Security checklist to map cyber maturity across primary care

NEWS  - eHealthNews editor Rebecca McBeth

A new cybersecurity self-assessment tool will provide a national picture of where cyber security gaps exist across the primary care sector for the first time. 

Health New Zealand | Te Whatu Ora developed the tool with General Practice New Zealand and has launched an information sharing and security awareness initiative aimed at supporting primary care providers to understand and meet their cyber security obligations. 

The security checklist is designed to help health service providers assess their current cyber security capability against the National Cyber Security Centre (NCSC) Minimum Cyber Security Standards.  

Jean Fleming, portfolio programme director for digital services at Health NZ says the results will deliver the first consistent, sector-wide view of where gaps exist and the checklist domains mean patterns across the sector will become visible as at the moment the view is mostly anecdotal. 

"If we are finding that across the board there is a failure in a domain, it just shows us where the resources need to go,” she says. 

The checklist covers ten standards: risk management, security awareness, asset importance, secure configuration of software, patching, multi-factor authentication, detecting unusual behaviour, least privilege access, data recovery, and response planning.  

Providers are rated across four levels - insufficient, baseline, better, and best - aligned to the Cyber Security Capability Maturity Model (CS-CMM). Organisations sharing information with Health NZ are required to meet at least CS-CMM Level 2, the baseline rating. 

Fleming explains that the obligations are not new, but there is now structured support being offered to help providers engage with them. 

She says the rollout of the Shared Digital Health Record requires providers to sign Access and Use Agreements with Health NZ and the checklist forms part of that onboarding.  

The Manage My Health privacy breach, which occurred in late 2025, also resulted in heightened awareness across the sector about how health information is shared and managed. 

"The scrutiny around how we share information, the stewardship of that information, has become quite a bit more acute," Fleming says.  

Elf Eggiman, Health NZ clinical informatics director, says the response to the initiative so far has been broadly positive. 

"It has been well received and there have been a lot of questions around how practices can be supported in completing that checklist,” she tells eHealthNews. 

Health NZ has run two webinars, held workshops in Christchurch and Tauranga, launched a dedicated webpage covering information sharing principles, and developed a risk module to help practices work through one of the checklist's core standards.  

Eggiman says the checklist results will help the organisation understand what support is actually needed, rather than working from assumptions.  

"What I'm trying to facilitate is that engagement and discussion around what Health New Zealand can do to help practices, to help Primary Health Organisations (PHOs) think about how they protect their information safely,” she says. 

"We are all in this together. We need to approach this problem of information sharing and data sharing - and how we do it safely, respectfully, and in the right way - as a really prevalent question that everybody should be asking themselves." 

Fleming says the initiative is initially focused on primary care, but interest is already coming from other parts of the funded sector such as aged residential care, pharmacy and dentistry. Expanding to others is intended within the current financial year, but which areas will be prioritised is still being worked through. 

The security checklist and other resources are available on Health NZ’s website and providers with questions are encouraged to contact their PHO for guidance and support.

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page