Pace of government digitisation a 'real cause for concern', says Manage My Health inquiry

A report into a big health cyber breach says AI is being flagged as an emerging risk that could amplify existing vulnerabilities if governance frameworks are not strengthened now.

Privacy Commissioner Michael Webster's second and final report into the Manage My Health breach in December 2025 is out today.

It found strong agreement that the spadework had not been done.

"There was strong consensus that foundational issues, forms, consent processes, and privacy arrangements must be resolved before expanding

digital health infrastructure at pace.

"The pace of government digitisation was a real cause for concern; the health sector was not seen as ready for a 'big digital one-stop shop'."

AI's growth made that worse.

The Office of the Privacy Commissioner (OPC) had warned Health New Zealand about a digital rollout of health portals in Northland.

"It needs to engage directly with the community and ensure that the proper foundations are in place ... co-design with Māori would be particularly beneficial".

The hackers compromised over 400,000 HNZ documents and over 22,000 uploaded by patients. About 90 percent of patients were from Northland.

He said on Friday the breach had significantly damaged trust in health portals, which were a small but vital part of the modern health information environment.

Health NZ responded that: "The Phase Two report does not identify any new privacy breaches by Health NZ and confirms we have met our legal obligations following the incident, including notifying the Privacy Commissioner and affected people."

"We are working with the Ministry of Health, primary care and wider sector partners to strengthen privacy and security settings across the health system."

Friday's report makes 10 recommendations with a stress on the two entities engaging "face-to-face" with Northland communities.

In July, HNZ said in an action plan in response to the OPC that it would roll out a digital solution for Northland next year and might extend that nationwide.

It was told in today's report to get the 2027 rollout right - such as by ensuring accounts are created and activated securely, and expressly include Māori data governance considerations.

A flaw allowed some Northland hospital information to be saved into accounts patients never activated. The flaw was corrected in January 2026.

Health NZ said in a statement it would strengthen protections to ensure security of patient information in Northland and elsewhere.

"People can be confident they will receive care in our hospitals and clinics across Northland."

The hospital flaw was not the only gap.

The report said: "It has been apparent from the start of this inquiry that large numbers of patients were unaware that they had an MMH account at all, or that MMH still maintained an account for them despite the fact the patient had moved practices or their practice had ceased to use MMH.

"They were therefore taken entirely by surprise to find that they were affected by the breach."

A privately owned patient portal, Manage My Health still had a 24-month dormant account process for patients that were registered with active practices which was too long.

"We consider that MMH retains contact and other details in non-activated accounts for too long."

After three months, it should be deleted, the report recommended.

It noted there had been no readily accessible information for representatives of people who have died about how to find out about and manage their accounts. There was more information now but Webster told the company to do full user testing with patients and doctors.

Webster said other organisations must learn from the crisis to have a plan ready to go in a cyber attack.

"It's going to be a lot more stressful for your customers and your staff if you have to create your crisis management playbook as you respond," he said in a statement.