Key Takeaways
- ManageMyHealth, a patient data app, has confirmed a security incident involving unauthorized access to its platform, potentially affecting 6-7% of its 1.8 million registered users.
- The company claims to have fixed the flaws in its code, with independent confirmation from IT experts, and has implemented additional security measures, such as two-factor authentication and limited access attempts.
- Affected users will be contacted in the coming days, and the company has set up a dedicated 0800 number and online helpdesk to provide support.
- The government is working closely with ManageMyHealth to understand the scope of the breach and protect patient privacy, with the Health Minister considering an independent review of the incident.
Introduction to the Security Incident
The operators of ManageMyHealth, a patient data app, have announced that they have received independent confirmation from IT experts that the flaws in its code have been fixed. This comes after the company confirmed a security incident involving unauthorized access to its platform, which may have affected between 6 and 7 percent of its approximately 1.8 million registered users. The incident has raised concerns about the privacy and security of patient data, and the company has been working to address the issue and prevent similar incidents in the future.
Scope of the Breach
According to ManageMyHealth, only one part of the app, Health Documents, was accessed by hackers, and not the whole app. The company has stated that it now has the complete list of people whose documents may have been accessed and expects forensic confirmation of the documents affected in the coming days. Affected users will be contacted in the coming days, following confirmation of forensics and liaison with Primary Health Organizations (PHOs) and General Practitioners (GPs) to ensure that individuals are getting the right information, in line with Privacy Act requirements.
Security Measures
The company has taken steps to enhance the security of its platform, including identifying and closing the specific gaps that allowed hackers to access documents. The fix has been independently tested and verified by external cybersecurity experts. Additionally, logins have been made more secure, and the number of access attempts in a short time has been limited. Users can now authenticate themselves using Google and Microsoft authenticator apps, and the company has encouraged users to reset their passwords or enable two-factor authentication (2FA) to add an additional layer of protection to their accounts.
Government Response
The government has been working closely with ManageMyHealth to understand the scope of the breach and protect patient privacy. Health Minister Simeon Brown has stated that an incident management team has been established to support ManageMyHealth, and he has asked for advice from the Ministry of Health on options for an independent review of what occurred. The Minister has also assured that there is no evidence that any Health NZ systems, including My Health Account, have been compromised, as ManageMyHealth has separate systems.
Criticism and Concerns
The Public Service Association has criticized the government for shedding IT staff, citing the incident as a warning. The association’s national secretary, Fleur Fitzsimons, has stated that the risks are too high to play fast and loose with data systems, and that the incident is a ticking time bomb. The association has pointed to the Waikato Hospital ransomware attack in 2021 as an example of the consequences of underresourcing IT systems.
Support for Affected Patients
ManageMyHealth has set up a dedicated 0800 number and online helpdesk to provide support to affected patients. The company has encouraged users to be vigilant and to report any unusual activity, such as medical bills or insurance claims that they do not recognize, or unexpected letters from healthcare providers. Users can also take steps to protect their accounts, such as resetting their passwords or enabling two-factor authentication. The company has assured that it is working with the police, Health NZ, and the privacy commissioner to address the incident and prevent similar incidents in the future.