§ 290bb–36c — National Suicide Prevention Lifeline Program

(a) The Secretary, acting through the Assistant Secretary, shall maintain the National Suicide Prevention Lifeline program (referred to in this section as the “program”), authorized under section 290bb–32 of this title and in effect prior to December 13, 2016. (b) In maintaining the program, the activities of the Secretary shall include— (1) supporting and coordinating a network of crisis centers across the United States for providing suicide prevention and mental health crisis intervention services, including appropriate follow-up services, to individuals seeking help at any time, day or night; (2) maintaining a suicide prevention hotline to link callers to local emergency, mental health, and social services resources; (3) consulting with the Secretary of Veterans Affairs to ensure that veterans calling the suicide prevention hotline have access to a specialized veterans’ suicide prevention hotline; (4) improving awareness of the program for suicide prevention and mental health crisis intervention services, including by conducting an awareness initiative and ongoing outreach to the public; (5) improving the collection and analysis of demographic information, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws, in order to understand disparities in access to the program among individuals who are seeking help; and (6) taking such steps as may be necessary to ensure the suicide prevention hotline is protected from cybersecurity incidents and eliminates known cybersecurity vulnerabilities. (1) For purposes of supporting the crisis centers under subsection (b)(1) and maintaining the suicide prevention hotline under subsection (b)(2), the Secretary shall develop and implement a plan to ensure the provision of high-quality services. (2) The plan required by paragraph (1) shall include the following: (A) Program evaluation, including performance measures to assess progress toward the goals and objectives of the program and to improve the responsiveness and performance of the hotline, including at all backup call centers. (B) Requirements that crisis centers and backup centers must meet— (i) to participate in the network under subsection (b)(1); and (ii) to ensure that each telephone call and applicable other communication received by the hotline, including at backup call centers, is answered in a timely manner, consistent with evidence-based guidance or other guidance or best practices, as appropriate. (C) Specific recommendations and strategies for implementing evidence-based practices, including with respect to followup and communicating the availability of resources in the community for individuals in need. (D) Criteria for carrying out periodic testing of the hotline during each fiscal year, including at crisis centers and backup centers, to identify and address any problems in a timely manner. (3) In developing requirements under paragraph (2)(B), the Secretary shall consult with State departments of health, local governments, Indian Tribes, and Tribal organizations. (4) The Secretary shall— (A) not later than 1 year after December 29, 2022, complete development of the initial plan under paragraph (1) and make such plan publicly available; and (B) periodically thereafter, update such plan and make the updated plan publicly available. (d) The Secretary shall, as appropriate, formalize and strengthen agreements between the Suicide Prevention Lifeline program and the Centers for Disease Control and Prevention with respect to the secure sharing of de-identified epidemiological data. Such agreements shall include appropriate privacy and security protections that meet the requirements of applicable Federal law, at a minimum. (e) The Secretary shall ensure that the aggregated information collected and any applicable analyses conducted under subsection (b)(5), including from local call centers, as applicable, are made available in a usable format to State and local agencies in order to inform suicide prevention activities. (A) The program’s network administrator receiving Federal funding pursuant to subsection (a) shall report to the Assistant Secretary, in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerabilities to the program within a reasonable amount of time after identification of such a vulnerability; and (ii) any identified cybersecurity incidents to the program within a reasonable amount of time after identification of such incident. (B) Local and regional crisis centers participating in the program shall report to the program’s network administrator identified under subparagraph (A), in a manner that protects personal privacy, consistent with applicable Federal and State privacy laws— (i) any identified cybersecurity vulnerabilities to the program within a reasonable amount of time after identification of such vulnerability; and (ii) any identified cybersecurity incidents to the program within a reasonable amount of time after identification of such incident. (2) If the program’s network administrator receiving funding pursuant to subsection (a) discovers, or is informed by a local or regional crisis center pursuant to paragraph (1)(B) of, a cybersecurity vulnerability or incident, within a reasonable amount of time after such discovery or receipt of information, such entity shall report the vulnerability or incident to the Assistant Secretary. (i) Except as provided in clause (ii), local and regional crisis centers participating in the program shall oversee all technology each center employs in the provision of services as a participant in the program. (ii) The program’s network administrator receiving Federal funding pursuant to subsection (a) shall oversee the technology each crisis center employs in the provision of services as a participant in the program if such oversight responsibilities are established in the applicable network participation agreement. (B) The cybersecurity incident reporting requirements under this subsection shall supplement, and not supplant, cybersecurity incident reporting requirements under other provisions of applicable Federal law that are in effect on December 1, 2025. (g) To carry out this section, there are authorized to be appropriated $101,621,000 for each of fiscal years 2023 through 2027.