Key Takeaways
- ManageMyHealth has suffered a data breach, with affected users to be contacted in the coming days
- The company has identified and closed the "specific gaps" that allowed hackers to access documents
- Additional security measures have been implemented, including more secure logins and two-factor authentication
- Users are advised to monitor their accounts for unusual activity and report any suspicious behavior
- An incident management team has been established to support ManageMyHealth, and an independent review of the breach is being considered
Introduction to the Data Breach
The recent data breach at ManageMyHealth has raised concerns about the security of patient data in New Zealand. The company has announced that affected users will be contacted in the coming days, following confirmation of forensics and liaison with Public Health Organisations (PHOs) and General Practitioners (GPs) to ensure that individuals receive the right information in line with Privacy Act requirements. This breach has sparked a response from government agencies, with Health Minister Simeon Brown stating that the government is working closely with ManageMyHealth to understand the scope of the breach and protect patient privacy.
Measures to Prevent Future Breaches
ManageMyHealth has taken steps to address the vulnerabilities that led to the breach. The company has identified and closed the "specific gaps" that allowed hackers to access documents, and this fix has been independently tested and verified by external cybersecurity experts. Additionally, logins have been made more secure, and the number of access attempts in a short time has been limited. Users can now authenticate themselves using Google and Microsoft authenticator apps, and can also enable two-factor authentication (2FA) where available, including biometric measures, to add an extra layer of protection to their accounts. These measures aim to prevent similar breaches in the future and provide users with greater control over their account security.
Response from Government Agencies
The government has responded quickly to the breach, with Health Minister Simeon Brown establishing an incident management team to support ManageMyHealth. Brown has also asked for advice from the Ministry of Health on options for an independent review of the breach. The Public Service Association has criticized the government’s handling of IT staff, stating that the incident is a warning to government departments shedding IT staff. The association’s national secretary, Fleur Fitzsimons, said that the risks are too high to play fast and loose with data systems, and that it’s a ticking time bomb. The government’s response to the breach will be closely watched, as it seeks to balance the need to protect patient data with the need to provide efficient and effective healthcare services.
Advice for Affected Users
ManageMyHealth has advised users to monitor their accounts for unusual activity and report any suspicious behavior. Users are warned to keep an eye out for anything unusual, such as medical bills or insurance claims they don’t recognize, or unexpected letters from healthcare providers. If users see anything that looks odd, they are advised to contact the relevant provider immediately. Additionally, users can reset their password or enable two-factor authentication to add an extra layer of protection to their accounts. ManageMyHealth has also set up a dedicated 0800 number and online helpdesk to help affected patients. By taking these steps, users can help protect their personal data and prevent further unauthorized access.
Conclusion and Next Steps
The data breach at ManageMyHealth is a concerning incident that highlights the need for robust cybersecurity measures to protect patient data. The company’s response to the breach, including the implementation of additional security measures and the establishment of an incident management team, is a positive step towards addressing the issue. However, the breach also raises questions about the government’s handling of IT staff and the need for independent reviews of data breaches. As the investigation into the breach continues, it is essential that ManageMyHealth, government agencies, and healthcare providers work together to protect patient data and prevent similar incidents in the future. By prioritizing cybersecurity and transparency, we can build trust in the healthcare system and ensure that patients receive the care they need without compromising their personal data.