OIA Request: Manage My Health Data Breach

Today COLFO has submitted the following OIA regarding the recent Manage My Health data breach. The details and response will be recorded in our OIA database and made available to members when it is answered.

***

I request the following information regarding the cybersecurity incident involving unauthorised access to the Manage My Health platform, notified in late December 2025.

Please provide:

1. Details of the types of information accessed or potentially accessed in the breach, including but not limited to patient health documents, medical records, prescriptions, appointments, diagnoses, and any notes or entries in patient files.

   
   

2. Confirmation of whether information relating to patients' firearms licence status was included in the accessed or potentially accessed data. Health practitioners in New Zealand receive notifications from the Firearms Safety Authority when a patient holds or renews a firearms licence. Practitioners record this information in the patient's medical records, often in the social history section of the Patient Management System. Licensed firearms owners frequently have this detail documented in their medical records, which may be uploaded to or accessible via the Manage My Health portal.

   
   

3. Any analysis or findings on whether firearms licence-related information was exposed in this incident, including the number of affected patients if known.

   
   

4. Copies of any reports, summaries, or correspondence (redacted as necessary) shared with your agency regarding the scope of data exposed, particularly sensitive categories such as those noted above.

   
   

5. Details of steps taken to identify and notify patients whose firearms licence information may have been compromised.

I request this information in electronic form where possible. If any part of the request requires extension or refusal, please provide reasons under the Act.