Were you expecting a bomb? The Privacy Commissioner has one.

Anybody following the Manage My Health breach from earlier this year would not have been surprised by the Privacy Commissioner's announcement in late September. 

The OPC has been widely expected to issue compliance notices to both Health New Zealand and Manage My Health arising from the findings of the Commissioner’s Phase 1 Report in May 2026 into the incident. These duly arrived on 23 September, and the bomb dropped into the sector apparently creating hardly a ripple. 

This has been signalled well in advance in both general and specific terms. The Commissioner has himself been a regular presence at conferences and in publications indicating that a tightening of expectations is happening. In this the commissioner is well supported by industry which gave an unequivocal statement in August of the growing cyber risk due to AI. Health NZ has been issuing guidance to primary care organisations which seems to signal a tightening of compliance requirements even within current contracts. 

It remains to be seen if anyone is paying sufficient attention to what all of this means. 

The MMH breach affected approximately 99,416 people, around 91% of whom were Health NZ patients in Northland. More than 403,000 Health NZ documents were compromised. The Commissioner also identified a likely disproportionate impact on Māori. 

Health New Zealand Compliance Notice

 

The Privacy Commissioner’s finding against Health New Zealand – Te Whatu Ora carries a clear message for health sector leaders: responsibility for protecting patient information continues when that information is entrusted to a technology provider. 

Following the MMH breach, the Commissioner found that Health NZ breached Rule 5(1)(b) of the Health Information Privacy Code 2020. Its shortcomings in supplier assessment, governance, risk management and contracting contributed to the breach. A formal compliance notice now requires corrective action. 

The findings describe weaknesses that should concern anyone responsible for digital health investment. Due diligence was insufficient, privacy assessments were inadequate, and the project steering group lacked direct privacy and security representation. There was no evidence that specialist advice had been sought early enough to properly influence design. Contracts lacked appropriate protections for patient information. 

For its replacement service to distribute hospital discharge information, Health NZ must strengthen governance, undertake assessments independent of suppliers, obtain security assurance and introduce enforceable contractual protections. These include audit rights, incident notification and ongoing assurance reporting. Required actions are due by 29 January 2027, with evidence supplied to the Commissioner by 12 February 2027. Failure to comply could lead to enforcement proceedings. 

For other organisations, the practical lesson is to examine how supplier assurances are tested and maintained throughout a contract. Leaders need to understand where sensitive information goes, who can access it, and what evidence demonstrates that safeguards work. Privacy and security expertise needs to influence procurement and design from the outset. 

The notice applies specifically to Health NZ’s replacement project; it does not automatically impose identical requirements on every organisation. However, the findings provide a useful basis for reviewing third-party arrangements across the health sector. The Commissioner has also recognised that smaller providers need practical support, recommending central verification of patient portal security rather than expecting every general practice to undertake separate technical testing. 

Manage My Health Compliance Notice 

Similarly, Manage My Health faces a mandatory programme of security improvements following the Privacy Commissioner’s finding that it failed to adequately protect sensitive patient information. The compliance notice requires the company to demonstrate that its safeguards are effective, with evidence and assurance extending through August 2027. 

The Commissioner found that MMH breached Rule 5(1)(a) of the HIPC.  

The inquiry identified weaknesses across authentication, access controls, web security, vulnerability management, software development, monitoring and data leak prevention. Together, these deficiencies allowed attackers to obtain sensitive information without effective detection and intervention. 

The notice sets a staged timetable. Logging, monitoring and data loss prevention improvements must be implemented by 30 November 2026, with evidence provided by 22 January 2027. Vulnerability management and secure development requirements must be met by 26 February 2027, with evidence due by 26 March. A further security testing report is required by 31 August 2027. Failure to comply or provide the required evidence could lead to enforcement proceedings before the Human Rights Review Tribunal. 

For MMH, this means sustained investment in security capability, testing, governance and assurance. The Commissioner has not estimated the cost, but considers the expenditure necessary to meet fundamental obligations for protecting health information. Commercially, the company can also expect customers to seek stronger evidence of security performance when reviewing their arrangements. 

The Commissioner acknowledges MMH’s cooperation and improvements already made, including multifactor authentication, identity management and web security controls. However, at the time of the notice, those changes had not been independently verified by the Commissioner. Some stolen information had been published on the dark web, creating lasting consequences for affected patients. 

So what? 

Rule 5 (1) is about reasonable safeguards. The distinction between the sub clauses is MMH’s responsibility to secure the information it held, and Health NZ’s responsibility to ensure appropriate protection when entrusting information to a third party.  

An easier way to think about it is due diligence. You can choose not to read a contract before you sign it, or click the "Accept " button when you install a piece of software, but not knowing your privacy obligations does not excuse failing to meet them. Organisations handling sensitive health information are responsible for understanding those obligations and ensuring they are met, including when they entrust that information to a technology provider. 

For digital health providers and importantly also for those that purchase from them, the lesson is practical: security needs to be demonstrated through everyday operations. Finding vulnerabilities, fixing their underlying causes, detecting unusual activity and verifying that controls work are continuing responsibilities. Rebuilding confidence will depend on reliable evidence that patient information is being protected.  

In plain language: keep patient information safe, including when someone else handles it on your behalf. 

According to OPC, one in five Kiwis actively disagree that organisations holding their data are serious about protecting their privacy rights. That may sound like a small minority, but small minorities have a habit of strongly influencing the majority when they are sufficiently energised by an issue. The more software vendors and their customers downplay or ignore the increasing risk of cyber breaches the more likely this is to happen.