommendations and strategies for evidence-based practices, including follow-up and telling callers about community resources; and (D) criteria for periodically testing the hotline each fiscal year, including at crisis and backup centers, to catch and fix problems quickly. (3) In developing the requirements under (2)(B), the Secretary must consult state health departments, local governments, Indian Tribes, and Tribal organizations. (4) The Secretary must (A) finish the initial plan and make it publicly available within 1 year of December 29, 2022, and (B) update and republish it periodically after that. (d) Improving epidemiological data The Secretary must, as appropriate, formalize and strengthen agreements between the Lifeline program and the Centers for Disease Control and Prevention for securely sharing de-identified epidemiological data, with privacy and security protections that at least meet applicable federal law. (e) Data to assist state and local suicide prevention activities The Secretary must make the aggregated information and analyses collected under subsection (b)(5) — including from local call centers, as applicable — available in a usable format to state and local agencies to inform their suicide prevention work. (f) Cybersecurity reporting (1)(A) The program's federally funded network administrator must report to the Assistant Secretary, in a privacy-protecting way consistent with applicable federal and state law, any identified cybersecurity vulnerability or incident within a reasonable time after identifying it. (B) Local and regional crisis centers must report the same kinds of vulnerabilities and incidents to the network administrator, in the same privacy-protecting way and timeframe. (2) If the network administrator discovers, or is told by a crisis center about, a vulnerability or incident, it must report that to the Assistant Secretary within a reasonable time. (3)(A)(i) Local and regional crisis centers must oversee the technology they use to provide services, except that (ii) the network administrator oversees a center's technology if the network participation agreement assigns it that responsibility. (B) These cybersecurity reporting rules add to, and do not replace, other applicable federal cybersecurity reporting laws in effect as of December 1, 2025. (g) Authorization of appropriations $101,621,000 per year is authorized for fiscal years 2023 through 2027.