New Zealand Privacy Commissioner Michael Webster released the second and final report into the December 2025 Manage My Health (MMH) breach, formally closing the section-17 inquiry. Around 91 per cent of affected patients were Northland hospital patients; the breach compromised more than 400,000 Health NZ documents and over 22,000 patient-uploaded files. The phase-two report found MMH retained contact details and non-activated accounts far too long — its 24-month dormant-account process should be reduced to deletion after three months — and that many patients were unaware they had portal accounts at all. It warned the "pace of government digitisation was a real cause for concern" and that the health sector was not ready for a "big digital one-stop shop". Phase one (May 2026) found MMH and Health NZ breached Rule 5 (reasonable security safeguards), with compliance notices issued in September. Health NZ said the phase-two report identifies no new privacy breaches.

• Source article