The New Zealand Privacy Commissioner has released the final report into the December 2025 Manage My Health cyber breach, bringing its two-phase investigation to a close and outlining lessons that extend well beyond the organisations directly involved.
Released on 30 October 2026, the Phase Two report examines the impact on affected patients, the handling of the incident and the wider implications for organisations collecting and managing sensitive personal information.
The investigation has already established that both Manage My Health and Health NZ breached Rule 5 of the Health Information Privacy Code, relating to the security of health information. Both organisations subsequently received formal compliance notices from the Privacy Commissioner.
The impact of the breach was particularly significant in Northland, with approximately 90% of affected individuals being Northland hospital patients. The Commissioner highlighted the disproportionate impact on Māori patients, whānau and local health services, alongside the anxiety and loss of confidence experienced by affected individuals.
Recommendations for wider agencies
Importantly, the final report is not just about Manage My Health. The Privacy Commissioner has used the investigation to highlight shortcomings that other organisations handling sensitive information should address.
The wider recommendations and lessons include:
- Account lifecycle management: Organisations should regularly review dormant, inactive and incomplete accounts, including accounts belonging to deceased individuals. Access should not remain available indefinitely simply because an account has not been formally closed.
- Understand the information being held: Agencies need to understand what personal information they collect, why they need it, where it is stored and how long it should be retained. Information that is no longer required should not remain unnecessarily accessible.
- Incident response preparedness: Organisations should have established incident response and crisis management plans before an incident occurs. Developing response processes during an active cyberattack creates unnecessary delays and additional pressure.
- Timely breach notification: Agencies need clear processes for determining when a privacy breach becomes notifiable and communicating with affected individuals within a reasonable timeframe. Internal processes and uncertainty should not become an excuse for delayed notification.
- Third-party accountability: Organisations must understand their responsibilities when engaging external technology providers and ensure appropriate oversight of vendors that process personal information on their behalf.
- Rebuilding trust: Organisations handling sensitive information need to recognise that the consequences of a breach extend beyond the technical compromise. Clear communication, support for affected individuals and demonstrable improvements to security are essential.
These recommendations reinforce the need for privacy and security to be treated as ongoing operational responsibilities, rather than simply compliance exercises undertaken when something goes wrong.
A serious incident, but where is the accountability?
Despite the seriousness of the incident and the sensitivity of the information involved, there is a question about what has ultimately resulted from the investigation.
The breach exposed significant weaknesses in account management, access controls, security processes and the handling of sensitive healthcare information. The consequences extended well beyond the technical compromise, affecting patient confidence in digital healthcare services and creating considerable distress for individuals whose medical information was potentially exposed.
Yet, despite the findings of Privacy Act breaches, no financial fines have been issued as a result of the investigation.
The Privacy Commissioner has issued compliance notices requiring Manage My Health and Health NZ to address their shortcomings. These are important regulatory measures, but they are not the same as financial penalties or broader sector-wide enforcement. There is nothing to suggest should a similar incident occur tomorrow would result in anything other than another privacy commissioner report which takes 6 months and issues a couple of warnings to the organisations involved.
There is also a reasonable question about whether the Privacy Commissioner’s investigation has made the most of an opportunity to improve cybersecurity across New Zealand’s healthcare environment.
Healthcare remains an attractive target for cybercriminals. Medical records contain highly sensitive information, healthcare organisations often rely on complex technology and third-party providers, and disruption can have consequences that extend beyond financial losses.
The Manage My Health incident provided a high-profile example of what can happen when security controls, account governance and privacy processes are inadequate. It could have been an opportunity to drive more substantial improvements across the sector, including clearer minimum security expectations, stronger oversight of healthcare technology providers and greater accountability for organisations entrusted with sensitive patient information.
Instead, much of the wider guidance appears to reinforce principles that responsible organisations should already be following.
Has the opportunity been missed?
The final report provides useful lessons, and the compliance notices issued to Manage My Health and Health NZ demonstrate that the Privacy Commissioner has taken formal action.
However, the bigger question is whether this will translate into a meaningful improvement in the security posture of New Zealand’s healthcare sector.
Organisations should not need to experience a major data breach before reviewing dormant accounts, implementing appropriate access controls, establishing incident response plans or understanding their obligations to patients.
The real measure of the investigation will not be the publication of another report, but whether it results in measurable improvements in how New Zealand organisations protect sensitive health information.
For patients whose information was exposed, those improvements cannot come soon enough.
