Kia ora, 

The Ministry of Health closedown period is between 23 December 2025 to 7
January 2026. During this time this inbox will not be monitored. We will
respond to your email upon our return.

Have a safe and happy holiday period. 
OIA Services Team
Ministry of Health  | Manatū Hauora

show quoted sections

Tçnâ koe Marcus,

 

Thank you for your request under the Official Information Act 1982 (the
Act) to the Ministry of Health – Manatû Hauora on 2 January 2026. You
requested:

 

"Back in April 2024, an OIA was submitted to the Office of Dr Shane Reti
querying about any "audit findings, documents, and emails pertaining to
the security of Medtech and ManageMyHealth."

 

This request was deemed to be more relevant to Te Whatu Ora (Health New
Zealand) and was transferred as HNZ00043507.

 

The following answer was given:

 

To the best of our knowledge, Health NZ does not hold audit findings or
similar.

 

Around five years ago or so, the Ministry of Health undertook security
reviews of general practice systems, which may have included Medtech and
ManageMyHealth (MMH).

 

Health NZ does not have access to these reviews.

 

Given the recent data breach affecting ManageMyHealth, I would like to
request a copy of each of these security reviews."

 

The information you seek is held by Health New Zealand – Te Whatu Ora. For
this reason, your request is being transferred to their agency under
section 14(b)(i) of the Act. You can expect a response from Te Whatu Ora
in due course ([1][email address]). 

 

Under section 28(3) of the Act, you have the right to ask the Ombudsman to
review the Ministry’s decision to transfer your request. The Ombudsman may
be contacted by email at: [2][email address] or by calling
0800 802 602.

 

 

Ngâ mihi,

  

OIA Services Team

Ministry of Health | Manatû Hauora
 

M[3]inistry of Health information releases

 

show quoted sections

Kia ora Marcus
 
Thank you for your request for official information regarding security
reviews, received by Te Whatu Ora - Health New Zealand as a transfer from
the Ministry of Health (the Ministry) on 7 January 2026. 
 
The Ministry has advised that upon further consideration of your request,
their agency is most appropriate to respond. Therefore, Health New Zealand
will no longer be providing a response to your request. You can expect a
response from the Ministry in due course.
 
Please accept our apologies for any confusion this may have caused.
 
Ngā mihi nui 

 

Emmie 

Government Services
Health New Zealand | Te Whatu Ora

Statement of confidentiality: This email message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege. If you are not the intended recipient, do not read, use,
disseminate, distribute or copy this message or attachments. If you have
received this message in error, please notify the sender immediately and
delete this message

Kia ora,
Thank you for your request for official information received on 2 January
2026 requesting:
"The Ministry undertook a sector-wide review of the security of key
portals and practice management systems in 2018 to understand the
potential security vulnerabilities and risks, and provide advice to
mitigate them.
This sector-wide review (presumably there was some sort of final report)
is what I would be interested in obtaining a copy of.
I'm not after any reviews that are strictly on ManageMyHealth, but just on
whatever reviews were done on practice management systems and portals
broadly.
Given that, can you clarify whether Te Whatu Ora would still be the right
place to transfer this request, given you've just said that the Ministry
of Health were the ones who undertood the review, and Te Whatu Ora had
previously said they don't have access to this review?"
The Ministry of Health has decided to extend the period of time available
to respond to your request under section 15A of the Official Information
Act 1982 (the Act) as the consultations necessary to make a decision on
the request are such that a proper response to the request cannot
reasonably be made within the original time limit.
You can now expect a response to your request on, or before, 27 February
2026.
You have the right, under section 28 of the Act, to ask the Ombudsman to
review my decision to extend the time available to respond to your
request. The Ombudsman may be contacted by email at:
[email address] or by calling 0800 802 602.
Ngā mihi,

OIA Services Team

Ministry of Health | Manatū Hauora

show quoted sections

Tēnā koe,

 

You will appreciate that given the sensitivities and high profile of the
matter, the Ministry is seeking legal advice and oversight to ensure that
the provisions of the Act are applied correctly and consistently. This
includes advice on the balancing of public interest considerations versus
the need to withhold information, and confirming that our proposed
response to/decision on a request aligns with the Ministry's obligations
under the Act.

 

Please note that under the Act, an extension of time may be made where
consultations are necessary to make a decision on the request, and a
proper response cannot reasonably be provided in the original timeframe.
Seeking legal advice falls in this scope.

 

We hope this clarifies.

 

Ngā mihi,

 

 

OIA Services Team

Ministry of Health | Manatū Hauora

 

 

------------------------------------------------------------------------

From: Marcus <[FOI #33403 email]>
Sent: Friday, 13 February 2026 14:25
To: OIA Requests <[email address]>
Subject: Re: Extension of time for responding to request, ref: H2026077293
CRM:0489460

 

Dear OIA Requests,

I acknowledge that you've decided to extend the time required in order to
provide the information that I've requested.

Would you be able to clarify the parties that need to be consulted as well
as why those consultations are necessary? I would also be interested to
know which aspect of the consultations is difficult such that a timeline
extension was required.

I also note that the Ministry of Health's technical assurance review is
due to be released a day after the new extended deadline.

I imagine that the offiical review will cover a lot of the same area and
that waiting until the report releases would result in de-duplicated work.
I also imagine that this is purely a coincidence as Section 18(d) was not
invoked and I imagine that the Ombudsman would take a dim view if this
were the case.

Much appreciated,

Marcus

show quoted sections

Kia ora, 

 

Please find attached the response for your request for official
information. 

 

Ngā mihi,

 

 

OIA Services Team

Ministry of Health | Manatū Hauora

 

show quoted sections