The Manage My Health inquiry: what every New Zealand organisation should take from it
- May 27
- 7 min read
On 1 January 2026, Manage My Health Limited told the Office of the Privacy Commissioner that hackers had stolen large amounts of health information from its patient portal. The Commissioner's Phase 1 report, released in May 2026, sets out what went wrong and why.
It is one of the largest known breaches of sensitive personal information in New Zealand's history. It is also one of the more interesting privacy reports the Commissioner has produced, because of what it says about who is responsible when a third party holds your data, what "reasonable security" actually requires, and where the law may be heading.
What stood out
These are the points that struck me most, and a guide to what the rest of this article covers:
Who is responsible when a third party holds the data. The Commissioner found Manage My Health responsible in its own right, because of its direct relationship with patients, rather than only an agent for the GPs and Health NZ.
It reaches well beyond healthcare. The findings apply to any organisation that handles sensitive information or hands it to a third party.
"Reasonable security" is not a low bar. It is measured against how sensitive the information is, and a small provider is not held to a lower standard.
The privacy impact assessments and the contract fell short. The quality of a PIA matters, and the contract was the wrong kind of agreement for the task.
This looks like a turning point. The Commissioner intends to issue compliance notices, and Phase 2 will look well beyond the breach itself.
The law may change. The report recommends making third-party providers directly liable for security, along the lines of the European GDPR.
The human cost was real. Behind the numbers are people whose most sensitive information was exposed.
What happened
The report describes hackers using a patient's stolen but valid login to get into the portal, then exploiting a weakness that let them reach thousands of other accounts and copy files over several days. Multi-factor authentication was available but not required. Manage My Health did not detect the intruders, and only learned of the problem when Health NZ told it the data was being offered for sale.
The Commissioner found that both Manage My Health and Health NZ breached Rule 5 of the Health Information Privacy Code 2020, which requires reasonable security safeguards, and intends to issue both with a compliance notice under section 123 of the Privacy Act 2020. Around 99,416 people were affected, about 91% of them in Northland.
Who is responsible when a third party holds the data?
The most interesting legal question in the report is who legally "held" the information. Under section 11 of the Privacy Act, where a provider holds information on behalf of another organisation, the information is generally treated as held by that organisation, not the provider. So a provider that is only processing data for a client can sit outside direct responsibility.
Manage My Health argued, in effect, that it held the data on behalf of the GPs and Health NZ. The Commissioner did not accept that. The deciding factor was the direct relationship between Manage My Health and the patient: patients self-register, agree to Manage My Health's own terms of use and privacy policy, control their own login, can upload their own records, and decide whether the account stays open. On that basis the Commissioner concluded that Manage My Health held the information in its own right and was directly responsible for its security under Rule 5(1)(a), whatever the source of the data. Even hospital documents, once delivered into a patient's account, were held by Manage My Health, because Health NZ could no longer see or control them.
It is a helpful clarification of how that "holding" test applies to portals and software providers. The Commissioner was also candid that the outcome turned on a close look at how this particular company operates, and that other providers might be treated differently. That is part of the reason the report goes on to recommend changing the law.
It reaches beyond healthcare
IPP5 of the Privacy Act and Rule 5 of the Code are almost identical, and the Commissioner says the findings apply to any organisation that handles sensitive information or engages a third party to handle it. If a provider holds personal information for you, the report is worth a read whether or not you are anywhere near the health sector.
The Commissioner was also clear that this is not a criticism of patient portals. Done well, the report says, they can enhance privacy by giving people better access to and control over their own information.
"Reasonable security" is not a low bar
The report is a useful reminder that "reasonable" security is not the same as basic security. The Commissioner's position is that safeguards must be proportionate to the risk, that the more sensitive the information the stronger the protections expected, and that a small organisation whose business involves high-risk information is not held to a lower standard simply because of its size or because security costs money. As the report puts it, security is a fundamental requirement.
The report also treats security as more than IT settings. It includes organisational controls: due diligence before engaging a provider, fit-for-purpose contracts, governance during a project and after it goes live, risk management, and ongoing testing and review. On governance, the Commissioner noted that the project's steering group included senior leaders but no direct privacy or security representation, which is not what you would expect for a project of that scale and novelty.
The PIAs and the contract fell short
Two findings stood out for me here. The Commissioner reviewed the privacy impact assessments behind the project and described one as "extremely weak". The report says the assessments were generic rather than specific to the actual information flows, did not properly assess how the data would move and be processed, applied some privacy principles incorrectly, and in places repeated the vendor's own assessment. One was finished about a month before the contract was signed and read more like a tick on the sign-off checklist than a tool used to design the project. The Commissioner was careful to say the problem was not the author, but that the work had fallen to someone who had a template and no privacy expertise.
The contract did not fare much better. The Commissioner found it was the wrong kind of agreement: a standard software licence drafted by the vendor, rather than a data-sharing and processing arrangement. It did not clearly describe the information being collected and processed, did not specify the safeguards that would apply, leaned on the vendor's own policies that the vendor could change at will, and contained no incident response or breach notification obligations.
One practical point is worth noting alongside this. Once you commission a test, an assessment or a PIA, you create a record of what you knew and when, and a regulator can later ask to see it. Where that work is genuinely legal advice, it may be possible to protect the candid findings under legal professional privilege, which can make it easier to be honest about weaknesses and then fix them.
Why this one matters
Two things make this report more than a routine breach post-mortem.
First, the Commissioner intends to issue compliance notices to both organisations. Compliance notices have been rare, and on the public record they have gone to public-sector bodies such as the Reserve Bank. A notice to a private company would be a notable step.
Second, this is only Phase 1, and it deals only with the security failure. Phase 2 will look more widely, including whether patients were properly asked to authorise their accounts, whether they were told how the portal would be used, how their information was retained and deleted, and how well the breach was communicated. In other words, a breach can open the door to a much broader look at an organisation's privacy practices.
Where the law may be heading
The report makes two recommendations worth watching. The first is that the Ministry of Health set up a central programme to verify that key health-sector vendors meet relevant security standards, so that organisations are not each left to check the same provider. The second is that the Ministry of Justice amend the Privacy Act so that third-party providers are directly liable for security under IPP5, even when they only process information for someone else. The Commissioner points to Article 32 of the European GDPR as a model, and notes that Australia is considering a similar controller and processor distinction.
If that change happens, the provider that fails would share the legal responsibility, rather than leaving the organisation that engaged it to rely on the contract.
The human cost
It is easy to read a breach like this as a compliance or business issue. The report is a reminder that it happened to people. More than 150 affected people wrote to the Commissioner, and the report records that many described anxiety, stress, embarrassment and anger. Among the experiences it sets out:
one person had stored their entire medical file with Manage My Health when they moved to New Zealand, so the breach exposed every aspect of their health;
Māori correspondents said the loss affected their wider whānau, not only themselves, and had damaged their trust in the health system, with some now more hesitant to seek care;
for several people, the exposure was worsening their PTSD or other conditions;
some feared the disclosure could affect their employment;
many still did not know what had actually been taken, and many had not realised their information was stored in the portal at all.
When security fails, the harm is not abstract. That is the real reason these obligations exist.
A final thought
The Manage My Health inquiry is not a reason to avoid portals or third-party providers. It is a careful look at what goes wrong when an organisation hands sensitive information to a provider and assumes its security is someone else's problem.
If you rely on third-party providers to hold or handle personal information, it is a good prompt to check that your due diligence, your contracts and your governance would stand up to the same questions. I have put together a to help you start.
You can read the Privacy Commissioner's full Phase 1 report here.
Comments