In 2026, Health IT policy gains a practical reshuffle as HHS realigns roles and responsibilities. The March 31 announcement confirms a tidier structure: the Office of the Assistant Secretary for Technology Policy and the Office of the National Coordinator for Health IT will be reunited under ONC as a single, clearer office. At the same time, the HHS Chief Technology Officer, the HHS Chief Artificial Intelligence Officer, and the HHS Chief Data Officer will move back under the familiar umbrella of the OCIO. Translation: enterprise IT, cybersecurity, and data operations gain a single owner; health IT policy and standards gain a sharper focus. This is not a reboot so much as a well-timed tune-up, with a dash of pragmatism and a pinch of common sense. If you track Health IT policy changes, this reorg feels like getting the right keys for the front door.
Health IT policy reset: A friendlier HHS reorg for 2026
In practical terms, ONC’s renewed mission focuses on health IT policy, standards, and certification. The OCIO takes ownership of enterprise IT, cybersecurity, and data operations. The split clarifies accountability: who sets the policy rules, who keeps the lights on, and who fixes the firewall when the lights flicker. The change reduces overlap and reduces the risk of someone chasing a policy while their system runs on a different schedule. It’s not an elimination of collaboration; it’s a realignment that aims to keep policy and ground-level IT from stepping on each other’s toes. For health IT policy stakeholders, that means a predictable cadence for standards, better oversight on certification, and fewer bureaucratic crosswinds during urgent decisions.
Policy and Health IT harmony: A practical look at OCIO and ONC roles
With ONC focusing on policy and certification, providers, vendors, and developers get a clearer map of expectations. The OCIO will shoulder enterprise IT risk management, resilience, and cyber defense. This arrangement invites more consistent security practices and more coherent data governance. The result should be happier auditors and calmer CIOs, and maybe a few extra hours at the coffee machine. The 2026 plan also signals that AI governance will ride alongside data governance, with the CAIO feeding into the bigger picture of enterprise systems while ONC defines what good health IT policy looks like in practice. For health IT policy watchers, it’s a chance to align standards with real-world workflows, from EHR interfaces to patient data exchange.
- Health IT users will see more consistent standards across platforms.
- policy updates will be clearer and delivered on a regular cadence.
- Security and privacy will be baked into IT operations rather than bolted on.
- Data governance will be coordinated with IT change management for faster, safer updates.
What to watch for in 2026: Health IT policy and enterprise IT converge
Look for a regular policy release rhythm from ONC, including pilot standards for interoperability and certification that feel like real work with measurable impact. Expect OCIO to publish risk management playbooks, incident response practices, and clearer cybersecurity guidelines that align with enterprise IT realities. AI governance will become a more visible thread, ensuring that the CAIO’s work harmonizes with ONC’s health IT policy goals rather than wading in separate directions. For health IT policy watchers, this is an invitation to test standards against actual workflows, from patient data exchange to clinician interfaces. The real win is not just better paperwork; it is smoother collaboration between policy-makers and hands-on IT teams, which ultimately benefits patients and providers alike.
As the year progresses, you will notice tighter coordination between policy teams and frontline IT operations. Expect fewer duplicated efforts, more transparent decision dates, and a clearer trail from policy to implementation. The point is not to chase perfection but to create a reliable rhythm that keeps health IT policy aligned with practical IT realities, ensuring patient data stays private, secure, and accessible to those who need it most.
Have thoughts on how this reorganization might affect your work, your vendors, or your patients? Share your perspectives in the comments below. Your insights help everyone understand the real-world impact of governance changes in health IT policy and enterprise IT.
Special thanks to the American Hospital Association for coverage of the change. You can read the original here: Original article.
Practical steps for organizations adapting to the reorg
- Map current workflows to the new OCIO/ONC responsibilities, noting where policy decisions impact IT operations.
- Catalog existing standards and certifications, identifying gaps that the reorganization could help close.
- Align data governance with change management so updates land safely and quickly.
- Prepare security playbooks that reflect enterprise IT realities and new governance lines.
Frequently Asked Questions
- How will ONC’s role change under the reorg? ONC will focus more on health IT policy, standards, and certification, while the OCIO handles enterprise IT operations and cyber defense.
- What stays with the OCIO? Enterprise IT, cybersecurity, and data operations remain under the OCIO’s umbrella, ensuring continuity for day-to-day IT work.
- How does AI governance fit in? The CAIO will coordinate with ONC and OCIO to ensure AI initiatives align with health IT policy goals and practical IT needs.
- Will this improve patient data security? The reorg aims for clearer accountability and tighter integration of security in IT operations, benefiting privacy and risk management.