Healthcare organisations depend on digital systems to deliver care, protect sensitive information and keep essential services running.

As expectations around cyber security increase, organisations must be able to do more than show that security tools are in place. They need to demonstrate that cyber risks are governed, controls are operating consistently and the organisation is prepared to respond when something goes wrong. 

What the Health NZ checklist means in practice  
The Health NZ cyber security checklist provides a way for healthcare organisations to assess whether they have reached an appropriate baseline level of cyber maturity. 

It draws on the National Cyber Security Centre’s Cyber Security Capability Maturity Model, or CS CMM. For organisations expected to demonstrate Level 2 maturity, also known as “Planned and Tracked”, simply having cyber security controls in place is not enough. 

Organisations need to show that their policies, capabilities and controls are established, repeatable, managed and supported by evidence. 

In my view, the checklist is less about compliance and more about confidence. Can an organisation demonstrate that it is protecting the health information entrusted to it? Can it show that its services can continue operating during and after a cyber incident? 

These are not purely technical questions. They are questions about organisational resilience, accountability and trust. 

Why technical reporting alone may not provide sufficient evidence 
A common misconception is that having security tools automatically demonstrates cyber maturity. 
Technical reports may show that multi factor authentication is enabled, vulnerabilities are being scanned or backups are running. These reports are useful, but they do not provide the complete picture. 

They do not necessarily show whether: 

• The controls have clear ownership
• Exceptions are identified and managed 
  
• Risks are understood and accepted appropriately 
  
• Policies and processes are regularly reviewed 
  
• Leadership has appropriate oversight of cyber risk 
  
• Controls are working consistently across the organisation 
  

As the name “Planned and Tracked” suggests, Level 2 is not simply about producing dashboards and technical reports, it requires ownership, policies, reviews, informed decision making and accountability. 

The organisation must be able to show not only that a control exists, but also that it is governed, maintained and operating as intended. 

The role of governance, supplier oversight and incident preparedness 
Governance, supplier oversight and incident preparedness are particularly important because they are recognised within both the Health Information Security Framework and broader cyber maturity expectations. 

Healthcare organisations increasingly depend on cloud providers, software vendors and managed service providers. As a result, some of their most significant cyber risks may sit outside their direct control. 
Strong governance ensures cyber risk is understood and managed at leadership level. It provides clarity about who owns each risk, how decisions are made and when an issue should be escalated. 

Supplier oversight helps organisations understand the risks introduced by third parties. This includes knowing what information suppliers can access, what security controls they have in place and how they would respond if an incident affected their service. 

Incident preparedness ensures there is a clear and structured response when something goes wrong. Leadership teams should understand who has decision making authority, how the organisation will communicate, which services must be restored first and how patients, staff, suppliers and other stakeholders will be supported. 

In many cyber maturity assessments, these areas reveal the difference between an organisation that owns security tools and one that has established genuine cyber maturity. 

Practical steps healthcare leaders can take to strengthen cyber maturity 
Healthcare organisations should start with the fundamentals, as these provide the foundation for meeting baseline maturity expectations. This includes being able to demonstrate appropriate controls across areas such as: 

• Multi-factor authentication  
  
• Patch and vulnerability management  
  
• Access management  
  
• Security monitoring  
  
• Staff awareness and training  
  
• Backup and recovery  
  
• Incident response planning 
  

However, healthcare leaders should recognise that this is not solely a technology exercise. 

The next step is to focus on governance and evidence. Organisations should: 

• Assign clear ownership of cyber risks and controls  
  
• Document critical policies and processes  
  
• Identify and assess important assets  
  
• Review third party providers regularly  
  
• Test incident response plans  
  
• Record and manage exceptions  
  
• Report cyber risk to leadership and the Board  
  
• Maintain evidence that controls are reviewed and operating consistently 
  

For many organisations, moving from Level 1 to Level 2 maturity may require less investment in new technology than expected. The greater challenge is often establishing consistency, accountability and evidence around the controls already in place. 

Treat the checklist as a maturity assessment, not a technical assessment 
One of the biggest mistakes organisations can make is treating the Health NZ checklist as a purely technical assessment as the checklist should be treated as a maturity assessment, not simply a review of technical controls.  

The question is not simply: “Do we have multi-factor authentication?” 

The more meaningful question is: “Can we demonstrate that cyber security risk is being managed in a repeatable and accountable way?” 

Cyber risk needs to be managed with the same discipline that organisations apply to health and safety. Having procedures written down is not enough. Responsibilities must be clear, practices must be embedded and leadership must have confidence that the organisation is prepared. 

That is ultimately what Level 2 maturity is intended to achieve. It is also why governance, supplier oversight and incident preparedness matter just as much as technical controls. 

Read more VIEWS

Return to eHealthNews.nz home page

Why Frost & Sullivan Ranked Palo Alto Networks #1 in Healthcare Innovation and Growth

The devices that keep patients alive are the ones you can't patch on a Tuesday night. An infusion pump running a decade-old OS, a patient’s vital signs monitor mid-shift, an imaging system that needs FDA revalidation before a single line of firmware changes — these are the assets attackers now count on, and the assets a maintenance window can't reach. Ransomware doesn't wait for your change-control board. When it reaches clinical infrastructure, the outcome isn't a data-loss headline; it's diverted ambulances and delayed care.

Regulators have noticed. FDA device cybersecurity guidance, the proposed HIPAA Security Rule update, EU MDR, and emerging AI governance requirements are converging into a compliance posture with no discretionary timeline — elevating cybersecurity from an IT budget line to a board-level obligation with a deadline attached.

Closing that gap between knowing a device is vulnerable and doing something about it without touching the device is the problem we set out to solve. It's also the reason Frost & Sullivan named Palo Alto Networks a Visionary Leader in its Frost Radar™: Healthcare Infrastructure Cybersecurity in the United States, 2026 — and positioned us further into the upper-right than any other provider evaluated, with the top Innovation Index score in the study (5.00) alongside a Growth Index score of 4.60.

"Palo Alto Networks is the Frost Radar™ Growth and Innovation Index leader. Its broad platform combines healthcare-specific device intelligence and virtual patching with network, cloud, identity, application, and AI security … while leveraging an extensive healthcare customer base."
— Frost & Sullivan

Fifteen providers were selected from more than 50 qualified participants, and only one led on both the Growth and Innovation axes. Here's what that position rests on.

From visibility to enforcement — without modifying the clinical asset

Most medical-device security stops at a dashboard. It tells you what you have and what's wrong with it, then hands the problem to a human who has to translate that finding into a firewall rule or a maintenance ticket. That translation step is where exposure lives.

Frost & Sullivan singled out Palo Alto Networks for moving past it. Device Security — evolved from our Zingbox-based Medical IoT origins — uses the next-generation firewall you likely already run as both the sensor that identifies a vulnerable device and the enforcement point that blocks the exploit against it. Guided virtual patching lets you protect a device that can't be conventionally patched — legacy OS, zero-downtime requirement, or pending FDA revalidation — and compresses remediation from months to minutes without modifying the clinical asset itself.

Frost & Sullivan called this our defining advantage:

"Rather than competing only as a medical device discovery vendor, Palo Alto Networks differentiates itself by moving directly from identifying risk to applying compensating controls through existing network infrastructure. This is especially valuable for legacy and difficult-to-patch clinical devices, where traditional remediation may be delayed by FDA revalidation requirements, uptime constraints, or operational complexity."
— Frost & Sullivan

What it means for you: the unpatchable-device problem stops being a standing risk you document and start being one you can actually contain, on infrastructure that's already deployed.

Signal instead of alert fatigue

Every security team in a health system is drowning in vulnerability findings and short on the people to work on them. Volume isn't the problem; relevance is.

The report credited how we cut through that volume. Device Security builds a correlated inventory carrying more than 3,800 identity and security attributes per asset — including clinical integrations such as Philips Focal Point and GE CARESCAPE — then layers vulnerability intelligence, active-exploitation data, network exposure, clinical criticality, and compensating controls to cut vulnerability noise by as much as 90%. MITRE ATT&CK mappings and out-of-the-box HIPAA and NIST CSF compliance dashboards come standard.

What it means for you: your team spends its limited hours on the single high-likelihood risk sitting on a choke-point device, not on hundreds of findings that will never be reached — and prioritization reflects patient impact, not just CVSS.

Built on a scale that keeps pace with the threat

Healthcare-specific capability only matters if it stays ahead of how attacks actually evolve. Frost & Sullivan noted that our "strongest innovation is now the integration of healthcare-specific security capabilities across a broader platform portfolio" — and tied that innovation profile to the scale behind it: threat intelligence from Unit 42, telemetry from more than 85,000 customers, 1.5 billion objects analyzed and 5 billion events processed daily, and behavioral baselines drawn from over 17 million devices.

That scale lets protection extend beyond the medical device. Cortex XSIAM and AgentiX drive automated investigation and response, Cortex Xpanse surfaces exposed clinical assets and third-party connections, Cortex Cloud protects cloud-hosted workloads, and Prisma AIRS addresses the risks now arriving with clinical AI — shadow AI, model vulnerabilities, and PHI exposure.

What it means for you: the roadmap isn't a promise; it's fed by one of the largest threat data sets in the industry, and it reaches the newer parts of your attack surface as fast as they appear.

What the market is telling analysts

Recognition is one signal. Adoption is another. Frost & Sullivan reported that our healthcare cybersecurity business is growing at roughly five times the broader market rate, with Device Security posting triple-digit year-over-year growth. Notably, about 70% of that growth comes from expansion within existing accounts — health systems that started with network security and activated device, cloud, AI-driven security operations, secure remote access, and identity capabilities as their needs grew, rather than buying and standing up separate siloed tools.

For procurement teams where third-party attestation is a prerequisite, the report also notes FedRAMP Moderate/High, SOC 2 Type 2, IRAP, and C5 certifications.

That pairing — above-market growth with the study's top innovation score — is what set the Visionary leadership position apart. Frost & Sullivan called our progression "from visibility to proactive risk reduction" the company's most notable advancement: the shift from cataloging risk to actively eliminating it — at the network layer, which for legacy and difficult-to-patch clinical devices is the difference that shows up in whether care stays running.

The real question

Leading the Frost Radar on both growth and innovation validates an approach. But the question that matters in a hospital isn't where a vendor sits on a chart — it's whether a vulnerable, unpatchable device can be protected before an attacker reaches it, and whether care continues while you do it. That's the standard we're building to.

Read Frost & Sullivan's full Frost Radar™: Healthcare Infrastructure Cybersecurity in the United States, 2026 to see the complete analysis.

Frost Radar™ is a trademark of Frost & Sullivan. Findings and quotations attributed to Frost & Sullivan, Frost Radar™: Healthcare Infrastructure Cybersecurity in the United States, 2026.

Source: Palo Alto Networks media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

Health New Zealand has developed new cyber security eLearning modules to support people working in primary care and the wider health sector.

The Protecting health data course was developed by Health NZ’s cyber security team, learning specialists, and a working group made up of people from across the primary care sector. This has helped ensure the content is practical, relevant and easy to use.

The two modules that make up the Protecting health data course focus on simple everyday actions that help protect health information, reduce everyday avoidable cyber risk and keep services running. They include topics such as recognising suspicious messages, using strong passwords, turning on multi-factor authentication (where available), keeping devices updated and knowing what to do when something goes wrong.

The Protecting health data course gives primary care and other health providers a ready-made, health-focused resource they can use to lift capability across their teams and is especially useful for smaller organisations that may not have the time, budget or resources to create their own training.

Organisations and individuals can use the training to build cyber security awareness and confidence, and to meet standard 2 of the security checklist for health service providers.

By making practical training available across the sector, we’re supporting stronger cyber resilience and helping protect patients, whānau, staff and services.

More information, including how to access the Protecting health data course, is available on the Health NZ website.

Source: Health New Zealand | Te Whatu Ora media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

A cyber incident can start with a single click and its impact can ripple far and wide.

When systems are disrupted, the challenge is not just restoring the technology, it is restoring trust. In healthcare, our work is ultimately about people, and that is an important perspective to bring to any cyber incident.

Responding successfully

A successful cyber response is not just about containing an attack or removing a threat from your environment: in many ways, that is when the real work begins.

When an organisation suffers a cyber incident, something more important than technology is affected - trust. Patients, customers, partners, suppliers and staff all want answers, they want to understand what happened, whether they have been affected, and what is being done to prevent it from happening again.

Many organisations focus heavily on prevention, but resilience requires us to think about what happens next. No organisation can eliminate every risk so the real test is how effectively you recover when things go wrong.

Do you know how you will communicate with affected people? Do you have accurate contact information if you need to reach them? Do you understand your privacy and regulatory obligations? Have you thought about how you will restore confidence once systems are back online? These questions are not technical questions, they are people questions.

Building trust

Another lesson is that trust is not rebuilt by saying everything is fine again. People increasingly expect evidence, not just attestations. They want to see what has changed. That means rolling out multi-factor authentication, being open about lessons learned, and demonstrating the actions taken to strengthen security. 

Showing the action you have taken can be just as important as restoring the technology itself.

Throughout my career, I have seen organisations underestimate the human impact of cyber incidents. The immediate focus is often on restoring systems, but recovery is about much more than technology, it is about restoring confidence in your organisation, your services, and your people.

I have also seen the toll incidents can take on those responding to them. Cyber events can place enormous pressure on teams: long hours, public scrutiny, and the responsibility of supporting affected people can create significant stress.

Resilience is not just about systems being able to recover, it is about ensuring people can recover too. Whether you are delivering healthcare, financial services, education, electricity, transport or government services, people depend on your organisation. When trust is disrupted, rebuilding it takes time, effort and preparation.

Putting people at the centre

Technology sits at the centre of modern organisations, but people sit at the centre of every recovery.

That is why cyber resilience is not simply a technology challenge, it is also a people challenge.

If you want to contact eHealthNews.nz regarding this View, please email the editor Rebecca McBeth.

Read more VIEWS

Return to eHealthNews.nz home page

Police are investigating and Health New Zealand is supporting a Dunedin-based clinical trial service provider as it responds to a cyber incident in which it appears health information has been stolen and posted online.

Zenith Technology, or ZenTech, is a privately owned and operated Dunedin-based contract research organisation (CRO) involved in clinical-trial related work with Health NZ and the wider health sector.

A Health New Zealand spokesperson says the organisation was made aware of a cyber incident after files attributed to ZenTech were identified online.

Health New Zealand is supporting the CRO with its response and ZenTech has also engaged specialist cyber forensic support.

“There is no impact on Health NZ digital systems, and hospitals and primary care providers are operating as normal,” the Health NZ spokesperson says.

“We recognise the public interest in this incident and the concern cyber events can cause. Our priority is to ensure the response is thorough, coordinated and based on verified information.”

Health NZ says the right agencies and specialist experts are involved, and the situation is being actively managed through established national incident response protocols.

"This is also an ongoing Police investigation, meaning there are limits to what can be said publicly while the investigation and related forensic work continue,” says the spokesperson.

“Where any information is confirmed that indicates risk to individuals, Health New Zealand will work with the impacted organisation and relevant agencies to ensure appropriate steps are taken to notify and support those affected."

ZenTech's website says the CRO provides clinical trial and analytical laboratory services for the international pharmaceutical industry.

A statement from the company reported in Stuff says it has taken certain systems offline while working to ensure their IT environment is secure and the incident has been contained.

“We are aware that some sample material purported to be company data has been published online. As a matter of priority, we have engaged independent cyber security experts to investigate the incident and assess the nature and extent of any impact,” it says.

New Zealand’s health system has been hit by a number of high profile breaches this year, including at patient portal provider Manage My Health, digital medication management platform MediMap and private healthcare provider IntraCare.

Altersec chief executive Faustin Roman said in March that having a cluster of breaches follows a predictable pattern which he described as a "feeding frenzy", where attackers target sectors with demonstrated weak defences and minimal consequences.
  

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

Health New Zealand | Te Whatu Ora does not have a consistent consolidated view of the health and performance of its critical digital systems, limiting its ability to detect and respond to service disruptions early, a new Request for Information (RFI) says.

The organisation has issued an RFI to look at how to improve visibility of its critical digital services, enable earlier detection of issues, and support faster diagnosis and resolution of service disruptions for its “complex and highly distributed technology environment” across national, regional, cloud, and on-premises platforms.

Health NZ has dealt with a number of system issues this year, including a 12-hour outage overnight on January 28 affecting clinical and operational systems at hospitals across the Northern region.

Waikato Hospitals experienced a major outage in July and Southern hospitals have also been impacted by outages, including two in January of this year, with failures forcing clinicians to resort to paper when they could not access critical systems.

Digital Services acting chief information technology officer Darren Douglass says the RFI is focused on Category 1 and Category 2 clinical applications within the Health NZ landscape, which is around 1,300 operational service records represented by around 867 unique applications.

Douglass says multiple service records may exist for the same application where it is deployed, operated, or managed separately across districts, regions, or service domains.

He gives the example of clinical portals as a single application which is implemented and managed independently across five regions, resulting in five service records.

The RFI says there are a range of monitoring capabilities in place and monitoring approaches, tooling, and coverage vary significantly between environments. 

“Current monitoring capabilities do not consistently provide a consolidated view of a service’s health, performance, dependencies, and failure conditions across critical systems,” it says.

This means service degradation or failure may not always be identified as early as possible and there is an opportunity to improve the speed of detection, diagnosis, and restoration of systems.

Category 1 systems are highly critical services supporting clinical care delivery, patient information management, and national health services while Category 2 covers operational, integration, corporate, and supporting services where degradation or failure may result in material operational impact. 

The RFI says Health NZ is looking for centralised visibility of service health and performance as well as proactive detection of degradation and performance issues “before it materially impacts users, patients, or operational services”.

Also, faster incident resolution, integration with existing service management and incident management processes and enhanced visibility of application performance, transactions, dependencies, and end-user experience across critical services.

Responses are due by 25 September 2026.

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

The Shared Digital Health Record team is working with early adopter general practices in Auckland, New Plymouth, Masterton, Taupō and Ashburton. These practices are testing the new Digital Service Hub onboarding and due diligence processes for health service providers wanting to connect to information sharing services like the Shared Digital Health Record.

The due diligence process looks at four key areas, including cyber security. A new security checklist, developed with General Practice New Zealand, is helping practices confirm that their cyber security arrangements meet the requirements for sharing personal health information with Health New Zealand | Te Whatu Ora. The development of the checklist highlighted the need for the information sharing and security awareness initiative now underway.  

Early feedback from practices has been very valuable. Some practices have looked to their practice management system (PMS) vendors, hosting providers or IT support partners to help complete the cyber security and due diligence requirements. Practices with existing internal security checklists or governance processes have found the security checklist easier to complete, while others have noted that smaller organisations may need additional support to meet requirements.  

Practices have also appreciated receiving draft materials and working copies of assessment documents in advance, so they can identify the right people to involve. 
The Access and Use Agreements and schedules related to providing patient data to the Shared Digital Health Record have now been shared with early adopter practices.

After the agreements are in place, the early adopter practices will begin communicating with their patients about the Shared Digital Health Record and their participation choices, before their health information is collected. Health NZ has developed patient brochures and posters and practice resources to support these conversations. The practices will help test these materials, providing feedback before they are used more widely.  

Focus will then move to working with primary health organisations (PHOs), to onboard their practices and corporates in Te Waipounamu | South Island, with other regions to follow. Health NZ will work with PHOs to support their practices to onboard. 

New resource hub
A new Shared Digital Health Record resource hub is now available on the Health NZ website. The hub brings together practical resources, training materials, patient communication tools and onboarding guidance.

The hub also directs providers to the right channels for onboarding, technical support, privacy and security questions, and patient enquiries.  

For a comprehensive, user-friendly overview of the Shared Digital Health Record, practices are encouraged to see the guide Introduction to the Shared Digital Health Record: Guide for primary care, which is on the resource hub. 

Source: Health NZ | Te Whatu Ora media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

A new cybersecurity self-assessment tool will provide a national picture of where cyber security gaps exist across the primary care sector for the first time. 

Health New Zealand | Te Whatu Ora developed the tool with General Practice New Zealand and has launched an information sharing and security awareness initiative aimed at supporting primary care providers to understand and meet their cyber security obligations. 

The security checklist is designed to help health service providers assess their current cyber security capability against the National Cyber Security Centre (NCSC) Minimum Cyber Security Standards.  

Jean Fleming, portfolio programme director for digital services at Health NZ says the results will deliver the first consistent, sector-wide view of where gaps exist and the checklist domains mean patterns across the sector will become visible as at the moment the view is mostly anecdotal. 

"If we are finding that across the board there is a failure in a domain, it just shows us where the resources need to go,” she says. 

The checklist covers ten standards: risk management, security awareness, asset importance, secure configuration of software, patching, multi-factor authentication, detecting unusual behaviour, least privilege access, data recovery, and response planning.  

Providers are rated across four levels - insufficient, baseline, better, and best - aligned to the Cyber Security Capability Maturity Model (CS-CMM). Organisations sharing information with Health NZ are required to meet at least CS-CMM Level 2, the baseline rating. 

Fleming explains that the obligations are not new, but there is now structured support being offered to help providers engage with them. 

She says the rollout of the Shared Digital Health Record requires providers to sign Access and Use Agreements with Health NZ and the checklist forms part of that onboarding.  

The Manage My Health privacy breach, which occurred in late 2025, also resulted in heightened awareness across the sector about how health information is shared and managed. 

"The scrutiny around how we share information, the stewardship of that information, has become quite a bit more acute," Fleming says.  

Elf Eggiman, Health NZ clinical informatics director, says the response to the initiative so far has been broadly positive. 

"It has been well received and there have been a lot of questions around how practices can be supported in completing that checklist,” she tells eHealthNews. 

Health NZ has run two webinars, held workshops in Christchurch and Tauranga, launched a dedicated webpage covering information sharing principles, and developed a risk module to help practices work through one of the checklist's core standards.  

Eggiman says the checklist results will help the organisation understand what support is actually needed, rather than working from assumptions.  

"What I'm trying to facilitate is that engagement and discussion around what Health New Zealand can do to help practices, to help Primary Health Organisations (PHOs) think about how they protect their information safely,” she says. 

"We are all in this together. We need to approach this problem of information sharing and data sharing - and how we do it safely, respectfully, and in the right way - as a really prevalent question that everybody should be asking themselves." 

Fleming says the initiative is initially focused on primary care, but interest is already coming from other parts of the funded sector such as aged residential care, pharmacy and dentistry. Expanding to others is intended within the current financial year, but which areas will be prioritised is still being worked through. 

The security checklist and other resources are available on Health NZ’s website and providers with questions are encouraged to contact their PHO for guidance and support.

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

A new Digital Accessibility Standard (DAS) is intended to replace the current Web Accessibility Standard in early 2027. Released for public consultation on July 13, it will broaden the focus beyond websites to encompass all digital technology. This is a significant shift that will have implications across the health sector. 

For health organisations, accessibility is not simply a compliance issue, it is a patient safety, quality of care, and equity issue. Every day, patients and whānau rely on digital tools to access health information, book appointments, communicate with providers, attend virtual consultations, complete forms, and manage their wellbeing. 

If these systems are not accessible, people can be excluded from essential services. 

The broader scope the proposed DAS is designed to ensure accessibility is considered across all digital technologies, not just web. This includes patient portals, mobile applications, telehealth platforms, clinical software, self-service kiosks, online forms, digital documents, internal staff systems, and potentially connected medical devices that include digital interfaces. 

Many health providers have already invested in digital transformation programmes, but accessibility has not always been included from the beginning. 

As a result, organisations may discover barriers such as PDFs that cannot be read by screen readers, online forms that cannot be completed using a keyboard, poor colour contrast, inaccessible mobile apps, or video content without captions. 

Implications for telehealth

Telehealth platforms will need to be viewed not just as video conferencing tools, but as complete digital health services that must be accessible from appointment booking through to follow-up care. 

The draft Digital Accessibility Standard is likely to increase expectations that video consultations, waiting rooms, chat functions, captions, consent processes, patient forms, mobile apps, clinical documents, and post-consultation information can all be used independently by disabled people. 

For health providers, this means accessibility will need to become a core consideration when selecting, configuring, and managing telehealth solutions, helping to ensure that digital care does not unintentionally exclude patients who are blind, Deaf, neurodivergent, have low vision, use assistive technology, or have mobility, cognitive, or communication impairments.

These barriers can affect people with blindness or low vision, hearing loss, physical disabilities, learning disabilities, neurodivergence, cognitive impairments, and temporary injuries. 

Taking stock

Accessible digital services improve experiences for everyone, not just disabled people. The draft standard presents an opportunity for health organisations to take stock of where they are today. 

The health industry should be asking themselves:

• Are our websites accessible and usable?
• Are our patient-facing documents available in accessible formats?
  
• Can people complete key tasks without a mouse?
  
• Do our digital procurement processes include accessibility requirements?
  
• Are accessibility checks built into our design, development, and testing processes?
  
• Can disabled patients independently access our digital services?

Organisations that start addressing these questions now will be better positioned for future requirements and will deliver better outcomes for the communities they serve.

If you are unsure how your organisation measures up against the proposed requirements, now is a good time to seek independent advice. Access Advisors can help health organisations assess websites, digital tools, software, documents, and procurement practices against recognised accessibility standards. 

Early assessment can identify risks, prioritise improvements, and help ensure that accessibility is embedded into future digital projects.

Get involved

Digital accessibility is ultimately about ensuring everyone can access healthcare information and services with dignity and independence. We encourage all health organisations to review the draft Digital Accessibility Standard, provide feedback before the consultation closes, and start planning for a more accessible digital future.

The consultation is open until 7 August and the Government has specifically invited views on what should be included in the new standard, making this an important opportunity for health providers, clinicians, digital teams, disability advocates, and technology vendors to share their experiences and perspectives. 

Note - The draft standard does not currently apply to Crown agents, but will be issued as "guidance" to Health NZ.

If you want to contact eHealthNews.nz regarding this View, please email the editor Rebecca McBeth.

Read more VIEWS

Return to eHealthNews.nz home page

Health organisations should start mapping how they collect patient information indirectly now, in preparation for compliance with the new Rule 3A of the Health Information Privacy Code, says Privacy Commissioner Michael Webster.

Speaking at the Future of Healthcare in Aotearoa Conference on June 25, he also said health organisations need to be sure of where patient data ends up before rolling out AI tools, saying sensitive health information could be feeding into AI training models without patient knowledge and consent.

Rule 3A came into force on May 1 as part of the Privacy Amendment Act and directly affects how health organisations handle information gathered from third parties, including referrals, other health agencies and external platforms.

Webster talked about health organisations creating an “information map” showing how they are collecting and receiving information and the need to notify patients about it.

"That might be as simple as having signage up at your business that notifies people of how information will be passed on and collected," he said. 

"Underneath that, the full description of what might happen can be found online."

An exception to Rule 3A is if an organisation has reasonable grounds to believe someone else has already notified the patient but Webster said that belief needs to be backed by evidence, not assumption.

When asked about AI he said the key concern is ensuring that confidential patient conversations do not end up training the large language models that underpin the tools clinicians rely on.

Webster recommended organisations do a privacy impact assessment before deploying any significant new AI tool, treating it as standard due diligence to understand what the tool does and how it handles data.

He noted that a cybersecurity advisory issued recently flagged increasing cyber threats driven by AI and said health organisations should start treating a data breach as an ‘when not if’ event.

He spoke about four privacy law reform priorities his office is advocating for which are; the right to erasure; financial penalties for serious breaches; stronger accountability provisions requiring organisations to publicly disclose their privacy practices; and oversight requirements for automated decision-making systems

A fifth priority has come from the Managed My Health inquiry, which involves extending liability for security failures to third-party service providers.

The Office of the Privacy Commissioner has published detailed guidance on Rule 3A, including worked examples, through its Poupou Matatapu resource hub. 

Image: Privacy Commissioner Michael Webster

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

The Office of the Privacy Commissioner (OPC) has recommended amendments to the Privacy Act that would hold third-party providers liable for security failures, even when they are collecting or storing data on behalf of another agency. 

The recommendation is part of a Phase 1 inquiry into the December 2025 Manage My Health breach, which resulted in the private health information of more than 99,000 New Zealanders being accessed, stolen and put up for sale.

"Third parties are increasingly playing a key role in the sharing, processing and storage of personal data," Privacy Commissioner Michael Webster says. 

"As such they are a target for malicious actors. It is critical they too are incentivised to put in place safeguards."

The report also recommends that the Ministry of Health set up a process for verifying and assuring that patient health portals such as Manage My Health meet health sector security standards.

“It is not practicable for every user, such as individual GP practices, to do their own separate security testing or assurance. Instead, providers should be checked and approved at a central level,” it says.

Altersec chief executive Faustin Roman says the OPC recommendation is overdue and the model already exists and works in other countries.

“Europe's GDPR makes processors directly liable for security alongside the controller, and Australia is moving the same way. New Zealand is now the outlier,”  he tells eHealthNews.

“Processor liability would give OPC a direct enforcement lever it currently lacks and reduce the unrealistic due-diligence burden on small principals like GP practices.”

However, he says this is not the whole answer and he was pleased to see the report also puts clear obligations on Government, the Ministry of Health and Health NZ.

“Health NZ is in a unique position here: it is both a respondent in this inquiry and the sector lead through the HISF standard. It is the agency best placed, and most obligated, to drive these reforms across the sector. It should lead from the front,” Roman says.

GPNZ deputy chair Justin Butcher says the OPC recommendation is a sensible and practical step.

“Small businesses such as general practices should not be left relying solely on contractual remedies when IT providers fail to meet appropriate standards,” he says.

An independent technical review of the MMH breach by CyberCX for the Ministry of Health recommends that Health New Zealand “comprehensively review and uplift its third party risk management practices”, saying the attack method was not technically sophisticated.

The breach happened when a hacker calling themselves Kazu used compromised user credentials to exploit flaws in an application programming interface to access stored data, which included clinical notes, intimate imagery and documents such as passport scans.

The review found Manage My Health was "unprepared for an incident of this nature", had "significant control failings" in its technology environment and were likely not aligned with the Health Information Security Framework requirements before the breach happened.

The inquiry also found Health New Zealand failed in its responsibilities and its contract with Manage My Health was "not fit for purpose," as it was generic rather than designed to reflect how information sharing would work and what was necessary to protect it.

The OPC review found GP practices were not liable for security failings that caused the breach, as they could not have prevented it and were not the source of stolen information. 

However, it sets out security safeguards it expects all GP practices to have in place when using patient portals.

Damon Campbell, chief operating officer, WellSouth Primary Health Network, says third-party digital health providers such as Manage My Health need to be held to the same standards as the health agencies they serve.

“The systemic lesson here is one the sector needs to take seriously: digital innovation in health is vital, but it cannot outpace the privacy and security frameworks that protect people,” he says.

Phase 2 of the inquiry will focus on the impacts of the breach, including whether patients were properly asked for authorisation before accounts were established, whether they received adequate information about the portal, and whether the breach caused disproportionate impact on Northland Māori.

Budget 2026 has committed more than $150 million in funding for cybersecurity in health over the next four years.

In his Budget statement health minister Simeon Brown said that over the next year, Health New Zealand will implement a programme to identify and manage cyber risks posed by third‑party vendors and systems, strengthen accountability for fixing security risks, introduce annual audits of critical systems, and use scalable tools, including AI-enabled assessments, to improve cyber security maturity across primary care.

If you would like to provide feedback on this news story, please contact the editor Rebecca McBeth.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

General Practice New Zealand (GPNZ) welcomes the shared conclusions of three reports into the Manage My Health (MMH) privacy breach, saying the findings reinforce the need for a coordinated, system-wide approach to privacy and security across the health sector.

“With these recommendations in place, we expect to see rapid and meaningful system improvements that will ensure the protection of patient information, with clear standards and accountability,” says GPNZ Deputy Chair Justin Butcher. 

As the Ministry of Health report says, the experience ‘should serve as a call to action for the health sector, and New Zealand organisations more broadly, to improve cyber security controls and governance’.

GPNZ endorses the Ministry’s recommendation that ‘Health NZ comprehensively review and uplift its third-party risk management practices’.

“This is a clear theme across the separate reports that needs urgent action. One of the most significant recommendations of the Privacy Commissioner’s report is the call for the Ministry of Health to establish a centralised and ongoing programme to verify that key health sector vendors are meeting appropriate security standards,” says Mr Butcher. 

“A nationally coordinated assurance function will help create greater consistency, clearer accountability and stronger confidence across the system, while reducing duplication and avoiding unrealistic compliance expectations being placed on frontline providers.”

GPNZ had an opportunity to provide feedback to the Office of the Privacy Commissioner during the inquiry process, and it is positive to see the final report acknowledge the practical limitations general practices face when dealing with complex security and contractual arrangements with vendors – issues the sector has raised for some time.

The OPC’s recommendation to consider amendments to the Privacy Act to ensure third-party technology vendors have direct obligations for maintaining appropriate privacy and security safeguards is a sensible and practical step.

“Small businesses such as general practices should not be left relying solely on contractual remedies when IT providers fail to meet appropriate standards,” says Mr Butcher.

General practices already understand the obligations they have around privacy and information security, with PHOs continuing to work alongside practices to support that work.

“Today’s findings reinforce the importance of regularly reviewing security settings, processes and governance arrangements, alongside stronger national assurance and better support for general practice.”

GPNZ has been working alongside Health NZ to develop practical resources for the sector, including a cyber security checklist and guidance for safe information sharing practices.

While the reports acknowledge the efforts of Health NZ and MMH in responding to the breach, GPNZ said there also needed to be stronger recognition of the extensive response led by PHOs and general practices across the country.

“Primary care teams carried a significant operational and relationship burden throughout this incident,” says Mr Butcher.

“Practices and PHOs were heavily relied on to support patients, respond to concerns, provide reassurance, gather information and help resolve issues in real time, at considerable time and cost.”

“That work was critical to maintaining patient trust and supporting the overall system response, and future breach response planning needs to properly recognise and incorporate the role of primary care.”

The safe sharing of health information is a vital element of modern healthcare, which, unfortunately, hackers will continue to try to exploit. The MMH breach was a wake-up call for us all, and these inquiries reinforce the additional elements we need to put in place to ensure the protection of that data.

GPNZ will continue working collaboratively with the Ministry of Health, Health NZ and its members to support ongoing improvements across the sector.

“This is about building a safer, more resilient and more trusted digital health system for patients and practices alike.”

Source: General Practice New Zealand media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

The Privacy Commissioner’s finding that Health NZ and Manage My Health had deficient security safeguards confirms what the PSA warned about in January: the health sector’s IT systems are under-resourced and vulnerable.

"This finding should be a wake-up call. Nearly 100,000 New Zealanders, many of them in Northland, had their most sensitive personal information stolen because security was not up to scratch," said Fleur Fitzsimons, National Secretary for the Public Service Association Te Pukenga Here Tikanga Mahi.

"Tomorrow’s Budget will make scandals like this a feature of public services in New Zealand as the Government moves to dismiss thousands of public servants. We know services are already being damaged, members tell us of the mounting toll cuts have inflicted."

"In January, the PSA called on the Privacy Commissioner to investigate the impact of cuts to Health NZ’s digital workforce. He declined. Since then, we have seen the Waikato payroll failure affecting 4,000 health workers, and OIA documents showing Health NZ’s own internal reports warned that cutting IT staff would increase risks to patient care and hospital resilience.

"The pattern is clear. Health NZ’s digital workforce has been cut by nearly 1,000 roles. The systems these workers maintained and protected are ageing and vulnerable. IT problems are taking longer to resolve. The people who understood those old systems and their weaknesses are gone.

"The Government needs to stop treating health IT as a cost to be cut and start treating it as the critical infrastructure it is. Properly resourcing digital services in the health system is not optional - it is essential to protecting patient safety and privacy.

"New Zealanders whose personal health information was stolen deserve better than this.

"We hope tomorrow’s Budget marks a turning point in health funding, and not more of the same - patient care must be a priority," said Fitzsimons.

Source: PSA media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

Today's Privacy Commissioner findings are important. Not only was the Manage My Health breach preventable, but it found that GP practices were not the source of the breach and could not have prevented it. During the crisis response we advocated strongly for this position.

Nearly 100,000 New Zealanders had their sensitive health information stolen, including many hundreds of affected patients in Otago and Southland. Yet our general practices largely bore the brunt of this crisis.

Everyone in the health sector has a responsibility to safeguard patient information, including general practice. However, practices trusted Manage My Health and Health New Zealand to have adequate protections in place, and that trust was misplaced. The Commissioner's recommendation that patient health portal providers be verified and approved centrally is exactly right. Practice teams should be able to focus on their core role: supporting the health and wellbeing of their patients.

Third-party digital health providers such as Manage My Health need to be held to the same standards as the health agencies they serve, but Health NZ also failed to uphold security obligations under the Health Information Privacy Code.

We therefore welcome the Commissioner's intention to issue formal compliance notices to both organisations. Described in the report as "the strongest tool currently available," these notices will require both parties to demonstrate that the necessary changes have been made and are working.

The systemic lesson here is one the sector needs to take seriously: digital innovation in health is vital, but it cannot outpace the privacy and security frameworks that protect people.

We have been closely watching this inquiry. We note that Health NZ's formal response plan will be published in July, setting out the way forward with regular reporting to the Board and relevant agencies. We will continue to track both the regulatory response and Phase 2 as they unfold.

Damon Campbell, Chief Operating Officer, WellSouth Primary Health Network. 

Source: WellSouth media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

The Ministry of Health and Health New Zealand are strengthening cyber security across the health system following independent reviews into the Manage My Health cyber incident, which resulted in the private health information of 99,000 New Zealanders being accessed, stolen and put up for sale.

Privacy Commissioner Michael Webster has found both Manage My Health and Health NZ breached the Privacy Act by failing to maintain reasonable security safeguards to protect patient information. 

The breach occurred on 21 December 2025, when a hacker using compromised credentials exploited a vulnerability in Manage My Health's application programming interface to extract more than 400,000 patient documents. 

Webster says the theft of this highly personal information caused significant anxiety and distress for patients.

More than 90 percent of those affected are in Northland, many of whom are likely to be Māori. This is because of a unique arrangement between Health NZ and Manage My Health involving hospital discharge information, which was not happening in other hospitals.

Ministry of Health chief medical officer Joe Bourne says a Ministry review found the breach was largely preventable and identified weaknesses in technical controls, incident preparedness, and communications.

"This incident has highlighted clear areas where the system needs to improve, and our focus is now on learning from it and implementing these changes at pace," he says.

The Privacy Commissioner will issue compliance notices to both Manage My Health and Health NZ, which he says are the strongest tools currently available to respond to serious privacy breaches. 

"Several of Manage My Health's technical security safeguards were inadequate at the time the breach occurred," Webster says. 

"We want to independently check what has been done and that the changes provide effective protection against similar types of attacks in future."

Phase 1 of the commissioner’s report found the cybersecurity breach was not the result of a single security failure but was due to a combination of problems. Manage My Health had several key gaps in security that allowed the attack to happen and failed to have systems in place that would detect large amounts of information being accessed.

It says that Health NZ should have taken more steps to ensure it was safe to pass information to patients through the portal. The project team that engaged with Manage My Health did not include specialist privacy and security personnel, which was needed for a project of this type, scale and novelty.

"There was over-reliance on information from Manage My Health about the security and privacy of the health portal as opposed to doing independent checks," the Privacy Commissioner's report says.

Ministry of Health chief information officer Quin Carver says the Ministry and Health New Zealand are taking action, including working with Manage My Health to get independent assurance of post-incident security improvements and strengthening expectations for suppliers holding sensitive health information.

The Ministry is reviewing how the Health Information Security Framework is applied and monitored in practice and establishing clearer roles and processes for patient notification during cyber incidents. A desktop review of other major patient portals is underway, along with developing a system-wide action plan.

An independent review commissioned by the Ministry makes 26 recommendations, including; stronger third-party cyber risk management and independent assurance, clearer system-wide processes for patient notification, improved visibility of supply chain risks, and enhanced incident preparedness.

Bourne says the Ministry has accepted all the report's recommendations. Three actions are complete, five have been actioned with the Ministry awaiting external confirmation they are complete, 12 are underway and a further six are being planned.

Health NZ chief financial officer Bevan McKenzie says the organisation accepts the Privacy Commissioner's overarching finding that more should have been done to protect patient information.

"People expect their personal health information to be securely stored, and Health NZ and the rest of the health sector must ensure that is done," McKenzie says. 

"On this occasion patients were let down and that is unacceptable."

Health NZ has stopped the flow of information from Northland district to Manage My Health because of the Privacy Commissioner's findings and measures are being put in place to ensure Northland patients can immediately be provided a paper copy of their discharge summary after a hospital visit, and that patient services are not impacted.

The Privacy Commissioner recommends the Ministry of Health should establish a process for verifying and assuring that patient health portals meet health sector security standards. The report also recommends amending the Privacy Act to allow third-party providers who do not meet reasonable security safeguards to be held liable.

"Third parties are increasingly playing a key role in the sharing, processing and storage of personal data," Webster says. 

"As such they are a target for malicious actors. It is critical they too are incentivised to put in place safeguards."

Bourne says protecting people's health information is fundamental to trust in the health system and that strong governance, clear accountability, and independent assurance are essential to reducing cyber risk.Manage My Health (MMH) says in a statement that it acknowledges the serious nature of the December 2025 cyber security incident and the distress and concern it has caused patients, healthcare providers and the wider community.

"We apologise for this occurrence and for the impact it has had on those affected," it says.

It says MMH is responding to the Privacy Commissioner’s report, as well as reviews by the Ministry of Health and Health New Zealand.

"Since the incident, MMH has undertaken a comprehensive programme of security and operational improvements. These include mandatory multi-factor authentication for all users, enhanced real-time monitoring and alerting capability, strengthened access controls, and expanded independent security testing across the platform," the statement says.

"We are continuing to work constructively with regulators and sector partners to demonstrate that our controls are in place and operating effectively."

Image: Privacy Commissioner Michael Webster

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

‘A bad system will beat a good person every time’ -Deming -

System safety is about empowering everyone through positive leadership, quality guardrails, appropriate training and clinical governance, underpinned by a culture of excellence and continuous improvement. In a digital era, clinical safety extends to electronic systems that consumers, patients and healthcare workers use every day.

At Health New Zealand | Te Whatu Ora, we have co-developed a Digital Clinical Safety Framework in partnership with consumers, healthcare professionals, technologists and wider health system stakeholders. These concepts are incorporated into our National Clinical Governance Framework.

Digital clinical safety is two-fold. First, it is about ensuring the quality, safety and resilience of digital systems intrinsically. Second, it enables people using these systems to deliver safer, more effective and efficient care extrinsically. Safety-by-design forms a foundational tri-weave alongside privacy and security-by-design.

Our Digital Clinical Safety Principles:

Culture of Safety - We empower our people by weaving a korowai, or cloak of protection, via the fabric of quality and safety systems. Digital solutions are interwoven to enhance safety, clinical safety and digital clinical safety as part of a broader organisational safety culture.

Collaborative Design - Involve healthcare consumers, workforce, technologists and industry throughout the digital solution lifecycle, so that digital health tools are human-centred, fit for purpose, and deliver maximum value and widespread benefits across the ecosystem.

Embedding Equity - Ensure solutions are holistic, inclusive, culturally safe, embrace diversity, and break down barriers through safe use, co-design and evaluation of technology. By embedding equity within our digital health systems, we endeavour to improve equity of access to healthcare services, and ultimately equity of health outcomes for all peoples.

Balanced Decision-Making - Clinical, operational and digital teams play to each other's strengths, amplified via multi-lane cost-benefit assessments, allowing us to make robust and data-informed investment and prioritisation decisions through leadership and clinical governance.

Semantic Interoperability - Promote interoperability among systems. Ensure digital tools and data exchanges are seamless while promoting data sovereignty, data quality, veracity, integrity, security, and privacy.

Continuous Quality Improvement - Build a resilient Safety-II system into our digital health environment by promoting virtuous cycles, striving to make it easier to do the right thing and harder to do the wrong thing. Adapt and improve based on real-world experiences. Review near-misses to bolster resilience, incidents to close gaps, and continuously drive towards “better” by evaluating risks and vulnerabilities.

Embedding into Practice

These principles represent our values and help shape strategy. Frameworks need to be embedded to drive action and influence outcomes. The overarching goal is to bring teams from different backgrounds with different perspectives, skills and expertise closer together. Implementation into practice includes various actions/objectives across strategic, governance and operational levels:

Digital Investment - Digital initiatives, projects and programmes are prioritised using a clinical quality and safety lens.

Clinical Sponsorship - Clinically relevant digital initiatives require sponsorship from relevant clinical leaders at the appropriate level, so that there is senior leadership buy-in, ownership, championing and escalation pathways for clinical governance and risk management.

Clinical Collaboration - Clinically relevant digital initiatives require input from clinicians and consumers at appropriate phases across the delivery lifecycle (especially multidisciplinary, frontline and junior staff).

Hazard Logs - Digital risks can impact clinical care delivery. Hazard logs capture both clinical risks that could arise from digital systems and vice versa. The end of a project is not only the start of business as usual, but also continuous quality improvement. Living hazard logs continue to be co-reviewed at regular intervals by clinical and digital product owners, informing the need for future enhancement via a pragmatic risk-based and cost-benefit approach.

Training - Teams at every level require training according to their needs. Digital specialists with a grounding in health can speak the same language as healthcare workers, and vice versa. Groups cross-pollinate to build a truly integrated clinical-digital team. Likewise, leaders also need to be supported in terms of leadership, governance and evidence-based decision-making.

Standards - Embed relevant clinical safety, quality, data, digital, architecture and interoperability standards into product delivery lifecycles and roadmaps.

Metrics - Clinically relevant digital initiatives should have at least one quality and safety indicator measured as a key success factor, ideally automatically collected as part of monitoring and feedback loops.

Continuous Learning System - Implement an integrated system to capture feedback, incidents, near-misses, risks, mitigations and lessons learnt (and implemented), so that there is whole-of-system visibility, monitoring and assurance via continuous feedback loops. This builds upon Safety II resilience towards Safety III, emphasizing the interconnectedness between people, process and technology across complex adaptive systems, which is further enhanced by incorporating predictive analytics and risk modelling to monitor safety thresholds, especially in the era of AI.

Looking Ahead - Digital clinical safety is a core tenet of clinical governance in digital health. It is a building block for developing sustainable systems and the 10-year Health Digital Investment Plan (HDIP), led by the Centre for Digital Modernisation of Health.

Read more VIEWS

Return to eHealthNews.nz home page

Primary care practices across New Zealand can now access a national, discounted cyber security assessment designed specifically for general practice, helping strengthen protection of patient data and digital systems.

The offer is being rolled out by Health Accelerator, a national primary care led innovation group focused on developing and scaling practical solutions for general practice, in partnership with PenTest NZ (a brand of Altersec).

The initiative comes in response to cyber incidents that affected the health sector earlier this year, highlighting the need for reliable data privacy and for practices to better understand and strengthen their current cyber security settings.

Through the partnership, practices can access a 25% discount on PenTest NZ’s standard cyber security assessment for general practice, an average saving of around $1,000 off the base assessment.

The assessment is carried out independently by PenTest NZ and identifies and documents cyber security risks specific to each practice. Practices receive clear findings, tailored recommendations, and evidence demonstrating steps taken to improve cyber security and manage risk.

Paul Roseman, CEO at Health Accelerator, says cyber security is now a fundamental part of delivering safe, trusted care.

“Cyber security is more important than ever, and Health Accelerator’s role is to support practices to ensure their security is sound and reliable. Partnering with PenTest NZ allows us to offer an independent, real world cyber security assessment at a significantly reduced cost.”

“Taking an assessment isn’t just for the sake of ticking boxes. It’s about giving practices confidence that they understand their risks, have the evidence they need to back their decisions, and can take sensible steps to protect systems and information.”

Faustin Roman, CEO of Altersec and the PenTest NZ brand, says collaboration across the sector is key to improving cyber resilience.

“We’re fully behind the innovation of the Health Accelerator initiative and supporting health providers in primary care and beyond to stay safe and healthy online.

“We’ve worked with PHOs for some time, including Tū Ora, and they share our belief that real progress comes from partners working together toward the same goal. System level leadership at PHO organisations enables companies like ours to support primary care, while clinicians focus on keeping people well.”

“This type of exercise is long overdue for many practices, so we welcome organisations that are interested in getting involved. Let’s spread the word, maximise this Health Accelerator partnership, and get New Zealand health services pen tested.”

The partnership reflects the need for practical cyber risk management aligned with Health NZ expectations, while ensuring solutions remain accessible and cost effective for practices. Health Accelerator is encouraging general practices to take up the offer and proactively support continuity of care.

More information about the PenTest NZ offer is available at: https://www.healthaccelerator.co.nz/pen-test-cyber-offer

Source: ProCare media release

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page

Three high-profile health data breaches within three months have exposed what a cybersecurity expert describes as a "feeding frenzy" pattern, where attackers target sectors with demonstrated weak defences and minimal consequences.

The latest incident at IntraCare, an Auckland-based private healthcare provider, comes after breaches at Manage My Health and MediMap, following what Altersec chief executive Faustin Roman says is a predictable pattern rather than coincidence.

"New Zealand health providers are genuinely under greater attack: one high-profile breach absolutely leads to more," he says.

In the latest case, IntraCare took its patient management system, Picture Archiving and Communication System (PACS), and finance systems offline after detecting unusual activity within its IT environment on 20 March 2026.

“We have confirmed the incident involved unauthorised access to parts of our network,” a spokesperson says. 

“We are working to establish exactly how this occurred and are already implementing additional safeguards and monitoring to further strengthen our systems.”

Roman says healthcare data represents the most valuable commodity on the dark web, with a single health record worth far more than a stolen credit card because it contains identity details, NHI numbers, and clinical history that cannot be cancelled like financial cards.

“In cybersecurity, we see a clear "feeding frenzy" pattern: once an attacker publicly compromises a sector and demonstrates that defences are weak and consequences are minimal, the broader criminal ecosystem takes notice,'" he says.

"The MMH breach effectively put a spotlight on New Zealand's health tech sector and potentially signalled 'this is soft. 

"Threat actors share this intelligence. They target the same vertical, in the same country, because the conditions that allowed the first breach - legacy platforms, voluntary security standards, a $10,000 privacy penalty cap – have not changed overnight."

The interconnected nature of health systems to enable data sharing may also allow attackers to move from one system to another, says Roman.

The timing of these breaches also aligns with known vulnerability windows, particularly the December-January holiday period when organisations operate with skeleton IT crews and reduced monitoring.

The ManageMyHealth breach was detected on 30 December, MediMap in February and IntraCare in March. 

“Attackers who gain access during the holiday period may not be discovered until staff return and systems are properly reviewed," he says.

The National Cyber Security Centre's Q4 2025 Cyber Security Insights report shows the threat landscape was already intensifying before these breaches, with website compromise incidents up 16 per cent, denial of service attacks doubling, and 23 per cent of nationally significant incidents attributed to state-sponsored actors.

Roman says New Zealand's approach to healthcare cybersecurity remains immature compared to other jurisdictions with no mandatory audit regimes and meaningful penalties.

He described the Privacy Act's maximum fine of $10,000 as "laughable" compared to Australia's privacy legislation or Europe's GDPR.

IntraCare, which treats more than 2,000 patients annually, says it activated its incident response plan after detecting the breach and engaged Cyber CX, a leading Australasian cybersecurity organisation, to conduct a forensic investigation.

The provider maintained patient care by reverting to manual processes, but the breach did impact some scheduled procedures with 28 patients temporarily deferred.

“We recommenced procedures on Monday 30 March. Our focus has been on ensuring systems are fully tested and resilient before bringing them back online,” the spokesperson says.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

As clinicians, we have long accepted that the tools of our trade are changing. Stethoscopes and scalpels are now joined by portals, platforms and AI. These are good things in skilled hands.  

However, as we increasingly rely on digital infrastructure to manage patient care, digital services and safety have been hollowed out by the National Government’s cuts, which favour short-term savings over long-term patient safety.

The cyber-security breach of Manage My Health in January this year was a watershed moment. With over 120,000 New Zealanders' private documents, including discharge summaries and specialist referrals, exposed to malicious actors, the incident was not merely an IT failure; it was a profound breach of the clinician-patient relationship and undermined patient trust in digital platforms. 

As we look at the fallout of that event, we must ask: is our wider health system becoming more resilient or more vulnerable to cyberattack? And how do we rebuild the trust our patients have lost in it?

The high costs of cuts

National’s cuts have made a drastic reduction in the expertise that keeps our health system running and safe. The data and digital workforce at Health NZ has been slashed by nearly 40 percent, moving from a baseline of 2,400 roles to just 1,460.

I have been vocal about the $330 million the government cut from data and digital health initiatives in Budget 2024. That funding was for work on cybersecurity capability, and it is gobsmacking to me that he would consider work in this field irrelevant when IT services needed investment.

By cutting these roles and funding we are not just losing staff; we are going backwards. We are missing the opportunity to get ahead of the curve. When we fail to modernise, we do not just stay still, we fall behind, leaving the doors wide open for external threats.

The Health Digital Investment Plan will never realise its promise unless the initiatives are funded. 

Patient care is at risk

Both in Parliament and the media, I have highlighted the backwards approach to security standards under the National Government and how it leaves patients vulnerable and undermined trust. I believe that cutting IT support is effectively jeopardising patient care.

We saw recently when patient records held in the MediMap medication management system were hacked, replaced with fake names and some patients even recorded as ‘deceased’ that patient care – not just their data - is at risk.

The Government’s refusal to properly fund the Privacy Commissioner and its failure to share cybersecurity capability with private providers has left us exposed to breaches of this nature, and the public distrustful. 

The cuts made in Budget 24 and 25 are false economies that will be wiped out by the cost of a single major data breach or a prolonged system outage. 

New Zealanders deserve confidence that when they use an app like Manage My Health or management of their care is entrusted to a system such as MediMap, their information is safe and that they can have trust in it. 

The Government has a role in ensuring that. Currently, that confidence and trust is at an all-time low.

What must be done?

To prevent further breaches and systemic failures and keep patients and their data safe, we must shift our perspective away from cuts and reinvest where it matters. Digital security is not a ‘nice to have’; it is a clinical necessity.

1. Mandatory security standards: We must enforce the high-level security standards Labour introduced in 2022 across all platforms, both in the public system and private providers that handle patient data.
2. Restore digital expertise: We cannot expect a safe, resilient and secure health system without staff who are experts in their field. We must halt the attrition of our digital workforce and re-invest where it is needed
3. Stronger rules and penalties: The Privacy Commissioner has called for penalties to drive compliance, but the National Government has instead cut funding to the privacy watchdog. All health providers must be properly regulated and held accountable in terms of how they handle personal information.

Where we should be heading

My vision for the health system is one that is truly patient-centred. That means New Zealanders get the care they need where and when they need it. 

Trusted and secure platforms are essential to this; services that are simple and consistent for patients and their clinicians to use, whether they are getting a vaccination in Kaitaia at a community-led provider, or a hip replacement in Dunedin at the hospital.

In New Zealand, we are lucky to have innovative, creative local developers to do this work, that can create jobs and improve patients’ health, trust in and experience of the health system. It is not clear to me that Health New Zealand’s present direction will give these developers the opportunities they need.

Conclusion

You cannot have a modern, safe health system while you are hacking away at its digital foundations. 

National’s cuts have created security and care risks. The Manage My Health breach was a warning shot, swiftly followed by MediMap. If we continue to hollow out our digital services, we are gambling with patient care. 

As health professionals and leaders, we must demand that digital infrastructure be treated with the same clinical rigor as any other medical tool. We cannot allow "efficiency" to become a euphemism for "vulnerability." Patients’ privacy, care and their safety depends on it.

Read more VIEWS

Return to eHealthNews.nz home page

General Practice New Zealand has released a position paper calling for digital primary care systems to be treated as critical national infrastructure, with enforceable minimum security standards and independent certification for all vendors handling patient data.

The position paper also says that sustainable investment in digital primary care is crucial as the funding model was not designed to uplift security and sustain ongoing compliance.

The move follows recent breaches including Manage My Health and MediMap, which GPNZ describes as symptoms of structural weaknesses in standards, governance, assurance and investment settings rather than isolated failures.

Justin Butcher, GPNZ deputy chair and chief executive of Pinnacle Midlands Health Network, says the health system’s reliance on digital tools has grown, but the governance and standards surrounding those systems has not kept pace.

“Digital systems are now embedded in everyday care. Patient portals, shared records and electronic referrals are essential to how primary care operates,” he says.

“Yet the standards and oversight needed to protect those systems remain inconsistent. The health system needs to move from reacting to incidents to deliberately strengthening its digital foundations.”

Butcher says other sectors already treat digital systems as critical infrastructure, operating with clear standards and independent oversight.

“Primary care sits at the frontline of the health system. It is where patients turn for reassurance and care, and that trust must not be undermined by preventable system failures,” he says.

The position statement calls for enforceable minimum digital security standards, independent certification and transparent assurance, oversight stratified by scale and concentration of risk, structured vendor governance with clear accountability, and sustainable investment recognising digital health as core infrastructure.

It says that current frameworks such as the Health Information Security Framework (HISF) operate primarily as guidance rather than auditable requirements and HISF is not currently enforceable and is not always used as the reference framework by vendors.

Because vendors engage individual practices as customers, there is limited aggregation of purchasing power and a lack of ability to influence pricing, standards and contractual terms, it adds.

Digital systems in general practice are funded from operating budgets and treated as overhead, meaning cost often becomes the main determinant of choice rather than security or functionality.

"Expecting small and medium sized providers to absorb increasing digital obligations within existing operating margins is neither realistic nor sustainable," the position paper says.

Butcher says primary care providers are committed to strengthening digital security but need consistent national frameworks to do so effectively.

His comments echo those of Aged Care Association (ACA) chief executive Tracey Martin and Medical IT Advisors chief executive Faustin Roman who told eHealthNews that healthcare IT should get similar regulatory treatment to other critical infrastructure sectors, with appropriate assurance and enforcement mechanisms. 

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

Last night I logged into my health and wellness app - following a GP consultation earlier in the day. It confirmed that the practice has sent an update, but I noted the absence of a reason for prescribing a new medication; therefore, I sent a response message asking for that data to be added to my record. I also created permissions to enable other members of my care team to see the new data prior to an appointment the following day… 

…and then I woke up and realised that I’d been dreaming. An hallucination based on a related fantasy that interoperability and consumer access to healthcare data can be achieved without regulatory intervention. Instead, the reality is a world where lip-service is paid to various standards unsupported by conformance and compliance requirements; intermittent funding is made to selected software suppliers to exchange their own proprietary data formats; and patient portals with read-only data are tethered to practice management systems. 

The New Zealand context 

The goal of interoperability is cited in virtually every single health information strategy and investment plan produced in New Zealand in the last 2 decades. The latest being the Health Digital Investment Plan published in November 2025. However, this excellent document does provide pointers to a way forward that takes us beyond the madness of continuing to expect this outcome by continuing to do the same things. 

In particular, the highlighted phrases this excerpt from the Data & Interoperability Section on Page 7: 

“We will enable the secure and seamless flow of health data across the system. We will do this by establishing and enforcing common data standards across the sector, creating a national data catalogue, and building a modern, standards-based interoperability platform using international best practices” 

and this ‘horizon’ listed on Page 26: 

“Approved health app developers can use national API resources to create innovative tools for patients that securely connect to the patient's health record” 

Obviously, these entries do not directly call out the need for regulation, but they should encourage us to see if other countries are moving in that direction, and even a cursory glance outside the shores of New Zealand reveals that several countries have established or are actively developing regulations regarding interoperable healthcare data. 

The global context 

Arguably leading the way in 2016, the 21st Century Cures Act in the USA prohibits information blocking and mandates that patients have free, electronic access to their medical records. This has been supported by government regulations stipulating the use of HL7® FHIR® APIs to provide access to consumers and payers. 

This legislative path has been followed in the EU by the European Health Data Space which mandates that Electronic Health Record systems must meet specific, standardized interoperability requirements to allow for seamless exchange.  

In Australia, The Modernising My Health Record (Sharing by Default) Act 2025 establishes requirements for healthcare providers to upload key health information to My Health Record by default. This represents a significant shift from voluntary participation to mandatory upload requirements for certain providers. 

Health interoperability in the UK is now primarily driven by the Data (Use and Access) Act 2025, which mandates technical standards for IT suppliers and providers. This legislation enforces compliance with interoperability standards—such as FHIR—to ensure seamless data sharing across the NHS and social care. 

Following closely behind are Canada and Ireland both with new legislation to support standards-based interoperability and patient access, so is it time for New Zealand to follow suit and adopt similar legal mandates? 

The case for regulation 

While I would answer that question with a firm ‘yes’, it’s with the caveat that regulation of itself is not a silver bullet and, critically, needs to be supported by investment. 

It’s easy to look at our current state and see that most health information data is not fit for purposes beyond that for which it was originally collected. Certainly, that is my experience based on decades of working on national interoperability projects such as GP2GP patient notes transfers and the NZ e-Prescription Service. 

That is not to blame the numerous software suppliers engaged in those and other similar projects. Their products are principally designed for the purposes of managing healthcare facilities and running practices and, consequently, scheduling and reimbursement related to patient encounters takes precedence over the creation of interoperable patient records. 

Naturally, vendors will prioritise new functional features that enhance their clients’ user experience and generate revenue rather than implementing changes that only appear to have downstream benefits. In NZ at least, it’s a low margin business and interoperability does not provide a competitive edge. As many have noted, it’s not a boat race - we are all effectively paddling in the same vessel. 

The need for investment 

Therefore, it’s clear that regulation needs to be supported by investment. Suppliers need financial incentives – preferably carrots rather than sticks - to comply with standards, and build APIs, that benefit us all in the long run but might otherwise have an adverse short-term effect on their profit margins. 

Furthermore, without the development of standards-based APIs, it’s difficult to foresee the emergence of a market for apps that enable engaged consumers to manage their own health and wellness data. It’s also highly likely that any project attempting to facilitate the sharing of patient records can produce significant benefits without structured, standards-conformant, data. 

We all know that dreams are free; in reality, experience should be teaching us that interoperability and consumer access both require regulation backed by investment. The time has come to put that into practice. 

Disclaimer: The opinions expressed in this article are purely personal and do not represent the views of my former clients, HL7 New Zealand, HL7 International or generative AI. 

If you want to contact eHealthNews.nz regarding this View, please email the editor Rebecca McBeth.

Read more VIEWS

Return to eHealthNews.nz home page

Digital health systems should be treated as critical infrastructure as security failures directly impact patient safety, experts say. 

Aged Care Association (ACA) chief executive Tracey Martin says the MediMap incident highlights how dependent modern care delivery has become on digital systems and this means security, redundancy and contingency planning must be treated as core health infrastructure responsibilities. 

Medical IT Advisors chief executive Faustin Roman agrees, saying that healthcare IT should get similar regulatory treatment to other critical infrastructure sectors, with appropriate assurance and enforcement mechanisms. 

Digital platform MediMap is used widely for prescribing, pharmacy dispensing, and medication administration in aged residential care, disability services, hospices, and community health settings. 

It was taken offline after detecting a security breach on 22 February, creating immediate operational impacts on aged care facilities across New Zealand and forcing providers to shift to manual systems to ensure residents continued receiving medications safely. 

Tracey Martin says digital medication systems bring real benefits by reducing transcription errors, supporting coordination between GPs, pharmacies and facilities, and strengthening clinical oversight.  

“But they are now critical infrastructure," she tells eHealthNews. 

"When they fail, whether through cyber breach or system outage, the pressure shifts immediately onto frontline staff." 

Martin says that manual processes are safe when done well, but are more labour-intensive and increase fatigue and workload risk.  

“That is why cybersecurity and system resilience can't be seen as 'IT issues'. They are patient safety issues,” she says. 

Roman, a certified ethical hacker with more than 10 years' experience in health IT security, does not agree with recent chatter on social media and Health NZ’s position on the MediMap incident, which places sole responsibility for security on platform vendors.  

"I do not agree that any organisation should ever be solely responsible: cybersecurity will always be a shared responsibility" he tells eHealthNews. 

“Providers have primary responsibility of certain controls, however other stakeholders need to play their part, e.g. users must be cyber-aware and protect their credentials, government agencies should enforce minimum standards, healthcare organisations should do regular assessments and third-party assurances,” he says. 

Roman argues that healthcare IT should get similar regulatory treatment to other critical infrastructure sectors, with appropriate assurance and enforcement mechanisms. 

“Regular penetration testing and security assurance should become standard practice, particularly as technology ages and threat levels increase.” 

He believes that New Zealand's approach to healthcare cybersecurity is still immature compared to other jurisdictions with a lack of enforcement mechanisms, assurance, incentives or liabilities. 

New Zealand's Privacy Act maximum fine of $10,000 contrasts sharply with penalties under Australia's privacy legislation or Europe's General Data Protection Regulation. 

Despite recent high-profile incidents, Roman there has been surprisingly low inquiry levels from health IT companies seeking security reviews and advice. 

While there was initial uptick in activity following the Manage My Health breach in late 2025, the MediMap incident has generated far less response than expected. 

"There is a time for talking and planning that maybe was about 10 or 15 years ago, and then there is the time to actually act, which is probably yesterday,” he says. 

Martin says the ACA has maintained regular contact with members since the MediMap incident, providing clear practical guidance and ensuring Health NZ understands the operational impact on facilities. 

"Our members showed resilience and professionalism, as they always do, but this event is a reminder that system-wide digital security matters deeply to aged care and needs to be prioritised accordingly,” Martin says. 

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

MediMap has started a phased restoration of its digital medication management platform after going offline in New Zealand due to unauthorised activity in its system.

The privately owned platform, used widely across New Zealand for prescribing, pharmacy dispensing, and medication administration in aged residential care, disability services, hospices, and community health settings, was taken offline after detecting the security breach on 22 February.

The breach involved some resident demographic information being changed including residents’ names, dates of birth, assigned prescriber, allergy or intolerance information and discharge or deceased status.

MediMap says restoration began on 2 March 2026 and facilities where current resident information has not been modified will be restored first following internal validation. 

Facilities where resident information may have been impacted will be contacted directly by MediMap to confirm current resident details prior to restoration.

MediMap has secured a court injunction to protect impacted individuals' information, which prohibits any person from accessing, using, copying, sharing or publishing any MediMap data that may have been unlawfully obtained.

“At this stage, we cannot confirm whether any resident data has been accessed beyond viewing, extracted, or exposed externally. The investigation is ongoing,” an FAQ for providers on MediMap’s website says.

The company says it has rebuilt a secure production environment and completed forensic review and validation of its data before beginning the restoration process. 

Independent cyber security specialists have supported the strengthening of authentication controls.

"We acknowledge the patience and professionalism of providers and their staff, who have continued to deliver care for patients and residents with manual processes during this disruption," MediMap says in a system update on 3 March.

"We are confident in the integrity of the restored environment.”

Providers will be required to validate specific demographic information identified during the investigation before accessing the platform and all user passwords will be reset as part of the security measures.

Healthcare providers have had to revert to manual processes while the system has been offline and must clinically review and reconcile any medication changes made during the outage period. 

Electronic prescribing via NZePS will be progressively re-enabled once the core system stabilises.

Following the initial restoration phase, MediMap will enter a stabilisation and hypercare period with expanded support arrangements to transition back to business-as-usual operations. The phased restoration approach has been shared with Health New Zealand to ensure alignment as services are progressively restored.

"Our shared objective is a safe, structured return to digital medication management that balances clinical continuity with strengthened security controls," MediMap says.

Health New Zealand acting chief information technology officer Darren Douglass says the organisation is supporting MediMap's response and has activated its Cyber Incident Management Team to assist.

“People need and deserve confidence that their private and sensitive health information is secure. Protecting patient data is a priority across the health system,” Douglass says.

MediMap has also notified the Office of the Privacy Commissioner and New Zealand Police about the incident. 

"We understand how concerning this situation has been for residents, patients, families and healthcare providers. We sincerely apologise for the disruption and distress caused," the company says in a statement.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

The true significance of the Manage My Health data breach will not be determined by how thoroughly it is investigated, but by whether the health sector uses this moment to fundamentally improve how digital health data and systems are designed, governed and protected in Aotearoa. 

If we do not get that right, we risk undermining the very tools and digital capability that increasingly support patient care when it is needed most. 

Time to review 

With the Ministry of Health and Privacy Commissioner's reviews now underway, this is an important moment. Reviews, inquiries and reports are familiar tools in the health system, particularly following high-profile incidents. However, experience shows that the value of these processes lies not in the documentation itself, but in whether they lead to clear, practical, and enduring change. 

For digital health, that bar must be set high. Otherwise, we risk regression at a time when trust is already fragile. Even highly digitally capable general practices, including some in our region, are questioning whether the ’system’ can be relied upon to keep data secure. 

Digital systems are no longer peripheral to care delivery. Patient portals, shared care records, analytics platforms and integrations between primary and secondary care are now core infrastructure. They shape how clinicians work, how patients engage with their care, and how information flows across the system. Here in the South, many general practices rely heavily on digital infrastructure to sustain care delivery amid a constrained workforce, particularly in rural areas where on-site daily clinical coverage is not always possible. 

As a result of this reliance, cybersecurity and privacy can no longer be treated as technical considerations or compliance exercises that sit alongside delivery. They are fundamental design principles that must be embedded from the outset and that are essential to rebuilding trust. 

Looking forward 

What the sector now needs from the Manage My Health reviews is not simply a retrospective analysis of what went wrong, but a forward-looking framework that helps us, as a nation, deliver digital health better and more safely. That framework needs to provide clarity on expectations, roles and accountabilities across the ecosystem, including vendors, health organisations, funders and regulators. More than that, it must work and regain the trust of clinicians and patients. 

Without that shared understanding, responsibility remains fragmented, and risks are pushed downstream to the organisations and clinicians closest to patients. 

One of the most pressing challenges exposed by recent cyber incidents is the inconsistency in security maturity across digital health platforms. Some organisations invest heavily in cyber governance, independent assurance and continuous monitoring, while others operate with minimal oversight and legacy approaches that no longer reflect the threat landscape. A system that relies on voluntary uplift or variable standards is inherently fragile. The reviews must therefore help define what “good” looks like in practice, including baseline security expectations that are proportionate to the sensitivity and scale of the data being held. 

Equally important is transparency. In a digital health environment built on trust, patients and clinicians need confidence that when things go wrong, information will be shared early, clearly and honestly. This is not about blame. It is about enabling informed decision-making, managing risk and maintaining confidence in the system as a whole. Clear expectations around communication and disclosure should be a core outcome of the reviews, not an afterthought. 

Opportunities for change 

The reviews also present an opportunity to strengthen cyber governance at a system level. Digital health in Aotearoa has grown rapidly, often through a mix of national initiatives, regional solutions, and vendor-led innovation. While this has delivered real benefits, it has also created complexity and uneven oversight. A more coherent approach to assurance, certification, and ongoing monitoring of digital health platforms would reduce duplication, build confidence and trust, and allow organisations to focus on delivery rather than constantly revalidating the same risks in isolation. 

Importantly, any path forward must recognise the operational realities of the health sector. General practices, community providers, and PHOs are not technology companies, yet they are increasingly expected to manage sophisticated digital risk alongside delivering care. A safer digital health system is one that supports these organisations with clear guidance, shared tools and system-level investment, rather than transferring risk without the means to manage it. 

At its core, this is about trust. Health data is among the most sensitive information people hold, and the expectation that it will be protected is both reasonable and non-negotiable. When that trust is undermined, the consequences extend beyond the immediate incident. Confidence in digital services erodes, adoption slows, and the potential benefits of digital health are harder to realise. 

The Manage My Health reviews are therefore a pivotal moment. They can either reinforce a pattern in which each incident is treated as isolated and exceptional or mark a genuine reset in how we approach digital health safety across the system. The latter requires courage, coordination and a willingness to move beyond minimum compliance towards shared responsibility. 

If we get this right, the outcome will not just be stronger cybersecurity. It will be a digital health environment that is more resilient, more transparent and more worthy of the trust that patients and clinicians place in it every day. 

If you want to contact eHealthNews.nz regarding this View, please email the editor Rebecca McBeth.

Read more VIEWS

Return to eHealthNews.nz home page

Health Minister Simeon Brown defended the government’s funding of health cybersecurity in Parliament today (January 28) as Labour questioned whether Budget 2024 cuts to data and digital services left the health system more vulnerable.

The questions follow a major data breach at private health organisation Manage My Health in December 2025 that compromised the personal information of more than 120,000 New Zealanders.

Labour health spokesperson Ayesha Verrall challenged Brown on whether cuts to Health New Zealand's data and digital funding in Budget 2024 led to the cancellation of cybersecurity projects.

More than $330 million earmarked for data and digital health initiatives at Health NZ was returned as part of budget savings in 2024.

This included $186 million for 'Data and Digital Foundations and Innovation' and $144 million for 'Data and Digital Infrastructure and Capability – Enabling Health System Transformation' through to 2027-28.

Verrall referenced Health New Zealand's annual review statement, saying that "planned future work on the next stage of cybersecurity capability uplift has been cut," and asked whether this related to the defunding of digital initiatives in Budget 2024.

Brown said the government has "continued to invest in strengthening Health New Zealand's cybersecurity capability" with an additional $9 million in Budget 2024 and $10 million in Budget 2025.

"Over the last two years, Health New Zealand has taken a number of important steps including adoption of new data sharing standards, increasing the use of multi factor authentication to access clinical systems and introducing 24/7 monitoring of devices and systems to detect, quarantine and respond to cyber incidents," Brown told Parliament.

Brown said the government takes the security of health data extremely seriously.

“That is why Health New Zealand has responded by running an all of government response, activated incident controllers to support Manage My Health, ensured that independent cyber security experts have been engaged to provide assurances of Manage My Health's response and provided support for the primary care as they respond,” he said.

Public Service Association national secretary Fleur Fitzsimons has also questioned the impact of budget cuts and downsizing of the digital services teams at Health NZ.

"New Zealanders deserve a health system where their private information is protected. That requires proper investment in IT security and the experts who deliver it - not endless cost-cutting that leaves our systems vulnerable," Fitzsimons said.

Manage My Health has 1.8 million registered users in New Zealand and the breach has prompted a number of investigations.

The Ministry of Health will begin a comprehensive review of the incident at the end of January, examining why critical vulnerabilities remained unaddressed before hackers accessed the system.

Privacy Commissioner Michael Webster has also announced an independent inquiry under the Privacy Act to examine compliance and governance arrangements surrounding the breach.

Image: Health Minister Simeon Brown

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page