“For context, under the Privacy Act 2020 and the Health Information Privacy Code, the obligation to notify affected individuals sits with the agency that holds the information,” ManageMyHealth said. “Where health documents originate from multiple sources, there may be multiple data controllers with independent notification obligations. He said that under the Privacy Act, ManageMyHealth was responsible for keeping the data it held secure. “A cyber attack is criminal activity and any unlawful use of private client information will be subject to legal action and takedown orders. It urged people to be cautious about emails or communications they received, as scammers could exploit the situation by pretending to be from ManageMyHealth.

Source: New Zealand Herald January 05, 2026 18:22 UTC