Public health providers have to obey strict cyber security rules – so should private contractors

The Conversation · 🇦🇺 public Australia · Mar 30, 2026 · 773 words · By Gehan Gunasekara; Ian Welch; Lisa Patterson

headphones Listen to the eFinder podcast briefing

Generate a natural audio summary of this story

Daily briefing

What to know about Public health providers have to obey strict cyber security rules – so should private contractors

The article discusses cybersecurity vulnerabilities in New Zealand's healthcare sector, citing data breaches and advocating for regulatory reforms. It compares New Zealand's approach to cybersecurity measures in the UK, US, and Finland, emphasizing the need for mandatory security audits and clear legal frameworks.

Propaganda risk 0%

Claims checked 20

Techniques found 0

Topics 0

Coverage spectrum

Coverage gap: Low Left coverage

Left0%

Center83%

Right17%

6 sources compared across this story cluster. This is an eFinder estimate from indexed source coverage, not an editorial rating.

What happened

Following a series of significant health data breaches, the government released a cyber security strategy and action plan to establish a national framework for responding to escalating cyber threats.

Why it matters

The strategy covers New Zealand’s critical infrastructure, from the electricity grid to transport, financial payment systems and the health sector.

Common ground

The government held consultations with each sector this week.

Perspective signals

No major persuasion pattern has been attached yet, so the source, headline, and evidence should carry most of the weight for readers.

Follow-up questions

What concrete event or decision sits underneath the headline: Public health providers have to obey strict cyber security rules – so should private contractors?
What evidence would most clearly confirm or weaken the claim that When patients change doctors, their old records don’t disappear. They can remain on whichever system their previous practice used for many years?
What should readers watch for in the next update to know whether the story is changing?

open_in_new Read the original article: https://theconversation.com/public-health-providers-have-to-obey-strict-cyber-se…

analyticsAnalysis

Propaganda Score

confidence: 95%

Low risk. This article shows minimal use of propaganda techniques.

fact_checkClaims Checked

eFinder analyzed this article and checked 20 claims against available evidence, cross-references, web search, and Wikipedia. Here is what the fact-checking layer found.

schedule Pending 10

help Insufficient Evidence 6

verified Verified By Reference 3

info Single Source 1

help

Claim 1: “When patients change doctors, their old records don’t disappear. They can remain on whichever system their previous practice used for many years.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

schedule

Claim 2: “Since Finland strengthened and broadened mandatory external security audits for those handling patient information, no breach on the same scale has been reported.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

info

Claim 3: “The strategy covers New Zealand’s critical infrastructure, from the electricity grid to transport, financial payment systems and the health sector.”

SINGLE SOURCE

This claim was extracted as a checkable statement from the article. eFinder labels it single source based on the available evidence and source context shown below.

travel_explore

web search NEUTRAL — It also signals that regulatory change may be on the horizon to strengthen requirements for the cyber security of critical infrastructure, better incentivise the protection of personal information, an…
https://www.russellmcveagh.com/insights-news/release-of-new-…

travel_explore

web search NEUTRAL — The ubiquity of information technology across all sectors, from public services, critical infrastructure, in the private sector and the everyday lives of citizens, provides a wide surface area for mal…
https://www.dpmc.govt.nz/sites/default/files/2026-02/nz-cybe…

travel_explore

web search NEUTRAL — Digitising Government New Zealand and the National Cyber Security Summit 2026, both being staged in Wellington next week, will continue the critical national conversation shaped recently by the releas…
https://defsec.net.nz/2026/03/10/new-zealands-cybersecurity-…

schedule

Claim 4: “Section 11 of the Privacy Act should be strengthened to require clear auditable contractual commitments between providers and those acting on their behalf to store or process information.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

verified

Claim 5: “Late last year, more than 120,000 New Zealanders had their medical records compromised when the patient data portal Manage My Health was hacked.”

VERIFIED BY REFERENCE

This claim was extracted as a checkable statement from the article. eFinder labels it verified by reference based on the available evidence and source context shown below.

menu_book

wikipedia NEUTRAL — Chinese New Zealanders or Sino-New Zealanders are New Zealanders of Chinese ancestry. The largest subset of Asian New Zealanders, many of the Chinese immigrants came from Mainland China, Hong Kong, T…
https://en.wikipedia.org/wiki/Chinese_New_Zealanders

menu_book

wikipedia NEUTRAL — The ManageMyHealth data breach was a cybersecurity incident involving unauthorised access to the ManageMyHealth online patient portal in New Zealand. The breach was disclosed in late December 2025 and…
https://en.wikipedia.org/wiki/ManageMyHealth_data_breach

menu_book

wikipedia NEUTRAL — New Zealand is an island country in the southwestern Pacific Ocean. It consists of two main landmasses—the North Island (Te Ika-a-Māui) and the South Island (Te Waipounamu)—and over 600 smaller island…
https://en.wikipedia.org/wiki/New_Zealand

help

Claim 6: “The Health Information Privacy Code also lists IT providers as 'health agencies' which may result in confusion as to which agency is ultimately responsible.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

schedule

Claim 7: “All private companies handling sensitive health data are already categorised as health agencies and must comply with the conditions of the Health Information Privacy Code 2020.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

help

Claim 8: “Then in February, the prescription app MediMap was taken offline after patient information was found to have been altered in a cyber attack.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

schedule

Claim 9: “In the US, federal audits of healthcare providers are conducted under the Health Insurance Portability and Accountability Act.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

verified

Claim 10: “The government held consultations with each sector this week.”

VERIFIED BY REFERENCE

This claim was extracted as a checkable statement from the article. eFinder labels it verified by reference based on the available evidence and source context shown below.

menu_book

wikipedia NEUTRAL — The animals of New Zealand, part of its biota, have an unusual history because, before the arrival of humans less than 900 years ago, the country was mostly free of mammals, except those that could sw…
https://en.wikipedia.org/wiki/Fauna_of_New_Zealand

menu_book

wikipedia NEUTRAL — Tourism in New Zealand comprised an important sector of the national economy – tourism directly contributed NZ$16.2 billion (or 5.8%) of the country's GDP in the year ended March 2019. As of 2016 tour…
https://en.wikipedia.org/wiki/Tourism_in_New_Zealand

help

Claim 11: “Currently, New Zealand has no single piece of legislation that mandates enforceable minimum cyber security requirements.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

schedule

Claim 12: “In the UK, any public or private organisation accessing patient data held by the public health system must complete a mandatory data security and protection toolkit annually.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

help

Claim 13: “Section 11 of the Privacy Act, which says healthcare providers remain responsible for information handled on their behalf, even when using IT service providers.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

schedule

Claim 14: “Rules regarding the retention and deletion of health data are found across multiple legislative codes. The ability to delete data is limited.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

schedule

Claim 15: “One patient reported their medical files were still uploading to Manage My Health two years after their doctor’s practice stopped using the platform.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

schedule

Claim 16: “Data is stored on foreign-owned servers, foreign laws may apply regardless of the physical location. This is particularly relevant when we consider the implications for Māori data.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

schedule

Claim 17: “Finland responded swiftly to a 2020 data breach at the private psychotherapy centre Vastaamo, mandating security audits for all healthcare providers, with no exceptions.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

verified

Claim 18: “Following a series of significant health data breaches, the government released a cyber security strategy and action plan to establish a national framework for responding to escalating cyber threats.”

VERIFIED BY REFERENCE

This claim was extracted as a checkable statement from the article. eFinder labels it verified by reference based on the available evidence and source context shown below.

menu_book

wikipedia NEUTRAL — The New Zealand men's national football team (Māori: Tīma hoka a-motu o Aotearoa) represents New Zealand in men's international football competitions. The team is governed by the governing body for fo…
https://en.wikipedia.org/wiki/New_Zealand_men's_national_foo…

menu_book

+ 3 more evidence sources

schedule

Claim 19: “We argue New Zealand needs mandatory security audits for all healthcare data systems. We hope the government will enforce this.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

help

Claim 20: “These security breaches have damaged trust in New Zealand’s entire health system. They are being investigated as part of a government review and an inquiry by the privacy commissioner.”

INSUFFICIENT EVIDENCE

This claim was extracted as a checkable statement from the article. eFinder labels it insufficient evidence based on the available evidence and source context shown below.

info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.