Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Print | Email this page

Final report into Manage My Health inquiry a wake-up call for agencies

A white couple, a man and a woman, sit on the couch with a cat. They are wearing white t-shirts and black trousers. The man is on a laptop. Privacy Commissioner Michael Webster has today released his second and final report into the Manage My Health (MMH) cybersecurity breach of December 2025. 

“The impact that this breach had on people should be a major wake-up call for agencies about how they handle personal information”, he said.

“What we learnt from the Manage My Health cyber breach reinforces what we say constantly; that agencies need to understand what information they collect and hold, why they need it and how they’re handling it. They also have to have a well-established plan in place for dealing with privacy breaches. 

“It’s going to be a lot more stressful for your customers and your staff if you have to create your crisis management playbook as you respond to the crisis”, said the Privacy Commissioner.  

“A good plan can’t anticipate everything but it lets you swing into action more quickly, and respond to your customers with clear and speedy information and support.”

The Privacy Commissioner has called out the activities below as being especially important for all agencies – not just those in the health sector – to get right. 

 

Managing customer accounts well
If a customer does not complete a registration process (for instance by setting a password or activating their account), they have not authorised any further collection and storage of information in that account.

Any agency that is relying on authorisation as a legal basis for collecting, using or disclosing personal information, should ensure that information provided to individuals is clear and precise so that they fully understand what they’re being asked to agree to. 
 

Clear processes for dormant accounts and accounts of deceased people
All agencies that operate customer accounts should have a process to identify and manage ‘dormant accounts’. The Office of the Privacy Commissioner generally expects agencies to check in with an account holder after 12 months of inactivity to see whether they wish to retain the account, unless there is a specific law or reason requiring retention.

Agencies should have a clear process for personal representatives to follow when an account holder has died, and should make sure that representatives can find information about what to do.
 

Managing privacy breaches well
All agencies should refresh their understanding of when a breach is notifiable under the Privacy Act, including making sure that they properly understand the ‘serious harm’ threshold. 

Not having good processes to identify affected people or to assess and manage breaches is not an excuse for delaying notification. A ‘reasonable timeframe’ for notification is determined not only by what the agency could do, but what a reasonable agency should have been able to do in the circumstances. 
 

Which agency is responsible for information when using third parties
If an agency that is processing information on behalf of another agency makes a design decision that wasn’t agreed to by that other agency, it will be independently responsible for complying with the relevant privacy principles.

The effect on the Northland community 

While the December 2025 breach created significant anxiety for people around New Zealand, the report recognises that it was the people of Northland and the GP practices that support them who have borne the brunt of it. 

“Ninety percent of people hit by Manage My Health’s breach were Northland hospital patients, which means there has been a disproportionate impact on Māori patients, whānau and health services in that region,” the Privacy Commissioner said. 

The report looks closely at the impact on those affected people as well as their GP practices, and makes recommendations for steps that Health NZ and MMH should take to restore trust and confidence in using portals and health services in Northland, particularly from a te ao Māori perspective. 

“This incident shows that people’s suffering goes beyond having documents stolen”, said the Privacy Commissioner. 

“For example, patients who had highly sensitive information in the Manage My Health portal (including records of sexual assault, family harm, and justice involvement) were at risk of re-traumatisation because of the breach, even if those records were not affected at all. 

“In addition, the initial uncertainty about what had and had not been accessed by the hackers created extra distress,” said Mr Webster.

The breach has significantly damaged trust in health portals, which are a small but vital part of the modern health information environment. 

“GP practices, Primary Health Organisations, and GP peak bodies have reported that some patients have started requesting physical rather than digital copies of information. 

“Some patients are also now more wary of using portals or other digital technologies, even if they were not themselves impacted by the breach,” said Mr Webster.

The completion of phase 2 marks the end of the Inquiry into the Manage My Health breach. Phase 1 of the Inquiry found both Health NZ and Manage My Health breached the Privacy Act, leading to both agencies being issued with compliance notices. These will be managed as stated in the notices. 

We have also received around 50 complaints, which we will also manage as part of our normal dispute resolution processes.

Read the Phase 2 report (opens to PDF, 901KB).

Read the Executive Summary of the report.

Catch up on information about the Manage My Health cyber attack in our Focus Area.

Back to top