Independent review recommends stronger cyber security across health system

The Ministry of Health is strengthening cyber security across the health system following an independent review into the Manage My Health (MMH) cyber incident.

This includes new work to ensure key third ‑ party suppliers are independently assessed against required security standards.

Ministry of Health Chief Medical Officer Dr Joe Bourne says this was a serious breach involving the cyber theft of highly sensitive health information affecting 99,000 people. New Zealanders expect strong protections, and action is already underway across the system to strengthen them.

Dr Bourne says a key lesson is the need for independent assurance of third ‑ party suppliers, rather than relying solely on self ‑ assessment. This incident has highlighted clear areas where the system needs to improve, and our focus is now on learning from it and implementing these changes at pace.

Ministry of Health Chief Information Officer Quin Carver says the Ministry and Health New Zealand are already taking action, including:

Mr Carver says further work is underway to establish a more consistent, system ‑ wide approach to independently validating that health sector suppliers holding sensitive health data meet appropriate cyber security standards, responding to recommendations from both this review and the Office of the Privacy Commissioner.

To strengthen the protections for health data, the review makes 26 recommendations focused on reducing the likelihood and impact of similar incidents. These include:

Dr Bourne says the Ministry has accepted all the report’s recommendations. Three actions are complete; five have been actioned and the Ministry is awaiting external confirmation they are complete); 12 are underway and a further six are being planned.

He says Manage My Health has already taken action to strengthen their data protections.

Dr Bourne says protecting people’s health information is fundamental to trust in the health system. This review highlights that strong governance, clear accountability, and independent assurance are essential to reducing cyber risk.

The Ministry of Health and Health New Zealand have also written to key health sector leaders emphasising the importance of this.

The Ministry will continue to work with Health New Zealand, the Office of the Privacy Commissioner, and sector partners to implement its action plan and will provide updates as this work progresses.