Manage My Health report: many patients didn't know they had accounts

Many patients caught up in last December's Manage My Health breach did not know the patient portal held an account in their name. That is one of the findings in Privacy Commissioner Michael Webster's final report on the attack.

The Office of the Privacy Commissioner released the report on 30 October. It is the second of two; the first, on 27 May, looked at what caused the breach and who was responsible. It found that Manage My Health (MMH) and Health NZ both had weak security and breached rule 5 of the Health Information Privacy Code. On 23 September Webster issued both organisations with compliance notices.

This report doesn't deal with security. It looks at how the breach affected patients.

Most of those patients were in Northland. The OPC says 90% of the people affected were Northland hospital patients, which it says means Māori patients, whānau and health services in the region were hit hardest. The Otago Daily Times reported that the hackers got into more than 400,000 documents. More than 22,000 of them had been uploaded by patients.

The ODT reported that, according to the report, "large numbers" of patients didn't know they had an MMH account. Others didn't know MMH still kept an account for them after they changed practices, or after their practice stopped using the portal. They "were therefore taken entirely by surprise to find that they were affected by the breach." Anyone who has been with a GP that used MMH could have one.

A software fault made things worse. It let some Northland hospital information be saved into accounts that patients had never activated. The fault was fixed in January 2026.

MMH currently keeps accounts for patients at active practices for 24 months before treating them as dormant. "We consider that MMH retains contact and other details in non-activated accounts for too long," the report says. It recommends deleting accounts that haven't been activated after three months.

Families of people who had died also struggled. Until recently there was no easy-to-find information on how they could locate and manage a relative's account. More is available now. Webster wants MMH to test it properly with patients and doctors.

The report makes 10 recommendations. Its sharpest language is about how fast the government is moving health services online. "There was strong consensus that foundational issues, forms, consent processes, and privacy arrangements must be resolved before expanding digital health infrastructure at pace," it says. It adds: "The pace of government digitisation was a real cause for concern; the health sector was not seen as ready for a 'big digital one-stop shop'." It also warns that AI could make existing weaknesses worse unless the rules governing it are strengthened now.

Health NZ's own plans are in the firing line. In a July action plan responding to the OPC, Health NZ said it would roll out a digital solution for Northland next year and might extend it nationwide, the ODT reported. The report tells Health NZ to get that 2027 rollout right. Accounts must be created and activated securely, and the plan must explicitly cover Māori control over Māori data. The report also says Health NZ and MMH should engage "face-to-face" with Northland communities. The OPC had already encouraged Health NZ to design the system together with Māori.

Health NZ took a different message from the report. "The Phase Two report does not identify any new privacy breaches by Health NZ and confirms we have met our legal obligations following the incident, including notifying the Privacy Commissioner and affected people," it said, as quoted by the ODT. That is accurate as far as it goes. The report wasn't meant to look for new breaches, and the finding that Health NZ broke the privacy code was made in May.

The first report also recommended changing the Privacy Act 2020 so that companies providing services to other organisations would be directly liable if they failed to put reasonable security in place. Writing for the IAPP, Daimhin Warner, a partner at Simply Privacy, notes that the Act currently places no direct security duty on companies that handle data for someone else. Overseas laws such as the EU's GDPR do. Warner wrote that if this came in alongside possible financial penalties, it would raise the risk for those providers and bring New Zealand closer to global best practice. He also said it isn't certain the law will change.

Webster said the breach had badly damaged trust in health portals, which he called a small but important part of how health information is handled today. His advice to other organisations was blunt: "It's going to be a lot more stressful for your customers and your staff if you have to create your crisis management playbook as you respond."