HHS Shuffles Internal Cyber, AI Oversight Back to CIO Office

The U.S. Department of Health and Human Services has reversed courses on changes made during the Biden-era that expanded both the name and scope of the long-standing Office of the National Coordinator for Health IT.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Under the course-correction, ONC will again have a narrower focus on external health IT policy, standards and certification interoperability – while HHS’ Office of the CIO, or OCIO, will regain internal enterprise-wide technology execution across cybersecurity, cloud, AI and data operations.

In 2024, the Biden administration, renamed the Office of the National Coordinator for Health Information Technology to the “Assistant Secretary for Technology Policy/ONC” – or ASTP/ONC for short – to formalize an expanded role in setting department-wide technology, data and AI policy. That shift expanded ONC’s narrower focus since its creation in 2009 from certified electronic health records to a broader mandate that also included some department-wide responsibilities.

Under the Biden-era changes, HHS’ CTO, chief artificial intelligence officer and chief data officer functions reported to ASTP/ONC. But under the Trump administration’s changes this week, those CTO, AI and data operations functions are centralized back to the OCIO. And ASTP/ONC is now simply called “ONC” again.

“This structure reinforces OCIO’s statutory responsibility for enterprise IT, cybersecurity and data operations, while enabling ONC to concentrate on health IT policy, standards and certification that support better care and lower costs,” HHS said in a statement Tuesday announcing the changes.

Some experts said the reshuffling at HHS makes sense and could help bolster cybersecurity and other critical IT activities within the department.

“It’s a very positive move. It aligns cybersecurity with data governance, AI, innovation and enterprise technology under OCIO leadership,” said attorney Lee Kim, founder of consulting firm Keytera and former longtime cybersecurity and privacy principal at the Healthcare Information Management and Systems Society.

“This reduces enterprise-wide risk, enables innovation and growth, and protects sensitive data and assets. Coordination, governance and execution will be vital,” she said.

The reorganization will also likely improve how security policies, controls, practices and workforce training are developed and implemented across HHS divisions and offices, Kim said.

“This is an opportunity for a reboot and to take a more holistic, enterprise-wide approach. Over time, this can help reduce technical debt, including legacy systems and ensure systems align with strategic IT, security and innovation road maps.”

As for emerging technologies, secure AI and quantum adoption will dictate the speed of progress and innovation at HHS, Kim said. “HHS can help the private sector by sharing more guidance on governance, security practices and information sharing best practices.”

Lucia Savage, former chief privacy officer at ONC during the Obama administration, agreed that the restructuring could help strengthen HHS’ internal cybersecurity but will not likely affect cybersecurity issues involving the external health IT world.

“There is a chance that now separated again, these offices that handled HHS internal systems will be able to focus on any remedial security attention those systems need, including assisting the HHS Secretary in understanding what Congress needs to fund for that,” she said.

But in terms of the broader state of cybersecurity in the health IT and healthcare ecosystem, “I expect this will have little to no impact and certainly no immediate impact,” she said.

What may be more impactful is if HHS’ Office for Civil Rights finalizes its proposed update of the HIPAA Security Rule, which was published in the final days of the Biden administration, she said.

“That rule will impact all covered entities and business associates who are not presently meeting whatever standards that rule articulates, like standards for encryption,” she said. “To the extent that an HHS division is subject to HIPAA, that division will also be impacted by this rule.” (See: What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

HHS is expected to make some kind of move with the proposed rulemaking by this summer.