Fleur Fitzsimons has renewed calls to the Privacy Commissioner to investigate the impact of cuts to Health NZ's digital services workforce. Photo / Mark Mitchell
Fleur Fitzsimons has renewed calls to the Privacy Commissioner to investigate the impact of cuts to Health NZ's digital services workforce. Photo / Mark Mitchell
The Public Service Association (PSA) said the security breach at ManageMyHealth is a “chilling reminder of how the Government blundered in cutting the jobs of many IT experts safeguarding the public health system”.
In a statement issued this morning, the PSA called the data breach at privately run ManageMyHealth “awakeup call” for the NZ healthcare sector, which Fleur Fitzsimons, National Secretary for the PSA Te Pūkenga Here Tikanga Mahi, called “a ticking time bomb”.
“We have seen it before in the public health system with the Waikato Hospital ransomware attack in 2021 and yet this government failed to heed that lesson in forcing Health NZ to cut the jobs of experts running digital services,” Fitzsimons said.
”The risks are too high to play fast and loose with data systems - it’s a ticking time bomb," she added.
“Like ManageMyHealth, our hospitals are using outdated systems but have lost experts who understand their complexities and weaknesses.”
Patients warned after ManageMyHealth cyber breach exposes medical records. Photo / Supplied
The association has called on the Privacy Commissioner to reconsider his decision to not investigate the impact of cuts to Health NZ’s digital services workforce, in light of the most recent data breach.
“Last year the PSA asked the Privacy Commissioner to investigate the impact of cuts to Health NZ’s digital services workforce but he refused,” Fitzsimons said. ”We call on him to reconsider this given the Manage My Health data breach."
Contacted by the NZ Herald, a spokesperson for the Privacy Commissioner said the commissioner has “ongoing discussions with Health New Zealand around its privacy and personal information responsibilities as part of its regular monitoring relationship” and, for that reason, no investigation has been initiated.
“While the Privacy Commissioner’s first focus is always on supporting agencies with their breach response to minimise the threat to affected individuals, we will expect ManageMyHealth, like any health agency, to be able to demonstrate to the regulator that it had appropriate safeguards in place, and where these were not sufficient, what steps will be taken to prevent such an incident happening again,” the spokesperson added.
‘A very concerning breach of patient data’ - Simeon Brown
Minister of Health Simeon Brown has called the ManageMyHealth breach “a very concerning breach of patient data”.
Brown highlighted that ManageMyHealth is a private platform used by many GP practices across New Zealand.
“ManageMyHealth is a private company responsible for protecting patient data, and it is responsible for this incident. While ManageMyHealth is a private company, it is my expectation that it provides its users, both GPs and patients, with regular and timely information, including whether and how they have been impacted and the steps ManageMyHealth is taking to address this breach,” the minister said.
Director-General of Health Audrey Sonerson and Health Minister Simeon Brown during their appearance before the Health Committee hearing, Parliament, Wellington, New Zealand, December 02, 2025. Photo / Mark Mitchell
A cross-agency Incident Management Team has been established to support ManageMyHealth.
Brown said he has directed officials to provide advice on what can be done to “strengthen assurance around the protection and security of heath data”.
“I expect clear options and advice to maintain public confidence,” he said.
“I have also sought advice on options for an independent review of what has occurred. In the meantime, Health New Zealand is utilising independent cyber security specialist capability to provide further assurance that the vulnerabilities that led to the breach have been addressed.”
ManageMyHealth is New Zealand’s largest patient information portal. Between 6 and 7% of the approximately 1.8 million registered users, up to 126,000 people, may have been impacted by the security breach.
“We now have the complete list of people whose documents may have been accessed and expect forensic confirmation of the documents affected in the coming days,” the company said in a statement.
