Northland<\/a> hospital patients through ManageMyHealth.<\/p>\nOf the 99,416 patients affected, 90,850 had data from Health NZ included.<\/p>\n
Health NZ and ManageMyHealth had a unique arrangement in the region involving hospital discharge information, which is why most people caught up in the breach were from Northland.<\/p>\n
Hospitals outside the region were not affected.<\/p>\n
Webster said the project was \u201ca novel digital project involving transfers of large amounts of health information\u201d.<\/p>\n
![\"Privacy]()
Privacy Commissioner Michael Webster.<\/p>\n
According to the inquiry, the project team that engaged with ManageMyHealth did not include specialist privacy and security personnel needed for a project of this type and scale.<\/p>\n
Instead of carrying out independent checks of the health portal\u2019s security and privacy, the project team relied too heavily on information from ManageMyHealth.<\/p>\n
The inquiry found poor-quality internal privacy risk assessments left project designers and decision-makers insufficiently informed about what was needed to safely share hospital information through the portal.<\/p>\n
The contract between Health NZ and ManageMyHealth was not fit for purpose.<\/p>\n
\u201cIt was generic rather than being designed to reflect how the information sharing would work and what was necessary to protect the information.\u201d<\/p>\n
Webster plans to issue compliance notices to ManageMyHealth and Health NZ.<\/p>\n
\u201cCompliance notices are the strongest tool I currently have available to me to respond to serious privacy breaches,\u201d he said.<\/p>\n
The notices require ManageMyHealth and Health NZ to demonstrate to Webster\u2019s satisfaction that security improvements are effective.<\/p>\n
The inquiry found GP practices were not liable as there was nothing they could have done to prevent the breach and were not the source of the stolen information.<\/p>\n
ManageMyHealth apologised for the breach, saying it was a deliberate criminal attack that used compromised credentials to exploit a vulnerability.<\/p>\n
![\"ManageMyHealth]()
ManageMyHealth offices in Auckland. Photo \/ Michael Craig<\/p>\n
The organisation has since implemented security and operational improvements, including mandatory multi-factor authentication, enhanced real-time monitoring and alerting, strengthened access controls, and expanded independent security testing across the platform.<\/p>\n
\u201cWe are continuing to work constructively with regulators and sector partners to demonstrate that our controls are in place and operating effectively.\u201d<\/p>\n
ManageMyHealth said it was not aware of any stolen data being publicly released beyond the initial sample shared.<\/p>\n
\u201cOngoing dark web monitoring is in place, supported by High Court injunctions to restrict access to and further distribution of the data.\u201d<\/p>\n
Health NZ accepted the Privacy Commissioner\u2019s finding it should have done more.<\/p>\n
\u201cOn this occasion, patients were let down and that is unacceptable,\u201d Health NZ chief financial officer Bevan McKenzie said.<\/p>\n
\u201cThe incident revealed weaknesses in the Northland patient portal arrangement, which had been designed to improve patient services.\u201d<\/p>\n
McKenzie said Health NZ had stopped the flow of information from the Northland health district to ManageMyHealth, and apologised to any patients surprised to find their health information was stored in the portal.<\/p>\n
![\"Health]()
Health NZ and ManageMyHealth had a unique arrangement in Northland involving hospital discharge information. Photo \/ NZME<\/p>\n
Patient access to ManageMyHealth portals and their GP-related clinical records, appointments and repeat prescription services are unaffected.<\/p>\n
McKenzie said measures were being put in place so Northland patients could immediately receive a paper copy of their discharge summary and to avoid impacting patient services.<\/p>\n
\u201cWhile ensuring people have timely access to their own health information is a priority for Health NZ, safeguarding the security of that information must always remain paramount.\u201d<\/p>\n
Health NZ commissioned its own independent review into the cyber breach, its relationship with ManageMyHealth and the management of Northland patient records to prevent a repeat.<\/p>\n
The review called for sweeping reforms, including stronger national security standards, tighter oversight of third-party providers, and a full review of health data systems across the country.<\/p>\n
While the inquiry focused on the ManageMyHealth breach, Webster indicated it was a wake-up call for the health sector.<\/p>\n
He said while digital innovation, such as patient portals, could unlock more efficient and effective services, safety was paramount.<\/p>\n
\u201cPatients need to be able to trust that their sensitive health information is being protected.\u201d<\/p>\n
The Ministry of Health will tighten cyber security across the health system after its own independent review into the breach. It called one of the most serious experienced by the New Zealand health sector.<\/p>\n
Measures include independent security checks on suppliers, stronger standards for handling health data, improved patient notification processes, and a wider review of digital health systems, with all recommendations accepted and work already underway.<\/p>\n
Ministry of Health chief information officer Quin Carver said protecting people\u2019s health information was fundamental to trust in the health system.<\/p>\n
The second phase of the Privacy Commissioner\u2019s inquiry is expected to start soon and will assess the attack\u2019s impact. <\/p>\n
Privacy complaints from affected patients could now be considered.<\/p>\n
Further compliance action may result if it can be demonstrated breaches of the Privacy Act have occurred.<\/p>\n","protected":false},"excerpt":{"rendered":"Privacy Commissioner Michael Webster said the ordeal had caused \u201cserious anxiety and distress\u201d for many affected. He announced…\n","protected":false},"author":2,"featured_media":446402,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[1975,5660,14903,4373,3105,12513,62381,11424,1874,16104,134,15415,37601,296,127691,9862,3025,111,43,139,1067,69,1523,1597,6903,30308,42912,12975,2437,1238,11422,2963],"class_list":["post-446401","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-at","tag-attacks","tag-commissioner","tag-cyber","tag-data","tag-failed","tag-fault","tag-finds","tag-found","tag-hack","tag-health","tag-information","tag-inquiry","tag-into","tag-managemyhealth","tag-meet","tag-most","tag-new-zealand","tag-news","tag-newzealand","tag-northland","tag-nz","tag-over","tag-patient","tag-privacy","tag-protect","tag-required","tag-sector","tag-security","tag-serious","tag-standards","tag-zealands"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/446401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=446401"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/446401\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/446402"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=446401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=446401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=446401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}