Manage My Health and Health New Zealand have been ordered to strengthen their privacy and cybersecurity systems after the Privacy Commissioner found both failed to adequately protect sensitive patient information during last year’s major cyberattack.
Privacy Commissioner Michael Webster has issued formal Compliance Notices to both organisations following the first phase of his investigation into the December 2025 Manage My Health breach. The inquiry found both organisations breached Rule 5 of the Health Information Privacy Code, which governs the storage and security of health information.
The breach affected 99,416 patients, after stolen login credentials were used to access and copy documents belonging to thousands of other patients. The information was subsequently offered for sale.
The impact was heavily concentrated in Te Tai Tokerau, with the Privacy Commissioner reporting around 91 percent of affected patients were connected to Northland hospitals, and many were likely to be Māori. This resulted from a unique arrangement allowing Northland hospital discharge information to be made available through Manage My Health.
The Commissioner identified seven areas where Manage My Health’s security protections were ineffective. Since the attack, improvements have been made around multi-factor authentication, restricting access to information and preventing unauthorised external access, but further work is required.
Health NZ has separately been directed to improve how it assesses and manages privacy and security risks when providing health information to external service providers. The earlier inquiry found shortcomings in due diligence, privacy assessments, contracts and specialist security involvement in the Northland project.
The investigation is continuing, with its second phase examining the real-world impact of the breach, including whether Northland Māori were disproportionately affected, how patients were informed and how their health information was retained and managed.
#ManageMyHealth #HealthNZ #TeWhatuOra #PrivacyBreach #CyberSecurity #DataSecurity #PatientPrivacy #HealthData #MichaelWebster #TeTaiTokerau #Northland #MāoriHealth #HauoraMāori #Whānau #DigitalHealth #PrivacyAct #WaateaNews #RadioWaatea
