Health digitisation is racing ahead of its own locks

The Privacy Commissioner has finished his inquiry into the Manage My Health breach, and his conclusion reaches well beyond one patient portal. Releasing the second and final report today, Michael Webster said the pace of government digitisation “was a real cause for concern”, and that the health sector was not seen as ready for a “big digital one-stop shop”. He also flagged AI as an emerging risk that could amplify existing weaknesses unless governance is strengthened now.

That is a pointed message while Health NZ plans a new digital rollout in Northland next year. For any business that sells technology into government, or simply holds customer data, it is also the clearest signal yet of where the regulatory bar is heading.

A breach built on forgotten accounts

The numbers are bad. Hackers using stolen patient credentials reached more than 400,000 Health NZ documents and over 22,000 patient-uploaded files, and the Ministry of Health’s review put the total number of affected patients at 99,416, with 90,644 of them in Northland. Those caught up included 13,670 children under 13 and 4,570 teenagers. With around 40 percent of Northland’s population Māori, the Commissioner notes the breach disproportionately hit Māori patients and whānau.

The most damning finding is not about firewalls. Large numbers of patients did not know they had an account at all, or that it survived after they changed practices. MMH kept dormant accounts for 24 months; Webster wants non-activated accounts cleared after three. The company has cut the period to 12 months for patients whose practices no longer use it, but the 24-month window remains for everyone else. Remediation is partial, not finished.

Worse, a flawed matching process saved Northland hospital information into accounts patients never activated, and even into portal records for people with no MMH account, matched against shared health records or Easy Booking data. The Commissioner found this breached collection rules under the Health Information Privacy Code, because patients could not see those records and never consented to them. Data was being collected about people who did not know the vault existed.

Due diligence arrived after the rollout

The first phase of the inquiry had already established how this happened. Health NZ did not do sufficient due diligence before engaging MMH, relied on security and privacy assurances supplied by the vendor itself, and could not show its project team got specialist privacy advice early enough to shape the design. The arrangement began in 2019, was piloted in 2021 and spread widely between 2023 and 2025, all before adequate governance existed.

In September, Webster issued compliance notices to both organisations, giving Health NZ until the end of January 2027 and MMH until the end of August 2027 to fix security failings. Health NZ’s response today is that the report “does not identify any new privacy breaches by Health NZ”. That is true and beside the point. Its own action plan commits to a Northland digital solution in 2027, possibly extended nationwide, and the Commissioner’s 10 recommendations, including face-to-face community engagement and explicit Māori data governance, are a list of things that should have been done the first time.

The sector saw this coming

None of this surprised the people running primary care. In March 2026, GPNZ argued that the MMH and Medimap breaches “reflect structural weaknesses in standards, governance, assurance and investment settings”, and called for enforceable minimum standards and independent certification. In February 2026, Damon Campbell, then chief operating officer of WellSouth Primary Health Network, warned that “a system that relies on voluntary uplift or variable standards is inherently fragile”.

Vendors should read this as a procurement memo

Digitising health is the right call. Patients want portals, clinicians want shared records, and taxpayers should want the productivity gains. The failure here was not ambition but a government buyer that outsourced its judgement to the vendor it was buying from.

The Commissioner is explicit that the lesson is general: any organisation running customer accounts should have processes to identify and manage dormant accounts. Software firms bidding for public sector work should expect independent assurance, tight retention rules and consent design to become contract conditions rather than nice-to-haves. Firms holding sensitive data outside health should audit their own inactive accounts now, because every dormant record is liability with no revenue attached.

The real test comes in January, when Health NZ’s compliance deadline lands just as its 2027 rollout gathers pace. If the locks are not fitted by then, the next one-stop shop will simply be a bigger target.

Sources

• RNZ: Pace of government digitisation a ‘real cause for concern’, says Manage My Health inquiry (2026-10-30)
• Ministry of Health: Manage My Health Cyber Security Review Phase 2 (2026-05)
• Office of the Privacy Commissioner: Manage My Health Inquiry (2026-10-30)
• Stuff: Manage My Health breach exposed flaws in dormant accounts and privacy processes (2026-10-30)
• LiveNews: Manage My Health phase two report (2026-10-30)
• Office of the Privacy Commissioner: Inquiry into the Manage My Health cyber security breach, Phase 1 Report (2026-05-27)
• RNZ: Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach (2026-09-23)
• GPNZ: Prevention is protection, securing digital primary care (2026-03-05)
• Scoop: Final Report Into Manage My Health Inquiry A Wake-Up Call For Agencies (2026-10-30)