Govt commissions review into Manage My Health security breach

Health Minister Simeon Brown has asked the Ministry of Health to review the response to a recent cyber security breach involving Manage My Health, a patient portal used by some general practices across New Zealand.

Manage My Health, which holds medical records and allows patients to communicate with health professionals, confirmed last week that it had detected a cyber security incident involving unauthorised access to its platform.

According to RNZ, hackers have reportedly threatened to release 400,000 documents containing patient information unless the company meets a payment demand by Tuesday.

The Ministry of Health will assess the company’s response and determine any further action required to protect patient data.

“I know this breach will be very concerning to the many New Zealanders who use Manage My Health, and we need assurances around the protection and security of people’s health data,” Health Minister Simeon Brown said in a statement.

Brown added that the patient data is personal and whether it is held by a public agency or a private company, it must be protected to the highest of standards.

“I have decided to commission the Ministry of Health to lead a review of the Manage My Health and Health New Zealand’s response.

Manage My Health platform has also introduced a "FAQs for Cyber Breach" section on their portal to address the concerns of the patients. 

"We recently identified a cyber security incident involving unauthorised access to the Manage My Health platform in New Zealand. We believe the incident has been contained, and we have engaged independent international forensic consultants to further verify the solution we have put in place and determine the extent of the data which is affected," the first section's first question answered. 

Brown said that he has written to the Director-General of Health asking that the review will commence no later than 30 January.

The purpose of the review is three fold:

•   assess the cause(s) of the incident,
•   review the adequacy of the data protections that were in place and the response to the incident, and
•   recommend any improvements required to prevent similar incidents occurring.

While the review is promised to commence as soon as possible, Brown said that the focus continues to be on the immediate response to the incident and that it does not distract from this response. 

An Incident Management Team has been meeting daily to coordinate advice and support across government agencies.

“In the meantime, I expect the Ministry to develop Terms of 

Reference, in consultation with the Government Chief Digital Officer and the National Cyber Security Centre (NCSC), and a timeline for the review process,” he added.

Health New Zealand has confirmed that its own systems have not been affected by the Manage My Health cyber security incident. They are working with primary care providers through General Practice New Zealand (GPNZ) to assess the potential impact on patients and general practices.

General practices remain open and continue to provide services to patients.