My View - Digital safety is patient safety

VIEW - Ayesha Verrall, Labour health spokesperson

As clinicians, we have long accepted that the tools of our trade are changing. Stethoscopes and scalpels are now joined by portals, platforms and AI. These are good things in skilled hands.  

However, as we increasingly rely on digital infrastructure to manage patient care, digital services and safety have been hollowed out by the National Government’s cuts, which favour short-term savings over long-term patient safety.

The cyber-security breach of Manage My Health in January this year was a watershed moment. With over 120,000 New Zealanders' private documents, including discharge summaries and specialist referrals, exposed to malicious actors, the incident was not merely an IT failure; it was a profound breach of the clinician-patient relationship and undermined patient trust in digital platforms. 

As we look at the fallout of that event, we must ask: is our wider health system becoming more resilient or more vulnerable to cyberattack? And how do we rebuild the trust our patients have lost in it?

The high costs of cuts

National’s cuts have made a drastic reduction in the expertise that keeps our health system running and safe. The data and digital workforce at Health NZ has been slashed by nearly 40 percent, moving from a baseline of 2,400 roles to just 1,460.

I have been vocal about the $330 million the government cut from data and digital health initiatives in Budget 2024. That funding was for work on cybersecurity capability, and it is gobsmacking to me that he would consider work in this field irrelevant when IT services needed investment.

By cutting these roles and funding we are not just losing staff; we are going backwards. We are missing the opportunity to get ahead of the curve. When we fail to modernise, we do not just stay still, we fall behind, leaving the doors wide open for external threats.

The Health Digital Investment Plan will never realise its promise unless the initiatives are funded. 

Patient care is at risk

Both in Parliament and the media, I have highlighted the backwards approach to security standards under the National Government and how it leaves patients vulnerable and undermined trust. I believe that cutting IT support is effectively jeopardising patient care.

We saw recently when patient records held in the MediMap medication management system were hacked, replaced with fake names and some patients even recorded as ‘deceased’ that patient care – not just their data - is at risk.

The Government’s refusal to properly fund the Privacy Commissioner and its failure to share cybersecurity capability with private providers has left us exposed to breaches of this nature, and the public distrustful. 

The cuts made in Budget 24 and 25 are false economies that will be wiped out by the cost of a single major data breach or a prolonged system outage. 

New Zealanders deserve confidence that when they use an app like Manage My Health or management of their care is entrusted to a system such as MediMap, their information is safe and that they can have trust in it. 

The Government has a role in ensuring that. Currently, that confidence and trust is at an all-time low.

What must be done?

To prevent further breaches and systemic failures and keep patients and their data safe, we must shift our perspective away from cuts and reinvest where it matters. Digital security is not a ‘nice to have’; it is a clinical necessity.

1. Mandatory security standards: We must enforce the high-level security standards Labour introduced in 2022 across all platforms, both in the public system and private providers that handle patient data.
2. Restore digital expertise: We cannot expect a safe, resilient and secure health system without staff who are experts in their field. We must halt the attrition of our digital workforce and re-invest where it is needed
3. Stronger rules and penalties: The Privacy Commissioner has called for penalties to drive compliance, but the National Government has instead cut funding to the privacy watchdog. All health providers must be properly regulated and held accountable in terms of how they handle personal information.

Where we should be heading

My vision for the health system is one that is truly patient-centred. That means New Zealanders get the care they need where and when they need it. 

Trusted and secure platforms are essential to this; services that are simple and consistent for patients and their clinicians to use, whether they are getting a vaccination in Kaitaia at a community-led provider, or a hip replacement in Dunedin at the hospital.

In New Zealand, we are lucky to have innovative, creative local developers to do this work, that can create jobs and improve patients’ health, trust in and experience of the health system. It is not clear to me that Health New Zealand’s present direction will give these developers the opportunities they need.

Conclusion

You cannot have a modern, safe health system while you are hacking away at its digital foundations. 

National’s cuts have created security and care risks. The Manage My Health breach was a warning shot, swiftly followed by MediMap. If we continue to hollow out our digital services, we are gambling with patient care. 

As health professionals and leaders, we must demand that digital infrastructure be treated with the same clinical rigor as any other medical tool. We cannot allow "efficiency" to become a euphemism for "vulnerability." Patients’ privacy, care and their safety depends on it.

Read more VIEWS

Return to eHealthNews.nz home page