23 April 2026
Sam Malik
[FYI request #34234 email]
Tēnā koe Sam
Your request for official information, reference: HNZ00201972
Thank you for your email on 25 March 2026, asking Health New Zealand | Te Whatu Ora (Health
NZ) for the following under the Official Information Act 1982 (the OIA):
I am requesting the following information under the Official Information Act 1982 regarding the
recent IT systems outage that affected hospital operations across New Zealand in or around
January 2026.
1. The exact timeline of the outage, including start time, duration, and full restoration of
services
2. A list of all hospitals, regions, and services affected
3. Any internal assessments of the impact on patient care, including delays, cancellations, or
adverse events
4. Copies of any internal reports, risk registers, or briefings from January 2024 to January
2026 that identified risks relating to:
a. IT system resilience
b. infrastructure failure
c. reliance on third-party vendors
5. Any documents or communications indicating prior warnings about the likelihood of a major
outage
6. Information on staffing levels within IT and digital services over the same period, including:
a. total headcount changes
b. any reductions, restructures, or hiring freezes
7. Any internal analysis of how staffing levels may affect system reliability or incident response
capability
8. The names of all third-party vendors involved in the affected systems
9. Copies of relevant service level agreements (SLAs) and performance reports relating to
uptime and incident response
10. Any internal or external reviews of vendor performance following the outage
11. Copies of any incident review, root cause analysis, or independent investigation reports
12. Any recommendations made and timelines for implementation
13. Briefings provided to the Minister of Health relating to the outage
14. Copies of current contingency plans for IT system failures in hospitals
15. Any evaluations of how those plans performed during the outage
Response
For clarity, I wil address each of your questions in turn.
1. The exact timeline of the outage, including start time, duration, and full restoration of
services
There was no single national IT outage during January 2026. Health NZ has interpreted this part of
your request as referring to significant network outages during January 2026 that affected hospital
operations. The relevant outages are outlined below.
•
13 - 14 January 2026 - Southern inter-connectivity network outage: A third-party
hardware failure caused a network outage impacting a range of clinical systems across Te
Waipounamu. Systems were progressively restored from the time of the incident at 3.21am
on 13 January through to complete restoration by 3.31pm on 14 January.
•
15 January 2026 - Central IT outage: A central IT outage occurred, with full system
restoration by 4:15pm on the day.
•
22 January 2026 - Southern outage: The outage started early Wednesday morning, and
the system was restored before 9.30am on the same day.
•
28 - 29 January 2026, Northern IT outage: The outage lasted approximately 12 hours,
with services restored to all impacted hospitals in the early hours of the following morning.
2. A list of all hospitals, regions, and services affected
The significant network outages during January 2026 affected hospitals and services across the
following regions:
•
Southern region: Dunedin Hospital, Invercargil Hospital, and Lakes District Hospital.
•
Central region: Wellington Regional Hospital, Hutt Hospital, and Wairarapa Hospital.
•
Northern region: Hospitals and services within Te Tai Tokerau, Waitematā, Auckland, and
Counties Manukau districts.
Across these regions, the outages affected a range of clinical, diagnostic, and operational hospital
services.
3. Any internal assessments of the impact on patient care, including delays, cancellations, or
adverse events
Health NZ does not maintain formal internal assessment or review documents relating to patient
care impacts from the January 2026 outages. While local incident and IT logs were created as part
of routine operational processes, these do not constitute internal assessments of patient care
impact.
Therefore, your request for information is refused under section 18(g) of the OIA as this information
is not held.
4. Copies of any internal reports, risk registers, or briefings from January 2024 to January
2026 that identified risks relating to:
1. IT system resilience
2. infrastructure failure
3. reliance on third-party vendors
Internal reports, briefings, and risk registers are created for a wide range of operational and
governance purposes and are held across multiple business units, districts, and systems. They are
not centrally held or categorised by reference to the specific risk themes you have described.
To determine what documents may have existed during the period January 2024 to January 2026,
and whether they identified the risks specified, would require a substantial manual review of a large
volume of material across multiple systems across our Districts and National Office. This would
unreasonably interfere with our operations. Therefore, this part of your request is refused under
section 18(f) of the OIA, as the information cannot be made available without substantial collation
or research.
Refining or extending the request would not reasonably reduce the effort required to locate and
assess potentially relevant information, as there is no central set of documents addressing the
risks specified across the period, and any attempt to identify such material would require the same
substantial review.
While we are unable to identify and provide documents based on the broad risk themes outlined
above, we have provided other information within our response that explains, at a high level, how
Health NZ responds to system outages and related risks.
5. Any documents or communications indicating prior warnings about the likelihood of a major
outage
Health NZ does not hold documents or communications warning of the definite likelihood of a
major outage occurring in January 2026. Most IT outages are unplanned and arise unexpectedly,
for example due to hardware failure, software faults, or third‑party service disruption. As such,
Health NZ generally does not receive advance notice that an outage wil occur on a particular day.
Where planned system maintenance is scheduled, this is managed through routine operational
communications; however, the outages experienced in January 2026 were not events for which
advance warnings of definite occurrence were held.
Accordingly, your request for information is refused under section 18(g) of the OIA as this
information is not held.
6. Information on staffing levels within IT and digital services over the same period, including:
a. total headcount changes
b. any reductions, restructures, or hiring freezes
Health NZ has interpreted this part of your request at a high level, as staffing data over the period
January 2024 to January 2026 is not held as a fixed snapshot.
As at 25 March 2026, our current Digital Services workforce comprises of a headcount of 1,460
roles, including 162 vacancies that we are actively recruiting to. Before the Data and Digital change
process in May 2025, 1,412 people were employed, excluding transfers and vacancies.
7. Any internal analysis of how staffing levels may affect system reliability or incident response
capability
Health NZ does not hold formal internal analysis that specifically examines how staffing levels
within IT and digital services affect system reliability or incident response capability. While staffing
considerations may be referenced in a general or contextual way within operational or governance
material, no analysis of the type described in your request exists.
Accordingly, your request for information is refused under section 18(g) of the OIA as this
information is not held.
8. The names of all third-party vendors involved in the affected systems
9. Copies of relevant service level agreements (SLAs) and performance reports relating to
uptime and incident response
Health NZ relies on a range of vendors to support and maintain complex national digital and
infrastructure systems. The names of third party vendors involved in the affected systems, along
with copies of external service level agreements (SLAs) and associated performance reports are
withheld under section 9(2)(b)(i ) of the OIA, to protect information where the making available of
the information would be likely unreasonably to prejudice the commercial position of the person
who supplied or who is the subject of the information.
10. Any internal or external reviews of vendor performance following the outage
Health NZ does not hold internal or external analysis of vendor performance regarding the January
outages. Accordingly, your request for information is refused under section 18(g) of the OIA as this
information is not held.
11. Copies of any incident review, root cause analysis, or independent investigation reports
The documents you have requested contain detailed information about system vulnerabilities,
incident response processes, and risk controls within Health NZ’s digital systems. Disclosure of
this information could increase the risk of further disruption or compromise, impacting the safe and
reliable delivery of health services. Therefore, this information is withheld under section 9(2)(c) of
the OIA, as disclosure would be likely to prejudice measures protecting the health and safety of the
public.
12. Any recommendations made and timelines for implementation
Health NZ holds draft information as described fol owing the January 2026 outages. This forms
part of an internal report that is currently being finalised.
Therefore, this information is withheld under section 9(2)(g)(i) of the OIA, to maintain the effective
conduct of public affairs through the free and frank expression of opinions by or between or to
Ministers of the Crown or members of an organisation or officers and employees of any public
service agency or organisation in the course of their duty.
13. Briefings provided to the Minister of Health relating to the outage
Health NZ has not provided any formal briefings to the Ministers of Health relating to the significant
IT outages in January 2026. Therefore, your request for this information is refused under section
18(e) of the OIA as this information does not exist.
14. Copies of current contingency plans for IT system failures in hospitals
The information you have requested contains detailed information about Health NZ s arrangements
for maintaining and restoring critical services during IT system disruptions. Therefore, this
information is withheld under section 9(2)(c) of the OIA, as disclosure would be likely to prejudice
measures protecting the health and safety of the public.
15. Any evaluations of how those plans performed during the outage
Health NZ does not prepare formal evaluations of business continuity or outage response plans
following every IT outage. Reviews are undertaken on a risk and severity basis, and for lower
impact outages learnings are addressed through operational processes rather than a standalone
evaluation document.
Accordingly, your request for information is refused under section 18(g) of the OIA as this
information is not held.
Where we have withheld information under section 9(2) of the OIA, we have considered any
countervailing public interests in the release of this information. We do not believe that the public
interests outweigh the need to withhold in this instance.
How to get in touch
If you have any questions, you can contact us at
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz or
by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may proactively
release a copy of this response on our website. Al requester data, including your name and
contact details, wil be removed prior to release.
Nāku iti noa, nā
Matthew McLay
Manager Government Services
Health New Zealand | Te Whatu Ora
