Key Takeaways
- Over 120,000 patient files on the Manage My Health portal were compromised in a ransomware attack on New Year’s Eve
- The breach has not affected Health NZ systems or other patient portals
- Patients will be notified individually, but the timeframe for notifications has not been confirmed
- Health NZ is working with Manage My Health to ensure clear communication and to prevent similar breaches in the future
- General practices remain open and people can continue to seek care as normal
Introduction to the Cybersecurity Breach
A recent cybersecurity hack has compromised the private health information of over 120,000 patients on the Manage My Health portal. The breach, which was reported to the authorities on New Year’s Eve, has raised concerns about the security of patient data in New Zealand. Despite the breach, general practices remain open and are continuing to provide services as normal. People have been assured that they can continue to seek care without any disruptions. The breach has been reported to the relevant authorities, and an investigation is underway to determine the extent of the damage.
Response to the Breach
Health NZ, the national health agency, has been working closely with Manage My Health to respond to the breach. Jason Power, the national director of planning, funding, and outcomes, has stated that the company has advised that individual patients will be notified about the breach. However, the timeframe for notifications has not been confirmed, and Health NZ expects Manage My Health to share this information by Tuesday. In the meantime, Health NZ is working with primary care providers through General Practice New Zealand (GPNZ) to clarify the potential impact on patients and general practices. The agency has also established an incident management team and is coordinating with other government agencies, including the National Cyber Security Centre and the Police Cyber Crime Unit.
Security Measures and Protections
The breach has highlighted the importance of robust security measures to protect patient data. Health NZ expects Manage My Health, and all other providers of health information systems, to meet the highest standards around system security, with patient safety and privacy a top priority. The agency is working with Manage My Health to ensure that clear communication is provided to patients and general practices impacted by the breach. Health NZ also expects assurance that appropriate protections are in place to avoid any repeat of the breach and that learning from this incident will be rapidly shared across the health system. The agency has confirmed that there has been no impact on Health NZ systems nor any other patient portals.
Support and Communication
Manage My Health has stated that it will provide regular updates on its website and directly through its patient app. The company will also be establishing an 0800 number for concerned and impacted people. General Practice New Zealand (GPNZ) chair Bryan Betty has stated that Primary Health Organisations will continue to work with their general practices in the coming days to assure that queries and concerns are addressed. GPNZ will work alongside Manage My Health and Health NZ to engage and support any patients whose information has been compromised. The support and communication efforts are aimed at minimizing the impact of the breach and ensuring that patients receive the care and support they need.
Conclusion and Next Steps
The cybersecurity breach on the Manage My Health portal has raised concerns about the security of patient data in New Zealand. However, Health NZ and Manage My Health are working together to respond to the breach and prevent similar incidents in the future. Patients will be notified individually, and general practices remain open and continue to provide services as normal. The incident highlights the importance of robust security measures and clear communication in protecting patient data. As the investigation continues, it is essential for healthcare providers and patients to remain vigilant and take steps to protect sensitive information. By working together, it is possible to minimize the impact of the breach and ensure that patients receive the care and support they need.