GP Security Reviews
Marcus made this Official Information request to Ministry of Health
This request has an unknown status. We're waiting for Marcus to read recent responses and update the status.
From: Marcus
Dear Ministry of Health,
Back in April 2024, an OIA was submitted to the Office of Dr Shane Reti querying about any "audit findings, documents, and emails pertaining to the security of Medtech and
ManageMyHealth".
This request was deemed to be more relevant to Te Whatu Ora (Health New Zealand) and was transferred as HNZ00043507.
The following answer was given:
> To the best of our knowledge, Health NZ does not hold audit findings or similar.
> Around five years ago or so, the Ministry of Health undertook security reviews of general
practice systems, which may have included Medtech and ManageMyHealth (MMH). Health NZ does not have access to these reviews.
Given the recent data breach affecting ManageMyHealth, I would like to request a copy of each of these security reviews.
Presumably there is a final report containing findings and recommendations which would be the ideal form but please let me know if these reviews exist in a different shape.
I also acknowledge that the 20 working days target won't begin until January 15th as defined in the Official Information Act
Yours faithfully,
Marcus
From: OIA Requests
Kia ora,
The Ministry of Health closedown period is between 23 December 2025 to 7
January 2026. During this time this inbox will not be monitored. We will
respond to your email upon our return.
Have a safe and happy holiday period.
OIA Services Team
Ministry of Health | Manatū Hauora
show quoted sections
From: OIA Requests
Tçnâ koe Marcus,
Thank you for your request under the Official Information Act 1982 (the
Act) to the Ministry of Health – Manatû Hauora on 2 January 2026. You
requested:
"Back in April 2024, an OIA was submitted to the Office of Dr Shane Reti
querying about any "audit findings, documents, and emails pertaining to
the security of Medtech and ManageMyHealth."
This request was deemed to be more relevant to Te Whatu Ora (Health New
Zealand) and was transferred as HNZ00043507.
The following answer was given:
To the best of our knowledge, Health NZ does not hold audit findings or
similar.
Around five years ago or so, the Ministry of Health undertook security
reviews of general practice systems, which may have included Medtech and
ManageMyHealth (MMH).
Health NZ does not have access to these reviews.
Given the recent data breach affecting ManageMyHealth, I would like to
request a copy of each of these security reviews."
The information you seek is held by Health New Zealand – Te Whatu Ora. For
this reason, your request is being transferred to their agency under
section 14(b)(i) of the Act. You can expect a response from Te Whatu Ora
in due course ([1][email address]).
Under section 28(3) of the Act, you have the right to ask the Ombudsman to
review the Ministry’s decision to transfer your request. The Ombudsman may
be contacted by email at: [2][email address] or by calling
0800 802 602.
Ngâ mihi,
OIA Services Team
Ministry of Health | Manatû Hauora
M[3]inistry of Health information releases
show quoted sections
Marcus left an annotation ()
I have since followed up with the Ministry of Health via email who have agreed that this OIA does fall under their purview and they will be reversing this transfer.
From: hnzOIA
Kia ora Marcus
Thank you for your request for official information regarding security
reviews, received by Te Whatu Ora - Health New Zealand as a transfer from
the Ministry of Health (the Ministry) on 7 January 2026.
The Ministry has advised that upon further consideration of your request,
their agency is most appropriate to respond. Therefore, Health New Zealand
will no longer be providing a response to your request. You can expect a
response from the Ministry in due course.
Please accept our apologies for any confusion this may have caused.
Ngā mihi nui
Emmie
Government Services
Health New Zealand | Te Whatu Ora
Statement of confidentiality: This email message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege. If you are not the intended recipient, do not read, use,
disseminate, distribute or copy this message or attachments. If you have
received this message in error, please notify the sender immediately and
delete this message
Things to do with this request
- Add an annotation (to help the requester or others)
- Download a zip file of all correspondence (note: this contains the same information already available above).
Offensive? Unsuitable?
Requests for personal information and vexatious requests are not considered valid requests for Official Information (read more).
If you believe this request is not suitable, you can report it for attention by the site administrators
Report this request
Marcus left an annotation ()
I emailed the Ministry of Health directly to clarify why this request.
They stated
> The decision to transfer your request to Health New Zealand was made as per Section 14(b)(i) of the Official Information Act 1982, as the information you are seeking is held by Health New Zealand and not by the Ministry of Health.
but then elaborated
> The Ministry undertook a sector-wide review of the security of key portals and practice management systems in 2018 to understand the potential security vulnerabilities and risks, and provide advice to mitigate them. The review was not an ongoing function and
does not form part of the Ministry’s continuing responsibilities.
which would seem to be contradictory.
I've clarified that the sector-wide review mentioned is what I'm interested in, and whether they still believe that transferring the request is the right decision.
Link to this