Final Manage My Health report flags AI risk and digitisation pace
Privacy Commissioner Michael Webster has released a second and final report into the December 2025 Manage My Health breach. RNZ reports that the report says the pace of government digitisation is a real cause for concern.
Hackers compromised more than 400,000 Health New Zealand documents and more than 22,000 documents uploaded by patients. About 90 percent of the affected patients were from Northland.
The report found that the health sector was not seen as ready for a "big digital one-stop shop", a single digital system that would bring services together. There was strong consensus that foundational issues, forms, consent processes and privacy arrangements must be resolved before digital health infrastructure is expanded at pace.
The report also flags artificial intelligence as an emerging risk. It says AI could amplify existing vulnerabilities if the rules and oversight arrangements that govern it are not strengthened now.
A flaw allowed some Northland hospital information to be saved into accounts that patients had never activated. The flaw was corrected in January 2026.
The report makes 10 recommendations, with particular emphasis on two entities engaging face-to-face with Northland communities. One recommendation is that Manage My Health delete contact and other details held in non-activated accounts after three months. Under the current arrangement, those details are kept under a 24-month process for dormant accounts.
Earlier, the Privacy Commissioner's inquiry concluded that both Manage My Health and Health NZ failed to have reasonable security safeguards in place. The commissioner gave Health NZ and Manage My Health until next year to comply with health privacy rules, RNZ reported.
Other agencies have also responded. The Ministry of Health has completed its review of the breach and says it is strengthening cyber security across the health system following an independent review of the Manage My Health incident. Health NZ has published a Manage My Health Action Plan in response to the inquiry and the reviews.
