New Zealand Privacy Commissioner issues compliance notices over December 2025 health-sector cyberattack
Key Takeaways
- 01The Privacy Commissioner issued Compliance Notices to Manage My Health and Health New Zealand on 23 September 2026.
- 02The notices followed findings that the organisations did not meet Rule 5 security requirements during a December 2025 cyberattack.
- 03Rule 5 of the Health Information Privacy Code requires reasonable safeguards for health information.
- 04The notices identify seven areas where the organisations must strengthen their protections.
New Zealand’s Privacy Commissioner has issued Compliance Notices to Manage My Health and Health New Zealand after finding that they failed to meet the security requirements in Rule 5 of the Health Information Privacy Code during a December 2025 cyberattack.
Rule 5 requires agencies handling health information to protect it with reasonable safeguards against loss, unauthorised access, use, modification, disclosure and other misuse. The notices identify seven areas in which the organisations must improve their protections.
Manage My Health and Health New Zealand are directly affected and will need to address the requirements set out in the Compliance Notices. The action signals that the Privacy Commissioner may use formal enforcement powers where health-sector organisations’ cyber-security safeguards do not meet Rule 5 standards.