Review Ordered After ManageMyHealth Cyber Security Breach Raises Patient Data Concerns

For many New Zealanders, logging into a health portal has become as routine as checking email. Test results, prescriptions, private messages with doctors, all stored digitally, all assumed to be safe. That assumption was shaken this week after a cybersecurity breach involving ManageMyHealth, prompting the government to order a formal review into how patient data was protected and how authorities responded.

The New Zealand Government has ordered a review into how a recent cybersecurity breach involving ManageMyHealth was handled. The decision follows growing concern about the safety of patient health data.

Health Minister Simeon Brown confirmed that the Ministry of Health will lead the review. The review will examine what caused the breach and whether the response met expected standards.

ManageMyHealth operates as a private online patient portal. Many general practices across New Zealand use it to help patients access medical records, book appointments, and communicate with health professionals. Although the government does not run the platform, it stores highly sensitive personal health information.

Why this breach matters

Health data is among the most personal information people share. It can include diagnoses, prescriptions, test results, and private conversations with doctors.

Because of this, cyber breaches involving health information carry serious risks. Unlike passwords or bank cards, people cannot easily replace medical data once it is exposed. As a result, any breach can damage trust in digital health systems.

For this reason, the Minister said both public agencies and private companies must protect patient data to the highest standard.

What the review will examine

The review will focus on three key questions.

First, it will identify what caused the cyber incident.
Second, it will assess whether the data protections in place were strong enough.
Finally, it will evaluate how organisations responded once the breach occurred.

After completing this work, the review will recommend steps to prevent similar incidents in the future.

The Minister has asked the Ministry of Health to begin the review by 30 January. However, he stressed that agencies must continue focusing on the immediate response before shifting attention to longer-term analysis.

How the government is responding now

At present, an Incident Management Team meets daily across government agencies. This team coordinates advice, support, and information sharing related to the breach.

Meanwhile, the Ministry of Health is preparing the Terms of Reference for the review. It is doing this in consultation with the Government Chief Digital Officer and the National Cyber Security Centre. This approach aims to ensure strong technical oversight from the start.

Impact on health services and patients

Health New Zealand has confirmed that the breach did not affect its systems. At the same time, it is working with primary care providers to understand the potential impact on general practices and patients who use ManageMyHealth.

Importantly for the public, general practices remain open and continue to provide care. Authorities have reported no disruption to frontline health services.

What this means for digital health in New Zealand

This incident highlights a wider issue facing health systems worldwide.

As healthcare relies more on digital platforms, private technology providers play a bigger role in delivering public services. However, this also raises questions about accountability and oversight.

For example:

• Who takes responsibility when private platforms fail?
• Do cybersecurity
  • standards remain consistent across providers?
• How quickly should patients receive clear information?

The government review is expected to address these questions and clarify responsibilities across the digital health sector.

What happens next

For now, officials will continue managing the immediate response while preparing the review. Once completed, the findings are likely to influence future rules and standards for digital health platforms.

For patients, the message is clear. Health services continue to operate as normal. At the same time, the government expects stronger safeguards to protect personal medical information in the future.