Brown orders review into ManageMyHealth cyber breach

Health Minister Simeon Brown has ordered a government review into the response to a cyber security breach involving the privately operated patient portal Manage My Health, which holds medical information for patients at general practices across New Zealand.

Brown said the incident would be deeply concerning for the many New Zealanders who use the service, stressing that health information is highly personal and must be protected to the highest possible standard, regardless of whether it is held by public agencies or private providers.

He has commissioned the Ministry of Health to lead a review examining both Manage My Health’s handling of the breach and the response from Health New Zealand. The review will assess the causes of the incident, examine the adequacy of existing data protections and incident response, and recommend improvements to prevent similar events in the future.

Brown has asked that the review begin no later than 30 January, while emphasising that immediate incident response efforts must remain the priority. An Incident Management Team has been meeting daily to coordinate advice and support across government agencies.

The Ministry of Health has been directed to develop formal terms of reference and a review timeline, in consultation with the Government Chief Digital Officer and the National Cyber Security Centre.

Health New Zealand has advised that its own systems have not been affected. It is working with primary care providers through General Practice New Zealand to clarify any potential impact on patients and general practices, which remain open and continuing to provide services.