Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Focus areas

Print | Email this page

Manage My Health Inquiry

A pregnant woman sits on the couch on her phone. A man sits on the floor in front on his laptop. A cat is on the back of the couch.

Updated 23 September 2026

Issuing of Compliance Notices

Privacy Commissioner Michael Webster has issued both Manage My Health (MMH) and Health NZ with a Compliance Notice for failing to comply (at the time of the cyber attack in December 2025) with the security requirements of rule 5 of the Health Information Privacy Code.

Read the media release.

Read Health NZ's Compliance Notice.

Read Manage My Health's Compliance Notice.

Completion of Phase 1 of the Manage My Health Inquiry

Privacy Commissioner Michael Webster has released the results of Phase 1 of his Inquiry into the Manage My Health cyber incident in December 2025. 

The Privacy Commissioner has found that both Manage My Health and Health NZ failed in their responsibilities to have good enough security in place and that they both breached Rule 5 of the Health Information Privacy Code, relating to the storage and security of information.

New Zealanders rightly expect any agency collecting, holding, using or storing their sensitive health information to maintain high standards of privacy and data protection. Given the Inquiry’s finding, the Privacy Commissioner intends to issue compliance notices to Manage My Health and Health NZ. 

While both Manage My Health and Health NZ have already made changes to their security settings, compliance notices will formally require both of them to complete any necessary remaining work and demonstrate to my satisfaction that all changes are working effectively.

The Inquiry into the Manage My Health cyber incident is being done in two phases and this completes phase 1, which focused on what caused the breach and who was accountable. Phase 2 will focus on the impacts of the breach.

Phase two of the Inquiry is likely to cover:

  • Whether patients were properly asked for authorisation before a MMH account was established for them and information was stored in that account.
  • Whether patients received adequate information about how the portal would be used.
  • Retention and deletion of information within the portal.
  • The quality of communications about the breach.
  • Whether the notifications to OPC and to affected patients met the requirements of the Privacy Act.
  • Whether the breach caused a disproportionate impact on any group, particularly Northland Māori. 

More information about the Manage My Health cyber incident:

Back to top