Sarah McMillan/cvnznews.com
Privacy Commissioner Michael Webster has released the second and final report into the December 2025 cyber breach involving the Manage My Health (MMH) patient portal, warning that the incident should serve as a major wake-up call for organisations handling personal information.
Webster said the breach highlighted the importance of understanding what information agencies collect, why they collect it, how it is stored, and how they respond when things go wrong.
“It is going to be a lot more stressful for your customers and your staff if you have to create your crisis management playbook as you respond to the crisis,” he said.
The report outlines several key lessons for agencies across all sectors, not just healthcare.
Among the findings is the need for organisations to properly manage customer accounts. The Commissioner said people who begin but do not complete a registration process have not necessarily authorised the ongoing collection and storage of their personal information. Agencies relying on consent must ensure individuals clearly understand what they are agreeing to.
The report also emphasises the need for clear processes to deal with dormant accounts and the accounts of deceased people. The Office of the Privacy Commissioner generally expects agencies to contact account holders after 12 months of inactivity to determine whether the account should be retained, unless there is a legal requirement to keep it active.
Webster also stressed the importance of having strong privacy breach response procedures in place. Agencies are expected to understand when a breach reaches the threshold for notification under the Privacy Act and should not delay informing affected individuals simply because internal processes are inadequate.
The report further clarifies that organisations using third-party providers remain responsible for personal information. Where a third-party processor makes design or operational decisions independently, it may also carry its own privacy obligations.
While the breach affected people across New Zealand, the report found Northland communities bore a disproportionate impact.
Around 90 percent of those affected were Northland hospital patients, resulting in particularly significant consequences for Māori patients, whānau, and health services in the region.
The report notes that the harm caused by the breach went far beyond the theft of information. Patients whose records contained highly sensitive information, including details relating to sexual assault, family violence, and justice involvement, faced anxiety and the risk of re-traumatisation even where those specific records were not ultimately accessed.
Uncertainty surrounding exactly what information had been viewed by hackers added to the distress experienced by many affected individuals.
Webster said the breach had also damaged public confidence in digital health systems.
Healthcare providers and sector organisations have reported some patients requesting physical copies of records rather than using online portals, while others are now more cautious about engaging with digital health technologies altogether.
The report makes recommendations aimed at rebuilding trust in health services and digital patient portals in Northland, with particular attention given to Māori perspectives and community confidence.
The final report concludes the Privacy Commissioner’s inquiry into the Manage My Health breach.
The first phase of the investigation found both Health New Zealand and Manage My Health had breached the Privacy Act, resulting in compliance notices being issued to both organisations. The Office of the Privacy Commissioner has also received around 50 complaints related to the incident, which will continue to be handled through its normal dispute resolution processes.
