Three high-profile health data breaches within three months have exposed what a cybersecurity expert describes as a "feeding frenzy" pattern, where attackers target sectors with demonstrated weak defences and minimal consequences.

The latest incident at IntraCare, an Auckland-based private healthcare provider, comes after breaches at Manage My Health and MediMap, following what Altersec chief executive Faustin Roman says is a predictable pattern rather than coincidence.

"New Zealand health providers are genuinely under greater attack: one high-profile breach absolutely leads to more," he says.

In the latest case, IntraCare took its patient management system, Picture Archiving and Communication System (PACS), and finance systems offline after detecting unusual activity within its IT environment on 20 March 2026.

“We have confirmed the incident involved unauthorised access to parts of our network,” a spokesperson says. 

“We are working to establish exactly how this occurred and are already implementing additional safeguards and monitoring to further strengthen our systems.”

Roman says healthcare data represents the most valuable commodity on the dark web, with a single health record worth far more than a stolen credit card because it contains identity details, NHI numbers, and clinical history that cannot be cancelled like financial cards.

“In cybersecurity, we see a clear "feeding frenzy" pattern: once an attacker publicly compromises a sector and demonstrates that defences are weak and consequences are minimal, the broader criminal ecosystem takes notice,'" he says.

"The MMH breach effectively put a spotlight on New Zealand's health tech sector and potentially signalled 'this is soft. 

"Threat actors share this intelligence. They target the same vertical, in the same country, because the conditions that allowed the first breach - legacy platforms, voluntary security standards, a $10,000 privacy penalty cap – have not changed overnight."

The interconnected nature of health systems to enable data sharing may also allow attackers to move from one system to another, says Roman.

The timing of these breaches also aligns with known vulnerability windows, particularly the December-January holiday period when organisations operate with skeleton IT crews and reduced monitoring.

The ManageMyHealth breach was detected on 30 December, MediMap in February and IntraCare in March. 

“Attackers who gain access during the holiday period may not be discovered until staff return and systems are properly reviewed," he says.

The National Cyber Security Centre's Q4 2025 Cyber Security Insights report shows the threat landscape was already intensifying before these breaches, with website compromise incidents up 16 per cent, denial of service attacks doubling, and 23 per cent of nationally significant incidents attributed to state-sponsored actors.

Roman says New Zealand's approach to healthcare cybersecurity remains immature compared to other jurisdictions with no mandatory audit regimes and meaningful penalties.

He described the Privacy Act's maximum fine of $10,000 as "laughable" compared to Australia's privacy legislation or Europe's GDPR.

IntraCare, which treats more than 2,000 patients annually, says it activated its incident response plan after detecting the breach and engaged Cyber CX, a leading Australasian cybersecurity organisation, to conduct a forensic investigation.

The provider maintained patient care by reverting to manual processes, but the breach did impact some scheduled procedures with 28 patients temporarily deferred.

“We recommenced procedures on Monday 30 March. Our focus has been on ensuring systems are fully tested and resilient before bringing them back online,” the spokesperson says.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

East Health Trust has developed more than 30 robotic process automation (RPA) bots to help address the growing administrative workload that can cause GPs to reduce clinical hours or retire early.

The Primary Health Organisation began developing the technology two and a half years ago after seeing administrative workload become a key factor in driving both newly qualified and experienced doctors away from general practice.

"The common feedback from clinicians was that the admin is what really causes them problems," says Daniel Calder, East Health Trust's clinical director. 

"Clinicians at all ranges of their career bring this up: from newly qualified GPs in interview situations to clinicians at the later part of their career saying it is one of the things that makes people want to retire."

The bots handle routine tasks including filing normal blood results, processing screening programme updates and managing hospital status notifications. Around 65 percent of East Health Trust's clinics are using them, covering 80 percent of enrolled patients.

Calder says the connectivity of healthcare systems has increased the administrative burden.

"It is not uncommon now during a consultation to do an electronic order for blood tests, an electronic order for radiology investigations, refer someone to a different specialty and perhaps arrange an ACC claim at the same time," he explains. 

"The clinician becomes part-time administrator as well as thinking with a clinical brain."

Richard Clapp, the PHO's programme specialist, says the volume of communication from hospitals can be a real challenge, with one bot dedicated solely to filtering status updates about patients progressing through the hospital system. 

A cardiovascular risk assessment bot identifies patients due for assessment and completes calculations using existing data warehouse information. It then automatically sends low-risk patients healthy lifestyle information and flags moderate and high-risk cases for nursing team review.

Blood result processing bots also handle thousands of laboratory results monthly, reviewing normal results against both standard ranges and historical values before filing them automatically. 

Calder says one of the most impactful bots works on referrals, filing routine acceptance notifications but alerting clinicians when they are declined or have advice from hospital colleagues.

He says that before implementing a new bot they test it in the clinic he works in and continue to audit its performance. 

Patients benefit by getting earlier access to  their results in the patient portal and GPs can focus more on direct clinical care.

Clapp says trust and confidence in the bots has built over time and clinics are now quick to adopt and ask when the next one is coming. 

“One of the key things that we have been able to achieve for our clinics is we have the Bots working across both indici and Medtech Evolution Practice Management Solutions," he says.

"The clinics that have a lot of bots running do not seem to have the same workforce churn, which is really positive.

"The bots do not get tired and they do not get bored - they just keep on going.”

Image: Daniel Calder, East Health Trust's clinical director

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Workforce news

Return to eHealthNews.nz home page

The Northern Region's Hospital at Home (H@H) programme is supporting around120 patients daily, with plans to expand to 200 patients by the end of the next financial year.

The service is having a significant impact on hospital capacity by effectively freeing up around 80 beds daily across the region's hospitals.

The home-based service combines continuous remote monitoring using wearable devices, intermittent monitoring devices, virtual ward rounds and in-person interventions, with 60 percent of patients on any day receiving in-person interventions and 40 percent of patients receiving virtual care as an alternative.

Erik McClain, clinical lead Northern Region H@H, says that since launching at Auckland Hospital they have seen a reduction in general medicine length of stay by one day.

With those wards seeing up to 220 patients daily, shaving a day off length of stay has a massive impact, he says.

Counties Manukau was the first to develop and implement H@H pathways supporting admission directly from the Emergency Department (ED) Medical Assessment Unit. Half of all patients admitted to H@H in Counties Manukau now come directly from the ED, avoiding a hospital admission altogether.

Other sites are planning to implement similar direct admission routes within the next few months. 

As the three Metro Auckland districts, H@H services were developed rapidly in response to the challenges created by the Covid-19 pandemic and in 2023 the Northern Regional Provider Group tasked the region as a whole with expanding H@H services.

Te Tai Tokerau went live with their first patients in March 2024, completing the regional rollout.

Penny Magud, interim regional operational lead for Northern Region H@H, says a key component of the regional service is the 24/7 virtual coordination hub staffed by virtual care nurses who monitor patients using remote wearable devices and intermittent monitoring equipment. 

The digital technology enables the service to support more patients, including those with higher acuity, through 24 hour oversight and virtual vital sign monitoring.

The wearable currently being used by H@H allows the team to monitor six different vital signs (HR, BP, RR, SPO2, Temperature and ECG), along with cardiac algorithms. A virtual care dashboard operates 24/7, prioritising patients based on early warning scores generated from their vital signs data.

"All patients receive virtual care as part of the hybrid model of care, as each patient is reviewed in a virtual ward round each afternoon, which are led by our H@H clinicians (SMO/Nurse Practitioners) ” Magud explains.

“This winter we are aiming for 150 patients at any given time to be supported in H@H across the region, with a vision that by end of the 2026-2027 financial year we will be supporting around 200 patients on any given day of the week”.

McClain says the programme has expanded beyond general medicine to include post-operative cardiothoracic surgery patients, with plans to add pre and post-operative vascular patients. New pathways from the ED for cardiology and general medicine patients admitted directly to H@H go live next month.

Future developments include bringing patients from Northland and Waitematā to Auckland for surgery, with pre and post-operative care provided through H@H. 

Caroline Ogilvie, project manager for digital delivery Northern Region Digital Services, says the team is working on sponsored data arrangements to ensure patients can access the service without the cost of data being a barrier.

"The patient can directly text or call the virtual care hub and also the virtual care hub can directly contact the patient by video call/ SMS/ in app messaging and push educational materials and patient questionnaires," she says. 

Patient satisfaction is high, with net promoter scores reaching 98-99 percent against a target of 90 percent, Ogilvie adds.

The Northern Region has had more than 7,000 admissions to Hi@H over the 12 months with nearly two thirds of patients over 70-years-old.

Magud says the programme reflects the area’s diverse patient population. Around 18 percent of H@H patients identify as Māori, 33 percent as Pacific peoples and 18 percent as Asian.

Image: Erik McClain, clinical lead Northern Region H@H

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Digital Patient news

Return to eHealthNews.nz home page

Whaikaha is using its own workforce as a real-world testing ground for accessible implementation of artificial intelligence (AI), with around half of staff identifying as disabled.

The Ministry of Disabled People’s approach involves testing AI tools with employees in their everyday work environments. Deputy chief executive strategy and enablement Ginny Baddeley says this internal testing provides insights into both barriers and benefits.

"We felt that to be able to have that conversation about AI from a disability perspective, we had to have our own test case and 50 percent of our staff are disabled or identify as having a disability,” she explains.

This real-world testing approach provides valuable data on how AI tools perform across different accessibility needs and work styles, enabling Whaikaha to provide evidence-based guidance about accessible AI implementation.

Whaikaha is mainly using Microsoft Copilot, but Baddeley says the specific technology matters less than whether it genuinely helps people work more effectively. 

Staff involvement from the early stages has kept use cases practical and focused on solving real problems rather than implementing technology for its own sake.

Baddeley says Whaikaha treats AI implementation as a behavioural change initiative rather than a technical project and says the main challenges are about confidence and judgement rather than technical skills.

"We consistently talked about AI as supporting thinking rather than replacing it, and reinforced that people remain accountable for decisions and outputs," she says. 

"As leaders, we set the tone by visibly using AI in our own work and talking openly about how and where we use it, and where we do not."

She says this leadership approach has helped normalise appropriate AI use and build confidence among staff members leading to steady uptake, particularly in writing, analysis and briefing roles.

“Our focus is on common tasks that take time but do not require unique judgement every time, such as drafting, summarising, and navigating internal guidance,” Baddeley says. 

“Reducing friction in these areas frees people to focus on work that benefits most from human insight, while improving consistency and accessibility.

“AI can assist, but people remain responsible. Building capability alongside clear guardrails has been more effective for us than relying on rules alone,” she explains.

Baddeley and Whaikaha chief executive Paula Tesoriero will share their learnings on building accessible responsible AI at an upcoming HiNZ event on March 31 in Auckland.

Register for – From IT to Digital and AI in Health – today.

Image: Deputy chief executive strategy and enablement Ginny Baddeley

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more AI & Analytics news

Return to eHealthNews.nz home page

South Taranaki Rural Health has implemented virtual consults using locum doctors to address staff shortages and maintain patient access to care.

The hybrid model, launched in December 2025, involves patients getting in-person nursing assessments before connecting with remote doctors who have full access to the practice's patient management system.

Practice manager Lisa Zame says this means the practice can continue to provide appointments for routine and acute care without having to cancel appointments or extend wait times.

The system reduces pressure on GPs as virtual locum doctors also support administrative tasks like managing patient inboxes and reviewing laboratory results.

"This means the clinicians on the ground can focus on patients that need to have physical exams or procedures done," Zame explains.

Patients generally attend the practice rather than connecting from home. They arrive 15 minutes before their scheduled appointment to see a nurse who does vital sign assessments, including blood pressure, height, and weight measurements and any other tests that are needed.

Nursing staff also photograph skin conditions or other visible symptoms to share with the remote doctor.

"That nurse is trying to be the ears and the eyes for the doctor at the other end, and trying to capture as much information as possible," she says.

Initially some patients were hesitant and nervous, particularly elderly patients who worried about managing the technology, but they have grown in confidence after becoming familiar with the system.

Zame says that without virtual consultations, the practice would face significant challenges managing patient demand and wait times would create additional pressure on staff and potentially drive patients to emergency departments.

The hybrid model also creates opportunities for preventive care screening with nurses identifying patients overdue for cervical screening and other testing during the same visit.

Both clinical and administrative staff needed time to understand which conditions could be managed virtually versus those needing in-person examination.

"We just learned as we went and we got good feedback from the locum doctor at the other end about what they could and what they could not manage virtually," Zame says.

Image: South Taranaki Rural Health Practice Manager, Lisa Zame

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Digital Patient news

Return to eHealthNews.nz home page

The loss of digital services jobs at Health New Zealand | Te Whatu Ora increases risks to patient care and willl hit rural hospitals hardest, an internal report reveals.

The organisation is actively recruiting into 200 vacancies in its digital services team and has contracted Datacom to support its IT help desk through to May 2026.

More than 600 roles were already vacant and not being filled at the organisation when it confirmed it would reduce the number of data and digital roles from around 2000 to 1460 in April last year.

At the time, the total number of employees in the department was 1412.

The report End user impact of digital change – consequences was prepared in April 2025 after being commissioned by Health NZ's Clinical Quality and Safety Committee (CQASC). It was obtained under OIA by the Public Service Assocation (PSA).

It says that ‘End User Impact of Digital Change assessments’ warned that smaller regional hospitals including Gisborne, New Plymouth, Whanganui, Masterton, Nelson, Greymouth and Rotorua were already under-resourced and geographically vulnerable before the cuts. 

In these areas, “the impact would be felt more keenly owing to the multiple roles conducted by some staff. A combination of single points of failure and inadequate wrap-around support," the report says.

The CQASC found the proposed cuts would increase "overall clinical and operational risks which will materially impact patient care and operational resilience".

Also that reducing digital delivery capability "may negatively impact Health NZ's ability to implement productivity and cost saving initiatives" needed to meet health targets.

It warns of longer wait times for clinicians seeking IT support, saying "delays in responding to issues and requests may lead to impacts on clinical care time or the ability to provide critical information."

Public Service Association National Secretary Fleur Fitzsimons says the report was "a crystal-clear warning that cutting the jobs of IT experts will increase risks to patients - and that was ignored by Health NZ in the headlong rush to make cuts ordered by the Government".

Health NZ's acting chief information technology officer Darren Douglass says the committee’s report identified that any reduction of that scale would carry risks if not actively managed.

"That is why targeted mitigations were built into the final proposal, including prioritising critical clinical systems, retaining additional operational support roles, strengthening regional digital leadership, and adding funded transition roles to support frontline services," he says.

Stuff reported in December that the organisation had contracted Datacom to help run its IT service desk until the end of January 2026. This contract has been extended through till 4 May 2026.

The report also reveals significant gaps in Business Continuity Plans nationwide, which ensure continuation of critical services during major system incidents or outages.

The PSA highlights recent IT outages as evidence of the risks, including an incident in January when clinicians across hospitals in Auckland and Northland were forced to use paper-based systems and whiteboards overnight.

Douglass says that as a large organisation with a significant number of different systems running in different parts of the country, Health NZ experiences technical issues from time to time. 

“Fortunately, the majority of incidents are resolved quickly.  We also have well-established contingencies in place to manage issues when they arise, to ensure patients continue to get the care they need,” he says.

The union is calling for the Government to immediately review funding for health digital services and IT infrastructure and commit to properly resourcing IT system upgrades and maintenance.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Workforce news

Return to eHealthNews.nz home page

General practices in Te Waipounamu, South Island will be the first to begin onboarding to the Shared Digital Health Record from April with clinicians expected to begin accessing SDHR data from mid-2026.

The phased rollout will continue with Te Manawa Taki | Midland region, followed by Northern and Central regions. 

The SDHR is a clinical data connector, designed to securely share patient data across the healthcare system, eventually enabling healthcare providers nationwide to access and update core health information including allergies, adverse reactions, conditions, encounters, and observations.

At a February webinar hosted by HiNZ on the SDHR, Heath Tolley, portfolio group manager – digital enablers & integration at Health NZ, said recent high profile health data breaches have affected public confidence in health information sharing systems.

Consumer research by Health NZ showed one in five of those surveyed reported a significant impact on their trust in health information sharing systems. 

However, 83 percent of participants were still comfortable sharing health information through services like the shared digital health record to support their care.

The latest SDHR update says the staged roll-out ensures each region gets proper support and prevents overwhelming Primary Health Organisations (PHOs) and practices during the transition. 

Stage one of the onboarding process includes a mandatory patient notification period, during which practices must inform patients about the SDHR and give them the opportunity to opt out if they prefer their health information not to be shared. 

It is an opt-in record by default, so if patient’s do not choose to opt out, Health NZ takes a copy of patient data held in the practice's Patient Management System (PMS) during stage two.

The final stage, planned from mid-2026, will see existing regional shared electronic health records (SEHRs) begin integrating with the SDHR, enabling clinicians using those systems to access patient health information held in the national record.

The update says some onboarding processes for the SDHR, including registration, privacy and security assessments, and signing access and use agreements, will also support data collection for the Primary Care Health Target and the National Primary Care Dataset.

Practices will receive information about participating in the SDHR from their PHO before the process begins in their region. Healthcare providers can also contact shareddigitalhealthrecord@tewhatuora.govt.nz.

Watch the webinar on demand and claim your CPD certificates/CME credits.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more National Systems & Strategy news

Return to eHealthNews.nz home page

General Practice New Zealand has released a position paper calling for digital primary care systems to be treated as critical national infrastructure, with enforceable minimum security standards and independent certification for all vendors handling patient data.

The position paper also says that sustainable investment in digital primary care is crucial as the funding model was not designed to uplift security and sustain ongoing compliance.

The move follows recent breaches including Manage My Health and MediMap, which GPNZ describes as symptoms of structural weaknesses in standards, governance, assurance and investment settings rather than isolated failures.

Justin Butcher, GPNZ deputy chair and chief executive of Pinnacle Midlands Health Network, says the health system’s reliance on digital tools has grown, but the governance and standards surrounding those systems has not kept pace.

“Digital systems are now embedded in everyday care. Patient portals, shared records and electronic referrals are essential to how primary care operates,” he says.

“Yet the standards and oversight needed to protect those systems remain inconsistent. The health system needs to move from reacting to incidents to deliberately strengthening its digital foundations.”

Butcher says other sectors already treat digital systems as critical infrastructure, operating with clear standards and independent oversight.

“Primary care sits at the frontline of the health system. It is where patients turn for reassurance and care, and that trust must not be undermined by preventable system failures,” he says.

The position statement calls for enforceable minimum digital security standards, independent certification and transparent assurance, oversight stratified by scale and concentration of risk, structured vendor governance with clear accountability, and sustainable investment recognising digital health as core infrastructure.

It says that current frameworks such as the Health Information Security Framework (HISF) operate primarily as guidance rather than auditable requirements and HISF is not currently enforceable and is not always used as the reference framework by vendors.

Because vendors engage individual practices as customers, there is limited aggregation of purchasing power and a lack of ability to influence pricing, standards and contractual terms, it adds.

Digital systems in general practice are funded from operating budgets and treated as overhead, meaning cost often becomes the main determinant of choice rather than security or functionality.

"Expecting small and medium sized providers to absorb increasing digital obligations within existing operating margins is neither realistic nor sustainable," the position paper says.

Butcher says primary care providers are committed to strengthening digital security but need consistent national frameworks to do so effectively.

His comments echo those of Aged Care Association (ACA) chief executive Tracey Martin and Medical IT Advisors chief executive Faustin Roman who told eHealthNews that healthcare IT should get similar regulatory treatment to other critical infrastructure sectors, with appropriate assurance and enforcement mechanisms. 

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page

A collaborative procurement platform designed for primary and community healthcare providers was piloted in Auckland and is technically ready for nationwide deployment, but needs access to the Health System Catalogue.

Primely is a business-to-business marketplace that would allow primary care providers to access the same national pricing available to hospitals for medical supplies and equipment.

Jess Morgan-French, chief executive of Collaborative Aotearoa, presented the project alongside Rod Hall from Tranzsoft at Digital Health Week NZ 2025, highlighting significant cost disparities between primary and secondary care procurement. 

She said there is a fundamental pricing disparity where primary and community care providers pay between 10 to 40 percent more for identical medical supplies compared to hospitals.

Morgan-French said it was ironic that community and primary healthcare providers receive less funding than hospital systems yet pay more for essential supplies.

The Primely platform is similar to consumer e-commerce sites, allowing healthcare providers to browse multiple suppliers to choose their items.

"What is missing is we do not have access to the Te Whatu Ora Health System Catalogue (HSC) despite a lot of advocacy from a lot of different people," she said.

Hall, who has led much of the technical development, said the platform was co-designed with primary care.

It consolidates procurement from multiple suppliers into one streamlined process and is designed to extend national pricing and supply access to all healthcare providers, including remote clinics, iwi health providers and urgent care centres.

However, following a successful pilot in Auckland a copule of years ago, wider deployment depends on gaining access to the national HSC, which contains standardised product data covering more than 270,000 active clinical and non-clinical products.

Treasury-approved business case documents from the original HSC project talk about providing access beyond hospitals, including Primary Health Organisations (PHOs), non-government organisations (NGOs), community services and other healthcare providers.

The business case stated that PHOs, NGOs and community services "would be consumers of the HSC, long-term".

However, national director - procurement, supply chain and health technology management Andy Windsor, says establishing the HSC to meet the needs of Health NZ is the current priority and no decisions have been made regarding extending it beyond that.

Morgan-French said the platform addresses several current health policy objectives, including supporting distributed and community-based care, providing equity across providers and communities, and enabling primary care-led system efficiency.

Image: Jess Morgan-French, chief executive of Collaborative Aotearoa

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more National Systems & Strategy news

Return to eHealthNews.nz home page