Source: Privacy Commissioner
Updated 27 May 2026
Completion of Phase 1 of the Manage My Health Inquiry
Privacy Commissioner Michael Webster has released the results of Phase 1 of his Inquiry into the Manage My Health cyber incident in December 2025.
The Privacy Commissioner has found that both Manage My Health and Health NZ failed in their responsibilities to have good enough security in place and that they both breached Rule 5 of the Health Information Privacy Code, relating to the storage and security of information.
New Zealanders rightly expect any agency collecting, holding, using or storing their sensitive health information to maintain high standards of privacy and data protection. Given the Inquiry’s finding, the Privacy Commissioner intends to issue compliance notices to Manage My Health and Health NZ.
While both Manage My Health and Health NZ have already made changes to their security settings, compliance notices will formally require both of them to complete any necessary remaining work and demonstrate to my satisfaction that all changes are working effectively.
The Inquiry into the Manage My Health cyber incident is being done in two phases and this completes phase 1, which focused on what caused the breach and who was accountable. Phase 2 will focus on the impacts of the breach.
Phase two of the Inquiry is likely to cover:
- Whether patients were properly asked for authorisation before a MMH account was established for them and information was stored in that account.
- Whether patients received adequate information about how the portal would be used.
- Retention and deletion of information within the portal.
- The quality of communications about the breach.
- Whether the notifications to OPC and to affected patients met the requirements of the Privacy Act.
- Whether the breach caused a disproportionate impact on any group, particularly Northland Māori.
More information about the Manage My Health cyber incident:
Original source: https://nz.mil-osi.com/2026/05/27/manage-my-health-inquiry/