On September 24, 2026, UnitedHealth Group named Jodee Kozlak to a newly created role: Chief Administrative Officer, effective September 28. The company says the role will drive "enterprise modernization and alignment" and will lead a portfolio that initially covers People, Real Estate, Procurement and Corporate Security [1].
Kozlak was chief human resources officer at Target from 2004 to 2015 and worked on Alibaba's expansion outside China in 2016–2017. She trained as a lawyer and accountant, chairs the board of C.H. Robinson and is lead independent director at KB Home [1].
Why now
The role arrives in the middle of a turnaround.
- Leadership reset. Stephen Hemsley returned as CEO in May 2025 [2]. By April 2026, nearly half of the company's top 100 leadership roles had changed [3].
- Scrutiny. In July 2025 UnitedHealth confirmed it was complying with formal criminal and civil requests from the Department of Justice about its Medicare practices [4]. No charges have been filed.
- Restructuring. The FY2025 10-K reports restructuring charges that include real estate rationalization and workforce reductions [5].
- Scale. The company reported more than 390,000 employees at the end of 2025 [5].
Business units have new leaders. The support layer underneath them (people, space, vendors, site security) now has a single owner.
Where the role sits
The chart below shows UnitedHealth's executive structure as publicly disclosed. UnitedHealth has not disclosed who the CAO reports to, or how the role relates to the existing Chief People Officer. Both are shown as open questions.
Two structural points stand out:
- Security is already split. Heather Cianfrocco became EVP of Governance, Compliance and Information Security in May 2025 [6]. The 10-K describes cybersecurity as overseen by the Chief Security Officer and the Chief Digital and Technology Officer [5]. The CAO's "Corporate Security" most likely means physical and workplace security, but UnitedHealth has not drawn that boundary publicly.
- People already has an owner. Erin McSweeney has been Chief People Officer since March 2022 [5]. Whether she now reports to the CAO is the most important open question in the new structure.
What the CAO portfolio covers
What the 10-K already admits
UnitedHealth's FY2025 annual report describes three risks that land directly in this portfolio [5]:
- System consolidation. The company says it may not succeed in consolidating the number of information systems it operates, and that failure could raise costs.
- Acquired businesses. It warns of more acute IT vulnerabilities in recently acquired businesses, which it may not be able to fix soon after closing.
- Vendors. It relies on third-party vendors whose operations sit outside its direct oversight and control.
The clearest example is Change Healthcare. Attackers used compromised credentials on a remote-access portal that did not have multi-factor authentication [8]. The incident was reported to affect about 192.7 million people, the largest healthcare breach on record [9]. Change was an acquired business.
What any health plan in transition should check
UnitedHealth is an extreme case, but the pattern is common: plans grow through acquisitions faster than their systems, vendors and controls converge. Leadership changes, restructurings and market exits then expose the gaps.
We turned the UnitedHealth case into a 20-question checklist across five areas:
- Systems & platforms: one inventory, one owner per system, a dated retirement plan.
- Data & reporting: one member identity, one metric dictionary, traceable risk-adjustment submissions.
- Identity & access: multi-factor authentication and access reviews at every entity, not only at headquarters.
- Vendors & regulators: Business Associate Agreements, one owner for third-party risk, one pipeline to CMS.
- People & sites: one workforce view, cost against actual use, one runbook for closing a site.
Sources
- UnitedHealth Group, "UnitedHealth Group Announces Addition to Leadership Team," September 24, 2026. https://www.unitedhealthgroup.com/newsroom/2026/2026-09-24-uhg-announces-addition-to-leadership-team.html
- UnitedHealth Group, "UnitedHealth Group Announces Leadership Transition," May 13, 2025. https://www.unitedhealthgroup.com/newsroom/2025/2025-05-13-uhg-announces-leadership-transition.html
- Star Tribune, "UnitedHealth has changed nearly half its top 100 executives in a year," April 2026. https://www.startribune.com/unitedhealth-profit-and-outlook-signal-start-of-turnaround/601667309
- UnitedHealth Group, "UnitedHealth Group responds to Department of Justice investigation," July 24, 2025. https://www.unitedhealthgroup.com/newsroom/2025/2025-07-24-uhg-responds-to-doj-investigation.html
- UnitedHealth Group, Form 10-K for fiscal year 2025 (SEC). https://www.sec.gov/Archives/edgar/data/731766/000073176626000062/unh-20251231.htm
- Optum, "UnitedHealth Group announces executive leadership team changes," April 29, 2025. https://www.optum.com/en/newsroom/people-culture/unitedhealth-group-announces-executive-leadership-team-changes.html
- Healthcare Dive, "UnitedHealth names first chief administrative officer," September 24, 2026. https://www.healthcaredive.com/news/unitedhealth-first-chief-administrative-officer-jodee-kozlak/831247/
- Testimony of Andrew Witty, U.S. Senate Committee on Finance, May 1, 2024. https://www.finance.senate.gov/imo/media/doc/0501_witty_testimony.pdf
- U.S. Department of Health and Human Services, "Change Healthcare Cybersecurity Incident Frequently Asked Questions." https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
Nimbotools is not affiliated with UnitedHealth Group. This note uses only public sources. Investigations mentioned have not resulted in charges.