“Out there somewhere is personal information that my family doesn’t even know.”
She noted she had been so cautious of sharing her personal information, she didn’t even have internet banking.
“There is a reason I don’t have apps on my phone, but they told me I could trust it [ManageMyHealth],” she said.
“Doctors can’t be touting stuff if they’re not certain it’s safe. They’re supposed to be people who people can rely on.”
Jane is one of about 127,000 people whose health records have been compromised in the attack, which ManageMyHealth became aware of on December 30.
The attacker allegedly demanded the company pays a US$60,000 ($104,000) ransom by 5am today to avoid the data being distributed.
ManageMyHealth is issuing daily updates, but is declining to answer the Herald’s questions, including around what’s happened to Jane’s documents, whether it’s negotiating with the hacker, and whether it’s been audited by a government entity.
The portal, which has 1.85 million users in New Zealand, works in conjunction with one of the two main operating systems GP clinics use. Medical practitioners use it to share information with their patients – including notes from appointments, test results and prescription information.
Jane believed personal health-related photos were among the documents that have now disappeared from the portal.
Some data breach victims have heard from their clinics, but not ManageMyHealth. However, Jane had only heard from the latter.
She was incensed by its communications ironically being headed, “private and confidential”.
Jane hadn’t contacted ManageMyHealth to ask where her documents had gone.
The Herald has heard a report of the 0800 number ManageMyHealth has given victims being clogged and not connecting to an operator.
“I don’t trust them,” Jane said.
“They’re going to cover their asses … They’re in PR mode.”
ManageMyHealth hasn’t said anything in its daily updates about people’s files going missing.
On Thursday, it said it was still in the process of contacting those whose data had been breached.
“The issue now is, who’s going to take accountability?” Jane questioned.
Health Minister Simeon Brown has distanced the Government from the saga, saying ManageMyHealth was responsible for keeping the data safe.
He directed the Ministry of Health to do a review in the wake of the breach.
The Office of the Privacy Commissioner wants the Privacy Act to be strengthened, as there is no civil penalty regime for organisations that fail to protect personal information.
Health New Zealand hasn’t responded to the Herald’s questions about the oversight it has of companies like ManageMyHealth that provide key services to the health sector.
Health New Zealand issues providers with detailed IT guidelines, but hasn’t told the Herald if it has audited ManageMyHealth.
In terms of accountability provided by ManageMyHealth’s governance structure, it only has two directors, one of whom is its chief executive and sole owner (via another company) – Vino Ramayah.
It is establishing an advisory board to provide it with support in the wake of the attack.
Jenée Tibshraeny is the Herald’s Wellington business editor, based in the parliamentary press gallery. She specialises in government and Reserve Bank policymaking, economics and banking.
- Stay ahead with the latest market moves, corporate updates, and economic insights by subscribing to our Business newsletter – your essential weekly round-up of all the business news you need.
