9 March 2026
Ron M
[FYI request #33440 email]
Tēnā koe Ron
Your request for official information, reference: HNZ00106753
Thank you for your email on 6 January 2026, asking Health New Zealand | Te Whatu Ora for the
following under the Of icial Information Act 1982 (the OIA):
1. Provide the most recent security assurance artefacts Health NZ held about
ManageMyHealth (or the relevant legal name of the vendor) prior to the security breach
incident, such as but not limited to:
•
security assessments,
•
audit reports,
•
pen test summaries/executive summaries,
•
SOC 2/ISO 27001 attestations (if any),
•
risk acceptance documents.
2. Provide any risk register entries (or equivalent) relating to ManageMyHealth (or patient
portals / third-party patient-facing platforms), including risk owner and treatment status.
3. Provide records of any known vulnerabilities, audit findings, or exceptions related to this
service, and evidence of how/when they were remediated or accepted.
Response
The information you have requested is largely held by Manage my Health, who are a private
organisation and not subject to the OIA. As such, Health NZ can only respond with regard to
information held by our agency, i.e. reported to us by Manage My Health.
Some documents relating to the security and certification were assessed by Health NZ in 2023 and
2024. And subsequent to the review, Health NZ generated a number of technical documents
relating to the security of Manage My Health. However, these documents and any correspondence
relating to Manage My Health’s security are withheld under the following section of the OIA:
• 6(c) as releasing info would likely prejudice the maintenance of the law, including the
prevention, investigation, and detection of offences, and the right to a fair trial. A complaint
regarding the Manage My Health data breach has been made to NZ Police and remains
under investigation.
• 9(2)(b)(i ) where its release would likely unreasonably prejudice the commercial position of
the person who supplied the information.
• 9(2)(e) to avoid prejudice to measures that prevent or mitigate material loss to members of
the public. The release of information relating to the cyber attack, its causes, any
weaknesses in security settings could risk further exploitation of those weaknesses by a
threat actor and place the security of individual’s health information at risk.
Where we have withheld information under section 9 of the OIA, we have considered any
countervailing public interests in the release of this information. We do not believe that the public
interests outweigh the need to withhold in this instance.
We note Manage My Health are publicly communicating updates regarding the cyber breach on
their website
: FAQs - Cyber Breach | Manage My Health
How to get in touch
If you have any questions, you can contact us at
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz or
by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may proactively
release a copy of this response on our website. Al requester data, including your name and
contact details, wil be removed prior to release.
Nāku iti noa, nā
Sasha Wood
Head of Government Services
Te Whatu Ora | Health New Zealand
