The Ministry of Health has been asked to carry out a review into how a recent cyber attack on ManageMyHealth was handled, following concerns that the personal information of tens of thousands of New Zealanders may have been compromised.
ManageMyHealth is a privately operated online portal used by some general practices to communicate with patients. The cyber attack occurred on December 29 and is believed to have potentially exposed the data of around 126,000 users.
Health Minister Simeon Brown says, “We need assurances around the protection and security of people’s health data.” Photo / Mark Mitchell
At this stage, ManageMyHealth has not yet notified individuals whose information may have been affected by the breach.
Health Minister Simeon Brown has commissioned the review, instructing the Director-General of Health to ensure it begins before the end of the month. The review will examine what caused the breach, whether appropriate data protection measures were in place, and how the incident was responded to. It will also make recommendations to help prevent similar breaches in the future.
Brown acknowledged the concern the incident will cause for many users of the platform, stressing the importance of safeguarding sensitive health information.
“I know this breach will be very concerning to the many New Zealanders who use ManageMyHealth, and we need assurances around the protection and security of people’s health data,” he said.
“Patient data is incredibly personal and, whether it is held by a public agency or a private company, it must be protected to the highest of standards.”
While the review is expected to get underway as soon as possible, Brown said the immediate priority remains managing the response to the incident itself.
The attackers are understood to have demanded a ransom of $60,000. In response, an Incident Management Team has been meeting daily to coordinate advice and support across government agencies.
Brown said the Ministry of Health is expected to develop clear terms of reference for the review, in consultation with the Government Chief Digital Officer and the National Cyber Security Centre, as well as establish a timeline for the process.
Health New Zealand has confirmed the breach has not affected its systems. It is working alongside primary care providers, through General Practice New Zealand, to better understand the potential impact on patients and general practices. Clinics remain open and continue to provide services as usual.TIN Bureau