HEHEHE DD broke it!!!

Media have reported details of the inquiries into MMH released today:

https://www.1news.co.nz/2026/05/27/managemyhealth-warned-before-massive-data-breach-inquiry/

https://www.rnz.co.nz/news/health/596425/privacy-commissioner-to-monitor-security-upgrades-after-manage-my-health-hack

https://www.nzherald.co.nz/nz/privacy-commissioner-inquiry-finds-managemyhealth-health-nz-at-fault-over-northland-data-hack/KZLFSJ6K7NCAJDP7NHOHK7IA4M/

Privacy Commission reporting:

https://www.privacy.org.nz/focus-areas/manage-my-health-inquiry/

Opinion (paywalled) on how weak our privacy laws are, headline "In Australia, Manage My Health would now be staring down the barrel of a $60m fine - Tech Insider":

https://www.nzherald.co.nz/business/in-australia-manage-my-health-would-now-be-staring-down-the-barrel-of-a-60m-fine-tech-insider/premium/2T6SSYXPANCQ7ONQE2KVIOSUHM/

New update when logging into the MMH portal today (wasn't there last week).

=====

For your convenience, below is a summary of what has been updated, in addition to formatting and numbering changes for easier readability.
Terms of Use

Section 2 – Use of ManageMyHealth and Your Obligations

Users must comply with the ManageMyHealth Privacy Policy when using ManageMyHealth.

Section 3 – Account Closure

A new Account Closure section explains how accounts can be closed, what happens if a healthcare provider stops using ManageMyHealth, how inactive accounts are handled, when account closure takes effect, and what happens to linked accounts.
Privacy Policy

Section 1.3 and 1.4 – Personal Information and Health Information

Personal Information is defined with reference to the Privacy Act 2020, and Health Information is defined with reference to the Health Information Privacy Code 2020, so it is clear what types of information are covered under the Privacy Policy.

Section 2.7 and 2.8 – Information from Healthcare Providers

Where personal or health information is provided by your healthcare provider, MMH receives and uses that information to operate and deliver its services. Your healthcare provider remains responsible for collecting and providing that information in accordance with Privacy Law.

Section 3 – Closure of Account

A new Closure of Account section explains what happens when a healthcare provider stops using ManageMyHealth, how you can close your account, how inactive accounts are handled, and what information may be deleted or retained after account closure.

Section 4.3 – Service Communications

MMH may contact you about your account, the security of your information, service changes, or matters required by law.

Your trust is important to us, and we want to ensure that you have complete clarity about our practices and policies.

If you have any questions or concerns, please do not hesitate to contact us at:
support@managemyhealth.co.nz

ACCEPT || CANCEL

=====

Logged in today to look for test results.

I was also forced to update my password - could not complete logon without doing so.

Closing the door after the horses have bolted!

Rikkitic:

 

Closing the door after the horses have bolted!

 

 

 

Better late than never. What's done is done.

It's painful they had to learn the lesson this way, but hopefully, they learned the lesson and we can expect better moving forward. 

As someone once told me, the safest jet in a fleet is the one that just had an issue and was checked from top to bottom.

How is MMH still around? Seems like everyone just ignored it and continued with business as usual.

boosacnoodle:

 

How is MMH still around? Seems like everyone just ignored it and continued with business as usual.

 

It's difficult to not use them when the GP practice and so many other medical entities (including laboratory testing and specialists) use them too.

boosacnoodle:

 

How is MMH still around? Seems like everyone just ignored it and continued with business as usual.

 

No, not really.  I wouldn't say they are to big to fail, but there is a huge dependency on it, not easily quickly shifted. 

With the 2 independent audits and the fact they seem to be making significant leaps in their security hygenie, so long as that is maintained, there is no guarantee you'd be better off with another provider. 

boosacnoodle:

 

How is MMH still around? Seems like everyone just ignored it and continued with business as usual.

 

How do you ignore it? As a patient I have no option if I want digital access to my records, it is what the practice uses - there is no choice. I would hope the practice looked at alternatives, but I imagine changing would be huge cost to the practice. Who's to say the others are any better? As @networkn says, this issue should have improved their security.

My practice switched to Tō Mai. I notice now that I can't go back in time in patient notes as far as MMH and I don't get notified as test results are added.

Our practice has just changed to Centrik Well, which appears to be locally developed in Christchurch. 10/10 for an app that finally lets you see an appointment calendar showing available bookings across the whole practice instead of having to dive in and out of each doctor's calendar to see if any of them are available. Kind of ironic that all of the emails advising that a new system was coming came via the Manage My Health platform though.

My local practice shifted to indici not long before the breech, but all my old data was still on mmh and the heath practice didn’t advise what to do. But they don’t allow us to book appointments or see when there are times and there is up to a month wait anyway. Kind of stupid because having it online allows people to see Slots that have been canceled.  

I received an email from Manage My Health this week, advising of a group message sent out by my medical practice. The email contained a link to click, and I was surprised that a software company that has been subject to a major security breach would promote the user behaviour of clicking links in emails. 

I manually went to the MMH site and logged in, and I found it very difficult to locate the group message that the email had referred to.

I'm really not convinced that MMH have learnt much from last year's fiasco. 

allan:

 

Our practice has just changed to Centrik Well, which appears to be locally developed in Christchurch. 10/10 for an app that finally lets you see an appointment calendar showing available bookings across the whole practice instead of having to dive in and out of each doctor's calendar to see if any of them are available. Kind of ironic that all of the emails advising that a new system was coming came via the Manage My Health platform though.

 

My practice has also switched to Well, I'm yet to set it up but this comment is encouraging

You used to be able to see an appointment calendar in MMH but they decided to change it so you had to go through each doctor to find an available appointment, it was freaking awful..