4 publishers · first seen Thu, 29 Oct 2026 17:00 UTC · updated Thu, 29 Oct 2026 19:51 UTC
Privacy Commissioner Michael Webster has released his second and final report into the December 2025 cyber breach of the Manage My Health (MMH) patient portal, which compromised over 400,000 Health New Zealand (HNZ) documents and more than 22,000 files uploaded by patients, about 90 percent of whom were from Northland. The report states that foundational privacy and consent processes were not in place before digital health expansion, and warns that AI could worsen vulnerabilities without stronger governance. A flaw had allowed Northland hospital data to be stored in unactivated patient accounts, corrected in January 2026.
The report makes 10 recommendations, urging HNZ and MMH to engage face-to-face with Northland communities and ensure secure account activation by the planned 2027 rollout, including Māori data governance. It criticises MMH's 24-month retention of data in non-activated accounts, recommending deletion after three months. Webster emphasized that organisations must have cyber crisis plans ready, as the breach significantly damaged trust in health portals.
Content auto-generated. May contain inaccuracies.