The hackers compromised 403,730 Health New Zealand documents and 22,609 documents that had been uploaded by patients.
Now, Commissioner Michael Webster has put the two organisations on notice and set deadlines for them to meet requirements.
The notices were issued for failing to comply at the time of the breach with the security requirements of rule 5 of the Health Information Privacy Code.
The rules required Manage My Health to ensure there were reasonable safeguards to prevent loss, misuse or disclosure of personal information.
Webster noted some changes had already been completed.
Manage My Health had already improved on the effectiveness of multifactor authentication, as well as restricting user access to information and controlling unauthorised external access, the commissioner’s office said.
Webster said he was thinking particularly of Māori in Northland, where 90% of the affected patients whose data was stolen live.
“These Compliance Notices will ensure, and confirm to me, that Manage My Health and Health New Zealand are treating patient data securely and it will give New Zealanders assurance that we take these breaches seriously and that strengthening systems is vitally important,” he said.
Manage My Health has until the end of August 2027 to make the changes, while Health New Zealand has until the end of January.