{"id":454817,"date":"2026-06-01T02:29:09","date_gmt":"2026-06-01T02:29:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/454817\/"},"modified":"2026-06-01T02:29:09","modified_gmt":"2026-06-01T02:29:09","slug":"manage-my-health-privacy-breach-provides-lessons-for-us-all-frith-tweedie","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/454817\/","title":{"rendered":"Manage My Health privacy breach provides lessons for us all \u2013 Frith Tweedie"},"content":{"rendered":"

About 91% of the people affected were from Northland because of a Health NZ project that used the MMH portal to deliver hospital documents in that region. Health NZ also actively encouraged patients and GP practices around the country to use MMH. <\/p>\n

Privacy Commissioner Michael Webster described the breach as one of New Zealand\u2019s biggest and worst. He emphasised that it caused \u201cserious anxiety and distress for many people\u201d. <\/p>\n

MMH and Health NZ were found to have breached the Privacy Act and will be issued with compliance notices. <\/p>\n

Not just a security issue<\/p>\n

While MMH\u2019s failures were mostly technical, Health NZ\u2019s were human. <\/p>\n

The report identified a range of privacy governance failures by Health NZ that contributed to the breach, including poor oversight, accountability, due diligence, risk assessment and contractual safeguards.<\/p>\n

Good privacy cannot be achieved through security controls alone. Organisations need to understand and remain accountable for how they collect and handle personal information.<\/p>\n

Relevance beyond healthcare <\/p>\n

The Privacy Commissioner is clear that all agencies need to consider the findings, not just those in the health sector. <\/p>\n

Many of the issues \u201cwill resonate and make you think about what you need to do to make sure the same thing couldn\u2019t happen to you in the future\u201d. That includes the following. <\/p>\n

Outsourcing services does not outsource accountability. The Commissioner warns that \u201csimply relying on vendor assurances about their security profile is problematic\u201d. Robust due diligence is essential.Privacy and security expertise is key to good privacy governance and oversight. And good governance is critical to understanding and managing privacy and security risks.Privacy impact assessments are essential tools for understanding privacy risks. The Privacy Commissioner found \u201cserious problems with the quality of the privacy risk assessments\u201d\u00a0done by Health NZ, presenting \u201ca lost opportunity\u201d to test the effectiveness of privacy safeguards.Appropriate contractual safeguards need to be in place when engaging third-party providers to handle data.\u00a0<\/p>\n

Where to from here?<\/p>\n

The Privacy Commissioner is recommending changes to the Privacy Act to make third-party service providers directly liable for ensuring reasonable security safeguards are in place for the personal information they process on behalf of customers.<\/p>\n

At the moment, legal responsibility can be unclear when organisations outsource data handling functions to vendors and cloud platforms. The Office of the Privacy Commissioner is signalling this is no longer good enough, particularly where sensitive health information is involved. <\/p>\n

Privacy law reform has also been suggested as part of the Cyber Security Action Plan 2026\u20132027 to incentivise the protection of personal information. That may include the introduction of a civil pecuniary penalty regime under the Privacy Act 2020. <\/p>\n

All organisations should expect greater scrutiny<\/p>\n

It\u2019s also sensible to keep an eye out for phase two of the MMH inquiry, which will investigate the broader impacts of the breach, including transparency practices, data retention, notification communications and whether the breach caused a disproportionate impact on Northland M\u0101ori.<\/p>\n

In short, organisations handling personal information should expect greater scrutiny of their privacy and security practices going forwards. Those who rely on digital services and third-party platforms should pay particular attention.<\/p>\n

Don\u2019t wait until new laws come in or a data breach before you act. Organisations that invest now in transparency, governance, privacy expertise and responsible practices will be better placed to adapt to increasing regulatory and public expectations.<\/p>\n

\"IntellectualIntellectual property lawyer turned Simply Privacy principal and NZ AI Forum Executive Council member Frith Tweedie.<\/p>\n

Frith Tweedie, a Partner at Simply Privacy, is a former lawyer who helps clients develop robust privacy and AI governance practices. She has designed and implemented privacy and AI governance frameworks for a range of clients across both the private and public sectors. Tweedie was previously the general counsel and chief privacy officer at a local tech company and led the Australian and NZ Digital Law teams at EY Law. She is a member of the Government Chief Digital Officer\u2019s AI Expert Advisory Panel and the IAPP\u2019s AI Governance Centre global advisory board. She served as an elected member of the AI Forum NZ Executive Council from 2019 to 2025.<\/p>\n

Catch up on the debates that dominated the week by signing up to our Opinion newsletter<\/a> \u2013 a weekly round-up of our best commentary.<\/p>\n","protected":false},"excerpt":{"rendered":"About 91% of the people affected were from Northland because of a Health NZ project that used the…\n","protected":false},"author":2,"featured_media":233783,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[5263,231348,4378,42343,2082,231346,8559,16104,134,527,5511,183858,25336,9554,4977,111,139,69,231349,6903,104249,4248,231347,3040,191018,18324],"class_list":["post-454817","post","type-post","status-publish","format-standard","has-post-thumbnail","category-healthcare","tag-all","tag-amplified","tag-breach","tag-failure","tag-for","tag-frith","tag-governance","tag-hack","tag-health","tag-healthcare","tag-just","tag-lapse","tag-lessons","tag-manage","tag-my","tag-new-zealand","tag-newzealand","tag-nz","tag-overreliance","tag-privacy","tag-provides","tag-technical","tag-tweedie","tag-us","tag-vendors","tag-wasnt"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/454817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=454817"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/454817\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/233783"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=454817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=454817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=454817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}