Privacy Commissioner gives Manage My Health and Health NZ until 2027 to fix security

Privacy Commissioner Michael Webster has issued formal compliance notices to Manage My Health and Health NZ, ordering both to fix the security failings behind the December 2025 hack of the patient portal. Health NZ has until 29 January 2027. Manage My Health has until 31 August 2027, according to the Office of the Privacy Commissioner's release, published by Scoop and NZ Doctor.

In May, Webster said only that he intended to take this step. In his phase 1 release he called compliance notices "the strongest tool I … currently have available to me to respond to serious privacy breaches". The same release said the attack exposed the health information of nearly 100,000 New Zealanders. RNZ has described it as one of the country's biggest cybersecurity incidents.

Both organisations were in breach of rule 5 of the Health Information Privacy Code, the security rule, when the attack happened. They broke different parts of it.

Manage My Health's notice falls under rule 5(1)(a). That part requires reasonable safeguards against loss, misuse or disclosure of personal information. Health NZ's falls under rule 5(1)(b), which requires an agency to do everything reasonably in its power to prevent misuse before it hands health information to a service provider. Put simply, Health NZ is being told to fix how it checks its suppliers.

Webster found seven areas where security protections didn't work. Since the attack, Manage My Health has improved three of them: how well its multi-factor authentication works, limits on which users can see what, and controls on unauthorised outside access. That leaves four. The OPC release says Manage My Health has already completed some of the notice's requirements.

"New Zealanders rightly expect any agency collecting, holding, using or storing their sensitive health information to maintain high standards of privacy and data protection," Webster said in the release. He said the notices "will ensure, and confirm to me, that Manage My Health and Health NZ are treating patient data securely".

The phase 1 findings, released on 27 May, explain what went wrong. Manage My Health had no systems to detect large amounts of information being accessed, so nobody stopped the hacker before so much was taken. At Health NZ, the project team working with Manage My Health had no specialist privacy or security staff. It relied on Manage My Health's own information instead of checking independently, and its internal privacy risk assessments were poor. The contract was generic and not fit for purpose.

GP practices were cleared. The OPC said they could have done nothing to prevent the breach and were not the source of the stolen data.

Northland bore the brunt, though the sources disagree on how much. The compliance-notice release quotes Webster as saying 90 percent of affected patients live there. His phase 1 release put it at around 91 percent. RNZ reported more than 70 percent. The OPC blames an arrangement unique to Northland, in which Health NZ sent hospital discharge information to Manage My Health. Hospitals elsewhere didn't do this.

Two other reports were blunter. Deloitte, reporting for Health NZ, found security across digital health "inconsistent and insufficient" and blamed Health NZ's over-reliance on third-party arrangements, RNZ reported. CyberCX told the Ministry of Health that Manage My Health was unprepared, had significant control failings and was likely not meeting Health Information Security requirements before the breach.

Health NZ chief financial officer Bevan McKenzie accepted the findings. "On this occasion patients were let down and that is unacceptable," he told RNZ.

Manage My Health told RNZ the attack was deliberate and criminal, using stolen login details and a specific vulnerability. It said the data taken was limited to the "My Health Documents" area. Its changes include compulsory multi-factor authentication for all users, better real-time monitoring and alerts, and more independent security testing.

According to The Lawyer Mag, Manage My Health told the OPC about the breach on 1 January 2026. Webster announced his inquiry on 21 January. On 23 July the High Court granted Manage My Health a permanent injunction over the stolen patient data.

For businesses, the bigger change may come from Webster's recommendations, not the notices themselves. He wants the Privacy Act amended so third-party providers that don't keep reasonable safeguards can be held liable, even when they handle data for another agency. That would reach software and cloud suppliers that store or process data for clients. He also recommends the Ministry of Health check and approve patient portals centrally against sector security standards. Both are recommendations only.

A second phase of the inquiry is still to come. The OPC said it is likely to look at GPs' obligations when using portals, including what patients are told and how their consent is obtained to set up accounts. No date has been given.

Health NZ has halted the flow of information from Northland to the Manage My Health portal, RNZ reported. Health NZ said it was putting measures in place so Northland patients could be given a paper copy of their discharge summary.