Public health providers have to obey strict cyber security rules – so should private contractors

The Conversation · Mar 30, 2026 · 773 words · By Gehan Gunasekara; Ian Welch; Lisa Patterson

The article discusses cybersecurity vulnerabilities in New Zealand's healthcare sector, citing data breaches and advocating for regulatory reforms. It compares New Zealand's approach to cybersecurity measures in the UK, US, and Finland, emphasizing the need for mandatory security audits and clear legal frameworks.

open_in_new Read the original article: https://theconversation.com/public-health-providers-have-to-obey-strict-cyber-se…

analyticsAnalysis

Propaganda Score

confidence: 95%

Low risk. This article shows minimal use of propaganda techniques.

fact_checkFact-Check Results

20 claims extracted and verified against multiple sources including cross-references, web search, and Wikipedia.

schedule Pending 10

help Insufficient Evidence 6

verified Verified By Reference 3

info Single Source 1

verified

“Following a series of significant health data breaches, the government released a cyber security strategy and action plan to establish a national framework for responding to escalating cyber threats.”

VERIFIED BY REFERENCE

menu_book

wikipedia NEUTRAL — New Zealand is an island country in the southwestern Pacific Ocean. It consists of two main landmasses—the North Island (Te Ika-a-Māui) and the South Island (Te Waipounamu)—and over 600 smaller island…
https://en.wikipedia.org/wiki/New_Zealand

menu_book

wikipedia NEUTRAL — The New Zealand men's national football team (Māori: Tīma hoka a-motu o Aotearoa) represents New Zealand in men's international football competitions. The team is governed by the governing body for fo…
https://en.wikipedia.org/wiki/New_Zealand_men's_national_foo…

menu_book

wikipedia NEUTRAL — Tourism in New Zealand comprised an important sector of the national economy – tourism directly contributed NZ$16.2 billion (or 5.8%) of the country's GDP in the year ended March 2019. As of 2016 tour…
https://en.wikipedia.org/wiki/Tourism_in_New_Zealand

+ 3 more evidence sources

info

“The strategy covers New Zealand’s critical infrastructure, from the electricity grid to transport, financial payment systems and the health sector.”

SINGLE SOURCE

travel_explore

web search NEUTRAL — It also signals that regulatory change may be on the horizon to strengthen requirements for the cyber security of critical infrastructure, better incentivise the protection of personal information, an…
https://www.russellmcveagh.com/insights-news/release-of-new-…

travel_explore

web search NEUTRAL — The ubiquity of information technology across all sectors, from public services, critical infrastructure, in the private sector and the everyday lives of citizens, provides a wide surface area for mal…
https://www.dpmc.govt.nz/sites/default/files/2026-02/nz-cybe…

travel_explore

web search NEUTRAL — Digitising Government New Zealand and the National Cyber Security Summit 2026, both being staged in Wellington next week, will continue the critical national conversation shaped recently by the releas…
https://defsec.net.nz/2026/03/10/new-zealands-cybersecurity-…

verified

“The government held consultations with each sector this week.”

VERIFIED BY REFERENCE

menu_book

wikipedia NEUTRAL — The animals of New Zealand, part of its biota, have an unusual history because, before the arrival of humans less than 900 years ago, the country was mostly free of mammals, except those that could sw…
https://en.wikipedia.org/wiki/Fauna_of_New_Zealand

menu_book

verified

“Late last year, more than 120,000 New Zealanders had their medical records compromised when the patient data portal Manage My Health was hacked.”

VERIFIED BY REFERENCE

menu_book

wikipedia NEUTRAL — Chinese New Zealanders or Sino-New Zealanders are New Zealanders of Chinese ancestry. The largest subset of Asian New Zealanders, many of the Chinese immigrants came from Mainland China, Hong Kong, T…
https://en.wikipedia.org/wiki/Chinese_New_Zealanders

menu_book

wikipedia NEUTRAL — The ManageMyHealth data breach was a cybersecurity incident involving unauthorised access to the ManageMyHealth online patient portal in New Zealand. The breach was disclosed in late December 2025 and…
https://en.wikipedia.org/wiki/ManageMyHealth_data_breach

menu_book

help

“Then in February, the prescription app MediMap was taken offline after patient information was found to have been altered in a cyber attack.”

INSUFFICIENT EVIDENCE

help

“These security breaches have damaged trust in New Zealand’s entire health system. They are being investigated as part of a government review and an inquiry by the privacy commissioner.”

INSUFFICIENT EVIDENCE

help

“Currently, New Zealand has no single piece of legislation that mandates enforceable minimum cyber security requirements.”

INSUFFICIENT EVIDENCE

help

“Section 11 of the Privacy Act, which says healthcare providers remain responsible for information handled on their behalf, even when using IT service providers.”

INSUFFICIENT EVIDENCE

help

“The Health Information Privacy Code also lists IT providers as 'health agencies' which may result in confusion as to which agency is ultimately responsible.”

INSUFFICIENT EVIDENCE

help

“When patients change doctors, their old records don’t disappear. They can remain on whichever system their previous practice used for many years.”

INSUFFICIENT EVIDENCE

schedule

“One patient reported their medical files were still uploading to Manage My Health two years after their doctor’s practice stopped using the platform.”

PENDING

schedule

“Section 11 of the Privacy Act should be strengthened to require clear auditable contractual commitments between providers and those acting on their behalf to store or process information.”

PENDING

schedule

“In the UK, any public or private organisation accessing patient data held by the public health system must complete a mandatory data security and protection toolkit annually.”

PENDING

schedule

“In the US, federal audits of healthcare providers are conducted under the Health Insurance Portability and Accountability Act.”

PENDING

schedule

“Finland responded swiftly to a 2020 data breach at the private psychotherapy centre Vastaamo, mandating security audits for all healthcare providers, with no exceptions.”

PENDING

schedule

“Since Finland strengthened and broadened mandatory external security audits for those handling patient information, no breach on the same scale has been reported.”

PENDING

schedule

“Data is stored on foreign-owned servers, foreign laws may apply regardless of the physical location. This is particularly relevant when we consider the implications for Māori data.”

PENDING

schedule

“All private companies handling sensitive health data are already categorised as health agencies and must comply with the conditions of the Health Information Privacy Code 2020.”

PENDING

schedule

“Rules regarding the retention and deletion of health data are found across multiple legislative codes. The ability to delete data is limited.”

PENDING

schedule

“We argue New Zealand needs mandatory security audits for all healthcare data systems. We hope the government will enforce this.”

PENDING

info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.

eFinder

eFinder

Public health providers have to obey strict cyber security rules – so should private contractors

analyticsAnalysis

fact_checkFact-Check Results