Privacy Commissioner Michael Webster has issued compliance notices to Manage My Health (MMH) and Health New Zealand for failing to adhere to security requirements during a cyber incident in late December 2025.
According to the Office of the Privacy Commissioner (OPC), the breach affected many people, whanau, and communities, with 90 percent of the affected patients living in Northland, particularly Māori.
The first compliance notice requires MMH to complete actions to abide by the security requirements by 31 August 2027. The OPC recognised that MMH has already fulfilled some requirements.
The second compliance notice identifies adjustments Health NZ should make to meet security requirements, with a deadline for required changes set at 29 January 2027.
Webster pointed to seven areas with ineffective security protections when developing the requirements under the compliance notices. MMH has improved in three areas since the cyber attack, including ensuring effective multi-factor authentication controls, restricting user access to information, and controlling unauthorised external access.
Read Also: Court rejects $27m claim against startup financiers
On 1 January 2026, MMH notified the OPC about the December 2025 cyber incident involving the access to, theft of, and sale of New Zealanders’ sensitive health information. Health Minister Simeon Brown announced a review of MMH’s and Health NZ’s response to the cybersecurity breach concerning patient information, commencing by 30 January 2026.
The compliance notices aim to ensure that MMH and Health NZ treat patient data securely, giving New Zealanders assurance that these breaches are taken seriously and that strengthening systems is vital. They are taking steps to prevent similar incidents in the future.
Michael Webster and the OPC are working to ensure that MMH and Health NZ comply with the requirements outlined in the notices. The OPC will monitor their progress to ensure that the necessary changes are made.
They have been given specific deadlines to complete these changes.
The review will help to identify areas for improvement and ensure that patient information is protected.
