Manage My Health responds to the Office of the Privacy Commissioner’s Phase One report
Manage My Health responds to the Office of the Privacy Commissioner’s Phase One report
Publish Date: 2026-05-27 17:22:00
Source Domain: www.nzdoctor.co.nz
Manage My Health (MMH) acknowledges the serious nature of the December 2025 cyber security incident and the distress and concern it has caused patients, healthcare providers and the wider community. We apologise for this occurrence and for the impact it has had on those affected.
MMH is responding to the Office of the Privacy Commissioner’s Phase One report, alongside reviews undertaken by the Ministry of Health and Health New Zealand. These reviews examine different aspects of the incident, including privacy safeguards, cyber security, system design, and the broader sector response.
The reports confirm that this was a deliberate criminal attack by an unauthorised third party involving the use of compromised credentials and the exploitation of a specific vulnerability. The affected data was limited to the “My Health Documents” area of the platform, with no evidence of compromise to core patient portal systems and their integration with GP practice management systems. We recognise that any breach of trust is significant and we take that responsibility seriously.
Since the incident, MMH has undertaken a comprehensive programme of security and operational improvements.
These include mandatory multi-factor authentication for all users, enhanced real-time monitoring and alerting capability, strengthened access controls, and expanded independent security testing across the platform.
We are continuing to work constructively with regulators and sector partners to demonstrate that our controls are in place and operating effectively.
The reviews also highlight broader challenges across digital health, including the need for stronger vendor assurance and more consistent security standards across the sector. MMH supports these findings and the opportunity for system-wide improvement.
At the time of the incident, the platform supported a Health New Zealand programme providing patients at Northland Hospital with digital access to their health information. While…
