Privacy regulator issues final report on Manage My Health cyber breach

Recommendations regarding MMH

In the final report, the OPC encouraged MMH to: 

• Reduce the dormant account process for patients associated with an active practice to 12 months to align with the process for fellow dormant accounts and to abide by r 9 of the Health Information Privacy Code 2020 
• Remove any non-activated accounts after three months with a process akin to that for dormant accounts, also in compliance with r 9 
• Do full user-testing with patients and practitioners so that documents can give clear information on individual rights and obligations 

Recommendations for Health NZ

The OPC’s final report called on Health NZ to: 

• Focus on directly engaging with the Northland community and health providers, including Māori health providers and end users, when carrying out the action plan 
• Explicitly include Māori data governance considerations in its procurement processes and in the terms of any contracts with vendors seeking to provide Northland health portal services as part of the new solution 

Broader recommendations for agencies

“The impact that this breach had on people should be a major wake-up call for agencies about how they handle personal information,” Webster said in the news release. 

The privacy commissioner urged agencies within the health sector and all other agencies to: 

• Manage customer accounts well, including by obtaining clear and precise authorisation for collecting, using, or disclosing personal information 
• Manage privacy breaches properly, including by refreshing their understanding of notifiable breaches under the Privacy Act 2020 
• Implement clear processes for dormant accounts and the accounts of deceased individuals 

“What we learnt from the Manage My Health cyber breach reinforces what we say constantly; that agencies need to understand what information they collect and hold, why they need it and how they’re handling it,” Webster said. 

Responsibility of third parties

According to the privacy commissioner, if a third-party agency processes information on another agency’s behalf, the third party shall be independently responsible for respecting the pertinent privacy principles if it made a design decision to which the other agency did not consent. 

Impacts on those in Northland

The final report acknowledged the consequences of the MMH cyber incident on Northland’s community and the general practices (GPs) that serve them. 

“Ninety percent of people hit by Manage My Health’s breach were Northland hospital patients, which means there has been a disproportionate impact on Māori patients, whānau and health services in that region,” Webster said in the OPC’s news release. 

Events following cyber attack

On 21 January 2026, Webster confirmed that he would be launching an inquiry under s 17(1)(i) of the Privacy Act to look into the December 2025 cyber incident. On 27 January 2026, Webster published the terms of reference for his inquiry. 

On 27 May 2026, as part of the results of the first phase of his independent inquiry into the incident, Webster found that MMH and Health NZ breached the Privacy Act, leading to the issuance of compliance notices. 

Enjoy this story? Read the latest TMT (telecoms, media, technology) news on the main page!