Dear Tairawhiti District Health Board,

I am writing to request information regarding the extent to which the Datix Midland Integrated Quality and Risk system (used for reporting complaints and incidents) was compromised by the cyber attack at Waikato DHB.

I note that Lakes District Health Board, Taranaki DHB, Bay of Plenty DHB and Tairawhiti District Health Boards all use the same was Datix Midland Integrated Quality and Risk system as Waikato DHB, and some of these reports, when entered, are automatically sent to the Health Quality & Safety Commission.

Yours faithfully,

Amy S Van Wey Lovatt

Dear Te Ao Mihiata Paenga-Morgan,

Thank you very much for your response. I am pleased to hear that your agency continued to have access to the regional Datix system. I ask that you please clarify as to whether the incident reports submitted into the regional Datix system (all 5 hospitals) are shared on the same server, which is also shared with the Health Quality & Safety Commissioner. If this is the case, where is the server located? If there is more than one server which holds the regional Datix system reports, where are these servers located?

Yours sincerely,

Amy S Van Wey Lovatt

Dear Te Ao Mihiata Paenga-Morgan,

I also ask if any of the information from the regional Datix system was leaked from the cyber attack at Waikato DHB, which is not the same as whether or not your employees still had access.

Yours sincerely,

Amy S Van Wey Lovatt

Dear Te Ao Mihiata Paenga-Morgan,

I am writing for clarification because the response I received dated 8 October 2021 was not clear.
My Question 1: Please clarify as to whether the incident reports submitted into the regional Datix system (all 5hospitals) are shared on the same server, which is also shared with the Health Quality & Safety Commissioner?

Your Response: Te Manawa Taki District Health Boards have their own shared instance of Datix.

I request for clarification. Are all reports in the regional Datix system located on one server, or multiple servers? Are all reports entered by members of your DHB held locally, on your DHBs servers, or are they also located on servers located at other DHBs and the Health Quality and Safety Commissioner? If there are also located at other DHBs, are they located at Waikato DHB?

My Question 2: Where is the server located? If there is more than one server which holds the regional Datix system reports, where are these servers located?

Your Response: For security reasons, we will not be commenting on our computer systems at this time.

I request the legal reason, as set out in the OIA for refusing me this information. I do not require the specific building within the location, only the general physical location, such as your specific DHB, another DHB, within the MoH in Wellington, or some held by some other third party, such as those providing cloud archive support.

You have stated, "The Datix regional Incident, Quality & Risk system was not impacted as a result of, or during, the Waikato Security Incident." I request a copy of the official investigative report which supports your assertion.

Yours sincerely,

Amy S Van Wey Lovatt

Dear Te Ao Mihiata Paenga-Morgan,

As a follow up, I also request copies of all contracts with suppliers who provide server (physical and cloud service) support for your DHB.

Yours sincerely,

Amy S Van Wey Lovatt