MMH Cyber Breach Practice Resources

The Manage My Health inquiry is closed. Here's what it means for your practice

Damon Campbell, Chief Operating Officer

The Office of the Privacy Commissioner released the final report of its inquiry into the Manage My Health breach on Friday 30 October. It runs to 83 pages. Most of it is directed at Manage My Health and Health New Zealand | Te Whatu Ora, but a good part of it describes what happened inside general practices, and three of the recommendations are written specifically for practice.

This is a short overview from me as to what's in it.

The inquiry in two phases

The first report, published in May, dealt with the security failures behind the breach and who was responsible for them. The Commissioner issued compliance notices to Manage My Health and to Health New Zealand | Te Whatu Ora, and those notices still stand.

This second report looks at how patients came to be affected, what the breach did to people and communities, and how the response was handled. The inquiry itself is now formally closed, with around 50 individual complaints still being worked through.

What the Commissioner found

Around 100,000 people had information stolen in late 2025, most of them in Northland, but all regions across the motu were affected. The finding that matters most is about awareness. A large number of affected people did not know they had a Manage My Health account at all. Some had an account created for them through a Te Whatu Ora project and never activated it. Some had activated an account years earlier and forgotten. Others had moved to a practice that didn't use the portal, or stayed with a practice that stopped using it, and assumed the account went with it. It didn't.

The Commissioner's view is plain: an account that was never activated was never authorised, and holding health information in it breached the Health Information Privacy Code. Leaving an account dormant for 24 months before checking in with the patient was also too long. Manage My Health has since deleted the information held in non-activated accounts, rewritten its terms of use and privacy policy, and shortened its dormant account process for patients who are no longer with a practice that uses the portal.

Three things to check in your practice

First, how your patients are told about the portal and the shared electronic health record. The report asks practices to check that patients are properly informed about how the system works and, where needed, that they have authorised information being transferred into it. Have a look at the wording your team uses at enrolment and at portal sign-up. WellSouth is working with GPNZ and Health New Zealand | Te Whatu Ora on standardised patient information so that every practice isn't writing its own.

Second, the age at which a child's portal account separates from a parent's. Manage My Health de-links accounts automatically, but only at the age your practice has set. The report asks practices to confirm that age is correct, at 16 at the latest unless a parent continues to hold legal authority. A wrong setting means a parent can read a young person's record after they are entitled to.

Third, what your practice would do on the day. The most uncomfortable reading in the report is the account of practices fielding calls from worried patients with no guidance, being told they had a handful of affected patients and then more than a thousand, and being asked to contact vulnerable patients without the clinical context to do it safely. The Commissioner's point is that the basics can be worked out in advance: who speaks to patients, how you reach people who are vulnerable, who deals with the media, and who you call for help. If you'd like to talk through your practice's breach plan, your Practice Partner is the place to start, and the Information Sharing and Cyber Security Grant can be used for this kind of preparation.

A checklist for your practice team

Worth running through at your next team meeting. Most items take ten minutes to confirm; the ones that don't are the ones worth doing now.

Patient information and authorisation

Your enrolment form and portal sign-up wording explain what the portal is, what information flows into it, and who can see it.
Every portal account the practice created for a patient has been activated by that patient. Any account that was never activated is closed.
Patients transferring in are asked whether they already hold a portal account with a previous practice.

Portal and account settings

The de-linking age for children's accounts is set, and set no later than 16.
One named person owns the portal settings and reviews the active account list at least once a year, closing accounts for patients who have left or died.
When a patient dies, closing their portal account is part of the practice's process, and the family or representative is told how records can be accessed.

Breach readiness

A written plan names who leads on the day, who speaks to patients, who handles media, and who contacts WellSouth and the Privacy Commissioner.
Staff know how to report a suspected breach inside the practice the day it's noticed. Delay in the practice is delay in notification.
You can produce a list of affected patients quickly, and a clinician decides how vulnerable patients are contacted and by whom.
Key people are reachable over holidays. The Manage My Health breach landed in the days before Christmas.
Your contracts with portal and IT vendors say who notifies patients after a breach, and do not try to limit the vendor's liability if your patients' information is stolen.

The wider lesson

Practices across the country have told the Commissioner that patients are asking for paper copies and are warier of portals than they were, even where they weren't affected. The report is clear that portals are a valuable part of modern general practice when they are safe and well managed. The way to keep that trust is the unglamorous work: knowing what you hold, knowing who has authorised it, and knowing what you'd say if it went wrong.

The full report and the Commissioner's media statement are on privacy.org.nz. If you have questions about any of this, contact your Practice Partner or WellSouth's Privacy Officer.

Manage My Health Cyber Breach General Practice Resources

WellSouth MMH Practice latest Drop-in Hui Recordings:

Latest drop-in, Manage My Health Cyber Info Drop in Session 29

Jan, 2026

These are hosted by WellSouth COO Damon Campbell.

Where to find information on MMH

Practices with affected patients will receive an email from MMH. The Patient data is then available on the MMH platform - Secure Provider Portal – Reports – Report 20 (20 includes any patients from Northland who may have enrolled with you). Please note the list of affected patients may increase. We do not know when the list is final. If you don't have MMH, the patient NHIs will be emailed to you.

Frequently Asked Questions

FAQs for practices, created 20 January, updated 9 February

MMH WS Practice MMH FAQs updated 9 Feb 2026 (check downloads if it doesn't appear in the browser)

These will be periodically updated. Please let us know if you have any questions for us to add.

Resources to support patients and their wellbeing

Contacting your patients/patients contacting you

If you do wish to proactively contact your patients on the MMH Affected Patient List provided to your practice, we have some suggested wording for this purpose below. This wording is intended as starting point only to reduce the burden on practices by providing plain-language wording that can be adapted locally while remaining aligned with current national knowledge.

Suggested wording - initial communication to patients on MMH Affected Patient List

You can now also share the 0800 number, 0800 747 778.

Patients who are upset about being on MMH and didn't realise may contact you. Here is a proposed script

Wellbeing support, Access & Choice or BIS

Please use your Access & Choice team, who have been prepped on the situation. If you do not have Access & Choice, please refer patients to our Brief Intervention Service. Clearly mark the information as related to the MMH security breach so that these patients are prioritised.

Access & Choice handout/script for practices WITH Access & Choice, Wellbeing MMH Handout/script for Practices WITH A&C
Access & Choice handout/script for practices WITHOUT Access & Choice, Wellbeing MMH Handout/script for Practices WITHOUT A&C

Reimbursement for practices

Updated 16 Jan

New Low Volume Programme to claim for MMH calls and GP/NP consults:

Details are here https://wellsouth.nz/provider-access/clinical-resources/funded-programmes/funded-programmes-summary#ManageMyHealth

Updated 9 Jan HNZ Support

Health New Zealand would like to support practices and patients impacted by the Manage My Health cyber breach by allowing for funded consultations with patients where appropriate.

Services
Funding is available to support services in primary care to support patients who:
1. request clarification of clinical records that have been accessed as part of the breach. This will primarily be related to Te Whatu Ora | Health NZ documents such as discharge letters and clinic records, but may also include specialist referrals
2. require proactive GP led notification because of identified vulnerabilities

More information here MMH Cyber Breach funding for primary care services.

Update from HNZ, 12 Jan

Where primary care services are noting increased demand (eg Access and Choice) as a result of the breach, providers are asked to notify the response/recovery team (practicesupport@managemyhealth.co.nz). Practices needing to allocate additional admin resource to the response are asked to record details, while discussions take place with MMH.

Communications resources

You are welcome to link to this page, or use information from it for your own comms.

Facebook tiles re wellbeing support

Facebook Tile Wellbeing MMH for practices With A&C

Facebook Tile Wellbeing MMH for practices Without A&C

Instructions for patients wanting to close their account: MMH Account Deletion instructions

You are welcome to share any of our posts that may be relevant to your community.

MMH comms to patients/0800

The 0800 number

The 0800 is 0800 747 778 and is available to anyone to use.

MH Impacted Account Email Template 08012026

Legal advice

Legal advice for practices affected by the Manage My Health data breach (MMH Breach)

LEGAL ADVICE practices contacting patients MMH Breach

Updated 12 Jan, Office of Privacy Commission statement

Office of the Privacy Commissioner | Updated statement on Manage My Health cyber incident