MoH investigation into Waikato DHB cyber attack still months away

An investigation into the cyber attack at Waikato Hospital seven months ago is unlikely to start until next year. Photo / Alan Gibson

An independent investigation by the Ministry of Health into the cyberattack on Waikato DHB's IT system won't start until next year.

The Waikato DHB has also commissioned an external forensic review of its digital systems during the time of the cyberattack on May 18 - but those initial findings also remain a secret for now.

The ministry's review will look into what caused the cyber attack and whether it could be repeated at the Waikato DHB or any other DHB.

But the outcome is still likely to be months away given the terms of reference, costs and the third party commissioned to carry out the work are not even expected to be confirmed until later this month.

"It was always intended the review be commissioned once most of the affected IT networks and systems were fully reinstated, so the respective terms of reference, and associated costs, are yet to be finalised," a MoH spokesperson said.

In the meantime the MoH gave all 20 DHBs specific information to increase the resilience of their systems and that has been completed.

While attempted cyberattacks were a constant threat, the vast majority were preventable and did not affect IT networks and systems providing healthcare to New Zealanders, the spokesperson said.

A Waikato DHB spokesman told the Herald the "majority" of its systems were back up and running and clinical services were no longer affected.

Waikato DHB had been waiting until Covid restrictions eased and vendors could travel into the region to fix "several very minor areas". This included a test environment used by the clinical records team which automated scanning and filing of paper documents which required an upgrade.

The DHB had been working to address any backlogs in several ways, including increased outsourcing, increased theatre time, evening and weekend procedures to catch up on the surgeries and appointments cancelled due to its IT systems being down for weeks, he said.

They could not give a date when waitlists would be cleared as the DHB's capacity had also been affected by Covid-19 alert levels and related restrictions.

However, they were able to maintain 80 per cent of normal activity levels over the two months following the outage.

The Office of the Privacy Commissioner was waiting on the Waikato DHB's own external forensic review of its digital systems to be completed before deciding whether to carry out its own investigation into the cyberattack,

"Once this has been completed, we will be looking for assurance from Waikato DHB that the causes of the breach are well understood, and that any necessary improvements have been, or are being, put in place," a spokesperson said.

Waikato DHB confirmed the initial findings of the forensic review had been received, but has not provided any further details about it at this stage.

NZ Police Cyber Crime Unit is also undertaking its own ongoing investigation into the cyberattack.