Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach

Manage My Health's patient portal was hacked in December 2025. Photo / RNZ, Finn Blackwell

The Privacy Commissioner has given Health New Zealand and patient portal Manage My Health until next year to comply with health privacy rules after a massive data breach last year.

Almost 100,000 individuals had data leaked after the portal was targeted by hackers in December.

About 90% of those individuals were based in Northland.

The commissioner had found in May that Health New Zealand and Manage My Health “failed in their responsibilities” to have adequate security controls when hundreds of thousands of medical files were stolen in the cyber attack.

The hackers compromised 403,730 Health New Zealand documents and 22,609 documents that had been uploaded by patients.

Now, Commissioner Michael Webster has put the two organisations on notice and set deadlines for them to meet requirements.