Privacy Commissioner orders Health NZ and Manage My Health to tighten data security
The Privacy Commissioner has given Health NZ and the patient portal Manage My Health deadlines to meet health-privacy rules after a large data breach.
A massive breach in December last year compromised 403,730 Health NZ records and 22,609 documents uploaded by patients, affecting nearly 100,000 people, most of whom live in Northland. The Privacy Commissioner concluded that both Health NZ and its portal Manage My Health did not meet the security requirements of rule 5 of the Health Information Privacy Code at the time of the attack. As a result, formal compliance notices have been issued, setting a deadline of August 2027 for Manage My Health to implement required changes and a deadline of the end of January for Health NZ.
The commissioner noted that Manage My Health has already enhanced multi-factor authentication, limited user access, and blocked unauthorized external connections. He emphasized the importance of protecting Māori patients in Northland and restoring public confidence in the health system.
Why it matters
It highlights the need for stronger safeguards of sensitive health data after a large cyber-attack.
In this story
