WellSouth response to Privacy Commissioner findings for MMH breach

SECTOR UPDATE - WellSouth 

Today's Privacy Commissioner findings are important. Not only was the Manage My Health breach preventable, but it found that GP practices were not the source of the breach and could not have prevented it. During the crisis response we advocated strongly for this position.

Nearly 100,000 New Zealanders had their sensitive health information stolen, including many hundreds of affected patients in Otago and Southland. Yet our general practices largely bore the brunt of this crisis.

Everyone in the health sector has a responsibility to safeguard patient information, including general practice. However, practices trusted Manage My Health and Health New Zealand to have adequate protections in place, and that trust was misplaced. The Commissioner's recommendation that patient health portal providers be verified and approved centrally is exactly right. Practice teams should be able to focus on their core role: supporting the health and wellbeing of their patients.

Third-party digital health providers such as Manage My Health need to be held to the same standards as the health agencies they serve, but Health NZ also failed to uphold security obligations under the Health Information Privacy Code.

We therefore welcome the Commissioner's intention to issue formal compliance notices to both organisations. Described in the report as "the strongest tool currently available," these notices will require both parties to demonstrate that the necessary changes have been made and are working.

The systemic lesson here is one the sector needs to take seriously: digital innovation in health is vital, but it cannot outpace the privacy and security frameworks that protect people.

We have been closely watching this inquiry. We note that Health NZ's formal response plan will be published in July, setting out the way forward with regular reporting to the Board and relevant agencies. We will continue to track both the regulatory response and Phase 2 as they unfold.

Damon Campbell, Chief Operating Officer, WellSouth Primary Health Network. 

Source: WellSouth media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page