MMH breach damaged trust in digital health

NEWS  - eHealthNews editor Rebecca McBeth

The final report into the Manage My Health (MMH) cyber breach calls on agencies to get their foundations right before expanding digital health infrastructure, saying damage to patient trust has extended beyond health portals. 

Privacy Commissioner Michael Webster has released his second report into the MMH breach which resulted in the private health information of 99,000 New Zealanders being accessed, stolen and put up for sale. Around 91 percent of those affected were Health NZ patients in Northland.

The report says GP practices, Primary Health Organisations, and GP peak bodies are reporting that some patients have started requesting physical rather than digital copies of information and are wary of using portals or other digital technologies, even if they were not affected by the breach.

"The impact that this breach had on people should be a major wake-up call for agencies about how they handle personal information," Webster says.

The report says people at a hui in Whangārei hosted by Ngāti Hine Health Trust, raised the pace of government digitisation as a real cause for concern. 

“There was strong consensus that foundational issues, forms, consent processes, and privacy arrangements must be resolved before expanding digital health infrastructure at pace,” it says.

“The pace of government digitisation was a real cause for concern; the health sector was not seen as ready for a ‘big digital one-stop shop’. 

“AI was flagged as an emerging risk that could amplify existing vulnerabilities if governance frameworks are not strengthened now.”

Webster says that agencies need to understand what information they collect and hold, why they need it, and how they are handling it before moving forward with new digital solutions.

"It is going to be a lot more stressful for your customers and your staff if you have to create your crisis management playbook as you respond to the crisis," he says.

Health New Zealand (Health NZ) has stopped sending information via MMH and reverted to paper forms and has published an action plan to roll out a new vendor-agnostic digital solution in Northland.

The Privacy Commissioner's report says the success of any new solution depends on rebuilding trust.

"It is apparent from discussions with affected people during this inquiry that Health NZ and relevant portal vendors cannot simply assume that the Northland population will be willing to adopt a new solution," the report says.

The commissioner recommends that Health NZ ensure direct engagement with the Northland community and health providers, including Māori end users and Māori health providers and that Māori data governance considerations be expressly included in procurement processes.

Alex Pimm, group director of operations for Northland, says Health NZ is committed to rebuilding trust in Northland’s health services and to providing services that protect their personal health information. 

“People in Northland Te Tai Tokerau were particularly impacted, and we know they found the breach distressing and confusing. We recognise that many people were unaware their information was being held by Manage My Health,” he says.

“Our future digital sharing of health records with patients will take a different approach that will ensure we have far stronger protection of patient information. People can be confident they will receive care in our hospitals and clinics across Northland.”

The report makes a series of recommendations for all agencies including maintaining clear processes for dormant accounts, ensuring customers who have not completed a registration process have not authorised further collection of their information, and having a proper crisis management plan in place before a breach occurs.

Phase 1 of the inquiry found that Health NZ and MMH breached the Health Information Privacy Code 2020 and both were issued with Compliance notices. 

The Office of the Privacy Commissioner has also received around 50 complaints, which will be managed through its normal dispute resolution processes.

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page