Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach
New Zealand's Privacy Commissioner has given Manage My Health and Health New Zealand until next year to comply with health privacy rules following a massive data breach in December 2025 that affected nearly 100,000 individuals, predominantly in Northland. The commissioner found both organizations failed in their responsibilities to have adequate security controls, leading to the compromise of hundreds of thousands of medical files. The notices require improvements in multifactor authentication, user access, and external access controls.
Why it matters
This incident underscores the critical importance of data security in healthcare, especially for sensitive patient information, and highlights regulatory actions taken to enforce privacy standards after significant breaches. It also raises concerns about the disproportionate impact on specific communities, like Māori in Northland, and the need for robust systems to protect vulnerable populations.
Manage My Health's patient portal was hacked in December 2025. Photo / RNZ, Finn Blackwell
The Privacy Commissioner has given Health New Zealand and patient portal Manage My Health until next year to comply with health privacy rules after a massive data breach last year.
Almost 100,000 individuals had data leaked after the portal was targeted by hackers in December.
About 90% of those individuals were based in Northland.
The commissioner had found in May that Health New Zealand and Manage My Health “failed in their responsibilities” to have adequate security controls when hundreds of thousands of medical files were stolen in the cyber attack.
The hackers compromised 403,730 Health New Zealand documents and 22,609 documents that had been uploaded by patients.
Now, Commissioner Michael Webster has put the two organisations on notice and set deadlines for them to meet requirements.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in