133 Molesworth Street
PO Box 5013
Wellington 6140
New Zealand
T+64 4 496 2000

18 November 2021

Cody C

By email:  [FYI request #17287 email]
Ref:
H202114757

Tēnā koe Cody

Response to your request for official information

Thank you for your request under the Official Information Act 1982 (the Act) on 21 October 2021
for information related to Valentia technologies. Please find a response to each part of your
request below:

I understand that a number of Valentia technologies have had cyber security issues /
breaches or otherwise lapses and that the Minister is aware of this matter yet has not
commented publicly on this. Please supply all documents and correspondence with
Valentina regarding these breaches.

The Ministry of Health (the Ministry) has identified one document within the scope of this part of
your request. This document is attached as Document 1 and is a compilation of email
correspondence between the Ministry and Valentia Technologies. Please note, only
correspondence directly between the Ministry and Valentia Technologies has been deemed in
scope and emails deemed out of scope have been removed accordingly.

Is the Ministry providing any API connectivity or other data products to Valentia? If so, why
given that the products are understood to be vulnerable? If not, when did this stop and
why?

There are application programming interface (API) connections to the Ministry’s Valentia
solution, all of which have undergone a formal security assurance process prior to being
implemented.

Has the Ministry, or Valentia (to your knowledge), notified the Privacy Commissioner of
any breaches related to Valentia technologies?

The Ministry has not notified the Office of the Privacy Commission of any breaches related to
Valentia Technologies. We understand that Canterbury District Heath Board notified the Office
of the Privacy Commission of a breach relating to their vaccine booking system.

What did the Minister know?

On 29 October 2021, this part of your request was transferred to the Office of the Minister of
Health, Hon Andrew Little in accordance with section 14(b)(ii) of the Act. You can expect a
response to this part of your request from the Office of the Minister of Health in due course.

Under section 28(3) of the Act, you have the right to ask the Ombudsman to review any
decisions made under this request. The Ombudsman may be contacted by email at:
[email address] or by calling 0800 802 602.

Please note that this response, with your personal details removed, may be published on the
Ministry of Health website at: www.health.govt.nz/about-ministry/information-releases.

Nāku noa, nā

Shayne Hunter
Deputy Director-General
Data and Digital
Page 2 of 2

1982
ACT
INFORMATION
OFFICIAL
THE
UNDER
RELEASED

Document Outline