Data Breach Exposes Historical Records of Manage My Health Users

A significant data breach has potentially compromised the historical records of users from the health portal Manage My Health, affecting individuals whose general practitioners (GPs) no longer utilize the platform. The attack was reported to authorities in the early hours of December 31, 2022, and hackers are demanding a ransom of $60,000 (USD) to prevent the release of sensitive information related to approximately 120,000 patients.

Manage My Health serves as New Zealand’s largest health portal, facilitating the exchange of medical information between patients and their GPs. Following the breach, the company has begun notifying general practices about whether their patients’ data has been exposed. Individual notifications will also be sent to affected patients in compliance with the Privacy Act.

Many users have reported that despite their GP’s switch to a different platform, they were still able to log into Manage My Health to access their historical data. Vino Ramayah, the chief executive of Manage My Health, clarified that the company retains patient records unless an account is actively canceled by the user. He emphasized that patients must take the initiative to delete their accounts if they wish to remove their data from the portal.

“When a practice leaves Manage My Health, the patients have a choice to continue to use Manage My Health or close the application, in which case we will delete the data,” Ramayah stated. He also noted that the platform allows users to operate independently of their GP and urged users to exercise “a level of personal diligence” regarding their accounts.

Security Measures and Regulatory Compliance

Ramayah stressed the importance of security, advising users to change their passwords regularly and to enable two-factor authentication. He remarked, “I would encourage everyone to consider security as a very key part of your thinking, especially when you put sensitive information in an application, irrespective of whether it’s Manage My Health or any other healthcare app.”

The New Zealand Privacy Commissioner has outlined that health agencies should retain medical records only for as long as they have a lawful purpose. According to the Health (Retention of Health Information) Regulations 1996, health agencies are required to keep patient records for a maximum of ten years following the last service provided to that patient. This requirement does not apply if the files have been transferred to a new healthcare provider or if the complete file has been given to the patient or their executor.

In response to the breach, Manage My Health is setting up a dedicated helpline for affected patients. The company is also informing GPs who no longer use the platform about the breach and what steps they can take to assist their patients.

“The Privacy Act requires individuals to be notified when their information has been accessed in an unauthorized way,” the company stated. “Manage My Health is taking on this responsibility on behalf of the practices, providing information so that they can support their patients after notification.”

As this situation develops, the focus remains on ensuring that affected individuals receive the necessary support and information regarding the safeguarding of their personal health data.