19 March 2025
Rodney Parsons
[FYI request #29460 email] Tēnā koe Rodney
Your request for official information, reference: HNZ00074210
Thank you for your email on 5 December 2024, to Health New Zealand | Te Whatu Ora under the
Official Information Act 1982 (the Act). Please find a response to your email below.
Response
MedTech is New Zealand's largest Practice Management System, and thereby directly and
indirectly funded by Health New Zealand, nationally.
MedTech is used by General Practitioners (GPs). GP practices are generally 50% funded by
government through capitation and 50% funded by patient fees, and therefore retain autonomy to a
degree regarding how their practices are managed. There are 13 instances directly funded by
Health NZ, all such arrangements were made by the former District Health Boards and we do not
hold information about these instances centrally.
MedTech's data management system involves central aggregation of data. Outline what
data is stored, what MedTech does with this data, whether the monetisation of this data is within
the scope of HNZ's arrangements with MedTech, what steps are taken to ensure this data is kept
private and secure, and not sold for commercial purposes such to pharmaceutical companies.
Outline what steps HNZ takes to ensure New Zealanders are informed that their data is being used
for commercial purposes, from the MedTech platform.
Health NZ’s contractual relationship with MedTech is minimal, as in most cases GPs are the
contract holders, as noted above.
Questions about Medtech’s use of that data should be addressed to Medtech directly. Health NZ is
unable to comment regarding the controls they apply to the data.
Health NZ has a role at a high level, set out in the Primary Health Organisation Services
Agreement (PHOSA) and service specifications we set with Primary Health Organisations (PHOs),
who then in turn carry back-to-back agreements with GPs.
This part of your request is therefore refused under s 18(g), as Health NZ does not hold
information about the security and privacy of data in MedTech’s systems. You can read more
about PHOSA here
Primary Health Organisation Services Agreement – Health New Zealand | Te
Whatu Ora
Outline any accreditation, audits or assessments that Health New Zealand has undertaken
on this software since Health New Zealand began (2022).
Health NZ does not audit or assess private practices, that role sits with PHOs. This part of your
request is refused under s 18(e), as the information does not exist.
A previous request to Ministry of Health and ACC outlines some important questions that
were successfully sidestepped by both parties:
Valentia Technologies administer multiple digital health functions within Health New
Zealand, or by contracted third parties.
Provide risks assessments and reviews of the known vulnerabilities arising from these
systems, as well as any plans to address these vulnerabilities. If HNZ is unaware of any
vulnerabilities or does not contain information on these vulnerabilities, please indicate what steps
HNZ has taken to ascertain this- process and areas discovered. HNZ does manage these systems,
so understanding why you would refuse or don't hold the information will be important to resolving
this request.
In general, Health NZ is unable to release specific detail in response requests for information
relating to risk and vulnerabilities. This part of your request is refused under section 9(2)(c) of the
Act, to avoid prejudice to measures protecting the health or safety of members of the public.
Provide an indication of the impact that the current change program in HNZ's digital health
area, will have on addressing these vulnerabilities.
No decisions on the proposal have yet been made. Please note that the Act does not require an
agency to form an opinion or create new information to answer a request. This part of your request
is therefore refused under section 18(g) of the Act.
How to get in touch
If you have any questions, you can contact us at
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz or
by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may proactively
release a copy of this response on our website. All requester data, including your name and
contact details, will be removed prior to release.
Nāku iti noa, nā
Ed Falloon
Acting Director Sector Digital Channels
Data & Digital
TeWhatuOra.govt.nz
Health NZ, PO Box 793,
Wellington 6140, New Zealand
