Dear Ministry of Health,

Back in April 2024, an OIA was submitted to the Office of Dr Shane Reti querying about any "audit findings, documents, and emails pertaining to the security of Medtech and
ManageMyHealth".

This request was deemed to be more relevant to Te Whatu Ora (Health New Zealand) and was transferred as HNZ00043507.

The following answer was given:

> To the best of our knowledge, Health NZ does not hold audit findings or similar.
> Around five years ago or so, the Ministry of Health undertook security reviews of general
practice systems, which may have included Medtech and ManageMyHealth (MMH). Health NZ does not have access to these reviews.

Given the recent data breach affecting ManageMyHealth, I would like to request a copy of each of these security reviews.

Presumably there is a final report containing findings and recommendations which would be the ideal form but please let me know if these reviews exist in a different shape.

I also acknowledge that the 20 working days target won't begin until January 15th as defined in the Official Information Act

Yours faithfully,

Marcus