Privacy Commissioner Released The Results Of Phase 1 Of Inquiry Into The December ...

News Video | Policy | GPs | Hospitals | Medical | Mental Health | Welfare |

Privacy Commissioner Michael Webster has today released the results of Phase 1 of his Inquiry into the December 2025 Manage My Health cyber incident in which the sensitive health information of New Zealanders was accessed, stolen and put up for sale. Phase 1 has focussed on what caused the breach and who was accountable.

New Zealanders rightly expect any agency collecting, holding, using or storing their sensitive health information to maintain high standards of privacy and data protection. The Inquiry has found both Manage My Health and Health NZ failed in their responsibilities to have reasonable security safeguards in place to protect patient information, meaning they breached Rule 5 of the Health Information Privacy Code, relating to the storage and security of information.

“My inquiry has found that there were several problems with how patient information was managed. This incident released the sensitive health information of nearly 100,000 New Zealanders and has caused serious anxiety and distress for many people.

The effects are concentrated in Northland with around 91 percent of affected patients based there, many of whom are likely to be Māori.”

“The reason so many Northland patients were caught up in the breach was because of a unique arrangement between Health NZ and Manage My Health in Northland involving hospital discharge information – it was not happening in hospitals in the rest of the country.

Given the Inquiry’s finding, the Privacy Commissioner intends to issue compliance notices to Manage My Health and Health NZ. “Compliance notices are the strongest tool I have currently have available to me to respond to serious privacy breaches”, Mr Webster said.

“While both Manage My Health and Health NZ have already made changes to their security settings, compliance notices will formally require both of them to complete any necessary remaining work and demonstrate to my satisfaction that all changes are working effectively.

“In particular, several of Manage My Health’s technical security safeguards were inadequate at the time the breach occurred. We recognise that Manage My Health has made several important changes, but we want to independently check what has been done and that the changes provide effective protection against similar types of attacks in future.

“Also, we consider that Health NZ should have done more to make sure that Northland hospital patients’ information would be safe before arranging to send it to patients through the Manage My Health portal. This was a novel digital project involving transfers of large amounts of health information. Health NZ’s structure and processes are different now and it has made many improvements.”

While the inquiry has focused on the Manage My Health breach, it is important for other health agencies, including other third-party providers, to look at the findings and ask themselves what they need to do to make sure the same thing couldn’t happen to them.

“Digital innovation can unlock greater efficiencies and effectiveness in service delivery. Patient health portals are an important part of the health sector and can improve privacy by enabling people to access their own information easily. But it’s important to make sure the portals are as safe as possible. Patients need to be able to trust that their sensitive health information is being protected. Lessons need to be learnt across the health sector to stop these types of breaches from happening again,” says the Commissioner.

In particular, the report recommends that the Ministry of Health should set up a process for verifying and assuring that patient health portals such as Manage My Health meet health sector security standards. It is not practicable for every user, such as individual GP practices, to do their own separate security testing or assurance. Instead, providers should be checked and approved at a central level.

The inquiry also recommends that the Privacy Act be amended to allow third party providers who do not meet reasonable security safeguards to be held liable, even where they are collecting, storing or processing on behalf of another agency. “Third parties are increasingly playing a key role in the sharing, processing and storage of personal data. As such they are a target for malicious actors. It is critical they too are incentivised to put in place safeguards”.

Key Inquiry Findings – Manage My Health

The cybersecurity breach was not the result of a single security failure, but was due to a combination of problems, including:

The inquiry also raised questions the quality of Manage My Health’s overall approach to security design, as well as the quality of its risk management practices.

Key Inquiry Findings – Health NZ

Most of the information that was stolen from Manage My Health was information sourced from hospitals in Northland. Health NZ should have taken more steps to make sure that it was safe to pass on the information to patients through MMH. Key points were:

Key Inquiry Findings – GP practices

There is nothing that GP practices could have done to have prevented this breach and they were not the source of the information that was stolen. GP practices are therefore not liable for security failings that caused this particular breach.

However, if another area of the portal had been affected, it could have been otherwise. So, the inquiry report sets out reasonable security safeguards that the Office of the Privacy Commissioner expects all GP practices to have in place when using patient portals. Even if their patients haven’t been affected by the breach, it is important for all GP practices to review these findings to ensure that they can be confident that they’ve taken adequate steps to protect patient information.

The second phase of the Inquiry, which is to commence soon, is also likely to look into further questions GP’s obligations when using patient health portals including what patients are told and how authorisation is obtained to set up accounts.

Lessons for the health sector

The Inquiry includes lessons for how the health sector manages personal information; including:

The Inquiry into the Manage My Health cyber incident is being done in two phases. Phase 1 of the Inquiry has focussed on causes and accountability. Phase 2 will focus on the impacts of the breach. This report completes Phase 1. OPC is now able to begin considering privacy complaints from people affected by the breach.

The scope and timing of Phase 2 will be announced shortly but is likely to include:

Phase 2 will gather information to assess the impacts of the breach, including meetings witH affected health providers in Northland. Phase 2 may result in further compliance action where it is demonstrated that breaches of the Privacy Act have occurred.

The grants support community-based oral history projects that reflect the diverse identities and perspectives of our nation. Manatū Taonga Ministry for Culture and Heritage administers this funding.

PILLAR is calling on the Minister to halt the progression of the bill before its third reading and engage in extensive consultation with the homeschooling sector before granting sweeping new powers to an unelected body.

The tool, which has been imported from Australia, was designed for 90-minute assessments whereas most schools in Aotearoa worked to timetables of 60-minute classes.

We demand full transparency from the New Zealand Government the decision-making process behind scrapping Fees Free, including the evidence, advice, and impacts considered before the policy was removed.

As the event builds toward its 50th anniversary in 2028, organisers are encouraging riders from across New Zealand and beyond to get behind this iconic Kiwi event and help keep the legacy rolling for future generations.

Calls For Course Change In Education, More Funding For People

Get started today with a free trial