A hospital is rolling out a new patient-portal system that stores electronic health records. Leadership asks who should be formally accountable for assigning the classification level of the patient data and approving who may access it. The IT infrastructure team manages the servers and encryption, while the compliance office monitors regulatory requirements. Which party should hold this accountability?