12:00 pm today

PSA says the privacy breach exposes risk of cutting IT experts in public health

12:00 pm today
The Public Service Association (PSA) is urging the Auditor General to investigate proposed job cuts in crucial anti-fraud roles at Te Whatu Ora Health New Zealand.
PSA National Secretary Fleur Fitzsimons said Health NZ was proposing to remove 23 roles, a cut of 28 percent of the workforce, along with other changes.

National Secretary for PSA Fleur Fitzsimons is calling on the Privacy Commissioner to reconsider investigating the impact of cuts to Health NZ's digital services workforce. Photo: RNZ / Samuel Rillstone

The Public Service Association (PSA) says the security breach at privately run ManageMyHealth highlights the risk of cutting IT experts in public health.

It said the government had "blundered" when they cut off the jobs of many IT experts "safeguarding the public health system".

ManageMyHealth confirmed last week it had identified a security incident involving "unauthorised access" to its platform. It believed between 6 and 7 percent of the approximately 1.8 million registered users may have been impacted.

PSA national secretary Fleur Fitzsimons said the breach was a "wake-up call for the entire health sector in New Zealand".

"We have seen it before in the public health system with the Waikato Hospital ransomware attack in 2021, and yet this government failed to heed that lesson in forcing Health NZ to cut the jobs of experts running digital services.

"The risks are too high to play fast and loose with data systems - it's a ticking time bomb."

She said hospitals were using outdated systems but no longer had experts who could understand their weaknesses

Fitzsimons called on the privacy commissioner to reconsider a previous request by the PSA to investigate the impact of cuts to Health NZ's digital services workforce.

Independent review floated

Health Minister Simeon Brown previously said government agencies were working with ManageMyHealth to fully understand the scope of the breach and to protect the privacy of patients.

"This is a concerning breach of patient data and Health NZ is working closely with ManageMyHealth to ensure it is being appropriately addressed," he said.

"At this stage, there is no evidence any Health NZ systems, including My Health Account, have been compromised as ManageMyHealth has separate systems."

Shortly before midday on Saturday he said an incident management team had been established to support ManageMyHealth.

Brown said he had asked for advice from the Ministry of Health on options for an independent review of what occurred.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

Get the RNZ app

for ad-free news and current affairs