Who should be responsible for protecting the nation's health data: the office that writes the rules, or the office that runs the systems? That question has taken on fresh urgency inside the U.S. Department of Health and Human Services (HHS) after a recent internal reorganization that moves cybersecurity, cloud, artificial intelligence (AI) and enterprise data operations back under the department's Office of the Chief Information Officer (OCIO), while returning the Office of the National Coordinator for Health IT (ONC) to a narrower role focused on external health IT policy and standards.
What changed and why it matters
HHS’s shift reverses structural adjustments made during the previous administration and was reported by GovInfoSecurity. The reallocation places department-wide responsibilities for cybersecurity, cloud infrastructure, AI oversight and data management within OCIO, while ONC will concentrate on setting and coordinating health IT policy with external stakeholders—vendors, providers and interoperability initiatives.
At a practical level, the move separates policy development from enterprise operations. OCIO will now oversee technical defenses, platform strategy and cross-agency IT services for HHS, while ONC resumes its traditional role as the policy and standards voice on health information exchange, interoperability, and related external-facing initiatives.
Background: a brief institutional history
ONC was created to help modernize health information technology, shepherd interoperability standards and coordinate federal policy affecting electronic health records and data exchange. Over time it has become central to national efforts on interoperability, standards and measures intended to make patient data more portable across providers.
OCIO, by contrast, is the department’s internal technology steward—responsible for cybersecurity posture, cloud adoption, enterprise architecture and the protection of departmental systems and data. The two offices have different missions: ONC shapes policy and standards for the broader health sector; OCIO secures and runs HHS’s own IT environment.
Implications: perspectives and risks
- Technologists: Centralizing cybersecurity and cloud under OCIO could streamline incident response, standardize architectures and reduce duplication. It may also speed procurement and implementation of protective tools. But during transitions, operational continuity risks increase; handoffs and redefined roles often create temporary coverage gaps and confusion over authority.
- Policymakers: Returning ONC to a policy-focused remit clarifies who negotiates standards with industry and other federal partners. However, separating policy from operations can widen the disconnect between standard-setting and practical enforcement or technical feasibility, complicating implementation of rules that affect system administrators.
- Health care organizations and patients: The central question is whether the reorganization will translate into better protection of patient records and more reliable services. If OCIO can harden HHS systems and accelerate secure cloud adoption, patient data may be safer. Conversely, if the shuffle disperses responsibility for AI governance or creates inter-office friction, patients could face delayed protections or inconsistent guidance.
- Adversaries: Any bureaucratic reconfiguration presents a potential window of vulnerability. Cyber threat actors prize uncertainty and transition periods. Conversely, a more unified enterprise security posture under OCIO could raise the bar for attackers if executed effectively.
What to watch next
Key indicators of whether the change succeeds will include the speed and clarity of new roles and authorities; published guidance on AI governance and data stewardship from OCIO; continued ONC engagement on interoperability frameworks; and the department’s ability to maintain uninterrupted incident response and compliance programs during the handover. Observers should watch for updates to HHS’s cybersecurity strategy, any new inter-agency memoranda defining responsibilities, and public statements from ONC and OCIO clarifying their respective scopes.
Reorganizations are a common tool in government to align responsibilities with evolving priorities. But in health care—where data breaches can cost lives, and AI tools are increasingly woven into diagnosis and care—the stakes are high. Will this reset produce a leaner, more secure HHS that separates policymaking from operations and eliminates overlap? Or will it simply shuffle authority without addressing deeper needs for coordination, accountability and resilience?
