On 30 October 2026, the Privacy Commissioner's office closed a two-stage inquiry into the Manage My Health cyber incident, and most of the coverage this week will read that date as the moment enforcement arrived. It was not. The instrument that actually binds Manage My Health Limited and Health New Zealand, carrying a numbered scorecard and two hard deadlines reaching into 2027, was issued five weeks earlier, on 23 September, off a different report entirely.[1][2] A director who reads the headline and skips the notice is holding the wrong document, and in this case the wrong document is the one with the deadlines on it.
This is not a peculiarity of one inquiry. Regulators increasingly split their work into two kinds of document: an enforcement instrument, which compels action under a specific legal provision and carries dates, and a narrative report, which explains what happened and who was affected, often published later and read far more widely because it tells a story rather than listing obligations. The second kind gets the headline. The first kind gets filed and, too often, forgotten until an auditor, an insurer or a court asks for it. Manage My Health and Health New Zealand are not unusual in this respect. What is unusual is that both documents, in this case, are now public, dated, and comparable side by side.
The two-stage inquiry runs back to 21 January 2026, opened under section 17(1)(i) of the Privacy Act 2020 after a December 2025 breach at Manage My Health, a patient portal used across New Zealand's health system. Phase one, published 27 May 2026, examined security standards and found both the company and Health New Zealand in breach of rule 5 of the Health Information Privacy Code 2020, the rule requiring reasonable safeguards against loss, misuse or disclosure of personal health information.[3] Phase two, the 30 October release, examined how people were affected: who was told, how long it took, and what the community impact looked like.[4] It is a genuinely separate document, answering a genuinely separate question, and it closes the inquiry. It is not the enforcement action. The enforcement action is the pair of compliance notices the Commissioner's office issued on 23 September, built entirely off phase one's findings, each attaching to a different limb of rule 5: Manage My Health's notice under rule 5(1)(a), the duty to maintain safeguards; Health New Zealand's under rule 5(1)(b), the duty to do everything reasonably within its power to prevent a service provider misusing information it supplies.[1][5] Independent reporting of the notices puts the volume of information involved at more than 400,000 Health New Zealand documents and over 22,000 patient-uploaded documents taken from the portal's own records module.[6] A compliance notice is not a request. It is an enforceable instrument under the Privacy Act 2020, and where an entity does not comply, the Commissioner's office can take the matter to the Human Rights Review Tribunal for an order, the kind of enforcement teeth a narrative report never carries, however widely that report is read. Those notices carry the only forward-moving regulatory clock in this whole matter, and both deadlines were already running on the day phase two made headlines.
The clock is worth reading in full, because it is more specific than most compliance notices get. In developing the notices, the Commissioner's office identified seven areas of ineffective security. Three have since been fixed, and all three are the same kind of fix: improvements to multi-factor authentication. Four remain open.[1] Health New Zealand has until 29 January 2027 to complete the actions its notice requires. Manage My Health has until 31 August 2027 to complete everything remaining under its own.[1] That is the number a board can actually use, not as a judgement on Manage My Health specifically, but as a question to put to any vendor or internal team handling information this sensitive: if a regulator wrote you a notice with seven findings today, could you say, without checking, which three you had already closed?
The place the "closed inquiry equals settled matter" reading fails hardest is a single paragraph inside phase two, on a question the Commissioner's office chose not to answer at all. The report records "reservations about the length of time it took to notify some individuals," referring to the section 115 duty under the Privacy Act to tell affected people about a breach.[4] The office then states, in substance, that whether any delay actually amounted to a breach of that duty is not something it has decided; that question is left for an individual complaint to resolve, should one be made, rather than settled here.[4] Roughly fifty complaints about the incident have been lodged with the office and are moving through its ordinary dispute-resolution process, a figure reported once and not yet independently corroborated a second time, so it is offered here with that caveat attached rather than as a settled count.[7] One outlet's coverage of phase two separately describes Health New Zealand as having met its own notification obligations.[8] The office's own wording makes no finding either way, and does not say which entity's notifications are in question. Those two readings do not reconcile from the documents available, and this piece is not going to force them to. An individual complaint can still produce a finding under section 115 that the inquiry itself declined to make, which is exactly why the office left that door open rather than closing it along with everything else on 30 October. A closed inquiry that still has an open complaint channel on its single most consequential unresolved point is not a settled matter, whatever the date on the final report suggests.
The numbers around this incident reward the same discipline the two reports themselves apply, because at least one widely repeated figure for this breach was never the regulator's number at all. The confirmed count, stated in phase two, is 99,416 people affected.[4] For most of the past ten months, the figure in circulation was considerably higher, commonly rounded to around 126,000, and that figure traces to Manage My Health's own preliminary analysis, published in the first week of January 2026 and picked up by national media the same week.[9] None of the Commissioner office's own January statements, checked specifically for an initial count, gives one; the office's first published number is the 99,416 in phase two, ten months later.[10] So the drop from "about 126,000" to 99,416 is not a regulator revising its own estimate downward. It is the regulator's first published count superseding a vendor's unofficial early estimate that had, by then, travelled through months of reporting as if it were settled. The distinction matters beyond this one incident. A board that repeats the louder, earlier, vendor-sourced number in its own risk reporting is citing the party under investigation, not the regulator investigating it, and the two are not interchangeable sources no matter how often the larger figure appears in print. Phase two separately states that ninety per cent of those affected are patients of hospitals in Northland, a figure the Commissioner's office frames as a disproportionate impact on a single region, and on the Māori patients, whānau and health services within it, a finding the office draws explicitly as its own inference rather than one this piece is extending further.[11]
That Northland concentration is the clearest place the book's Kaitiakitanga Checklist applies on the facts rather than by habit, because the checklist's governing question is guardianship of information about a population that did not choose the platform holding it. Some of the people affected were not registered Manage My Health users at all; their records were drawn into non-activated portal accounts created on their behalf, through the ordinary administrative act of matching a hospital record to a patient. Guardianship, in that setting, is not a slogan about cultural sensitivity bolted onto a breach notice. It is the specific question of who decided an account should exist, on whose authority, and whether anyone checked that the account's existence served the person it was created for rather than only the system that created it. A checklist that only asks whether consent was technically obtained, without asking who benefits from the account's existence, would have passed this exact arrangement and still missed the point entirely. Phase two recommends that non-activated accounts be deleted after three months and that dormant account holders be contacted after twelve, against a retention period it found excessive at twenty-four months: two separate numbers doing two separate jobs, not one rule that a tired summary collapses into a single figure.[4]
The Hour-Zero Protocol is useful here for a narrower, less flattering reason than usual: not as a verdict on how fast Manage My Health or Health New Zealand moved, which neither report frames as a timeliness failure at the point of notifying the regulator, but as a reminder of how differently "fast" and "resolved" can read from the outside. The office's own account is that Manage My Health notified it within an expected window of about seventy-two hours of discovering the breach, a response time nobody involved treats as inadequate.[4] The separate, unresolved question about notifying affected individuals, the one phase two declines to rule on, shows that meeting one clock cleanly tells a board nothing about whether every other clock in the same incident was met. A board that only asks "how fast did we tell the regulator" has asked the easy half of the Hour-Zero question and skipped the one a regulator was still unwilling to answer ten months later.
What this leaves a board with is less a lesson about Manage My Health specifically than a short, repeatable checklist for reading any compliance notice its own organisation might one day receive, or any vendor notice it is handed to review. First: which document is the enforcement instrument, and which is the narrative report, because they are rarely published on the same day and rarely by the same logic. Second: of the findings in that instrument, how many are fixed, how many remain open, and against which dates. Third: is there a limb of the relevant notification law the regulator has declined to rule on, because that is the limb still carrying risk after everything else has been called closed. Fourth: whose guardianship question does this breach actually raise, and does the retention and account-creation policy answer it, or only describe it.
There is a fifth question worth adding for any board whose own exposure runs through a vendor rather than directly: does your contract with that vendor require it to forward a compliance notice, or any equivalent regulatory instrument, to you within a fixed number of days of receiving it? A notice addressed to a vendor is still, in substance, a notice about your customers' data. Several of the governance gaps this incident surfaces, non-activated accounts created without a clear collection purpose and a retention period nobody had revisited in years, are exactly the kind of thing a vendor assurance review is supposed to catch before a regulator does. Asking whether your own vendor review would have found three of Manage My Health's seven gaps is a more useful exercise than asking whether the company's own review did.
The open-source dimension sits in the standard, not the vendor. Manage My Health's own code is closed; nobody outside the company and its regulator has seen it. The portal exchanges patient data through HL7's Fast Healthcare Interoperability Resources standard, FHIR, open enough to read, implement and test[12] through projects such as HAPI FHIR, an Apache-licensed implementation anyone can run against their own system.[13] A vendor's claim to meet a security control cannot be checked that way. A claim to implement an open standard can, because the standard and its conformance tests are both public. That gap, one claim checkable by any practitioner, the other checkable only by a regulator with statutory notice powers, is close to why this inquiry needed two reports and still left a question unanswered. An open standard does not make a system secure. It makes a vendor's claims about it contestable, which a compliance notice alone does not.
New Zealand's compliance notice regime is generic: the same Health Information Privacy Code rule applies whether the breach touches a hospital portal or a parking app. The United States treats healthcare as its own critical infrastructure sector and has published sector-specific Cybersecurity Performance Goals for it, naming the controls a hospital or health system is expected to carry, essential and enhanced, rather than leaving the standard to be inferred from a privacy regulator's enforcement notice after the fact.[14] That sector-specific floor is one New Zealand's own critical infrastructure consultation has not yet settled. A related access question has nothing to do with legislation at all: Google's staged rollout of its top-ranked Gemini 4 Carbon security model names healthcare providers among the vetted defenders eligible for early access, yet a health system under an active compliance notice is, for now, exactly the organisation that cannot buy it.[15][16]
A second, smaller instance from the same fortnight makes a related point. The Ministry of Justice's own Chief Operating Officer confirmed on 27 October 2026 that a separate incident, affecting a contracted provider named ZenTech, exposed some Coroners Court information from the Otago and Southland region, mostly dated between 2016 and 2022; a dedicated helpline, 0800 638 924, is open on weekdays for affected families.[17] The detail worth carrying forward is not either agency's performance. It is that two unrelated health-and-justice-adjacent incidents, in the same fortnight, both turned on a third-party provider's access to records nobody still using the current system had reason to think about.
Two running deadlines now sit quietly past the news cycle that will soon forget them: 29 January 2027 and 31 August 2027. Neither will generate a headline on the day it lands, the way 30 October did. Both will determine, as a matter of public record, whether a Crown entity and a private health technology company closed out findings a regulator wrote down in May. The lesson for every other board watching this from outside the health sector is not about Manage My Health's particular failures. It is that the loudest published document about an incident and the one that actually binds an organisation to a date are very often not the same piece of paper, and the only way to tell them apart is to go and look. That holds whether the notice in question comes from a privacy regulator, a financial regulator, or an insurer's own policy conditions. The format changes. The discipline of finding the instrument with the date on it does not.
If your organisation received a regulator's compliance notice tomorrow, with a numbered scorecard and a hard date attached to each unresolved item, could your board name, without checking, which findings were already closed and which were not?
If your board wants an independent AI and cyber risk briefing, or a review of what your vendor's assurance actually verified, message me and I will send the scope and the fixed fee.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. Through Te Pono he provides independent AI and cyber risk briefings and vendor assurance reviews to boards; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] Office of the Privacy Commissioner. "Privacy Commissioner issues compliance notices to Manage My Health and Health NZ." 23 September 2026. https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/
[2] RNZ. "Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach." 23 September 2026. https://www.rnz.co.nz/news/health/1530878/privacy-commissioner-puts-manage-my-health-health-nz-on-notice-after-data-breach
[3] Office of the Privacy Commissioner. "Executive Summary: Manage My Health Phase One." 27 May 2026. https://www.privacy.org.nz/focus-areas/manage-my-health-inquiry/executive-summary-manage-my-health-phase-one/
[4] Office of the Privacy Commissioner. "Manage My Health Phase Two Report." 30 October 2026. https://www.privacy.org.nz/focus-areas/manage-my-health-inquiry/manage-my-health-phase-two-report/
[5] Insurance Business NZ. "Privacy Commissioner splits cyber responsibility between two organisations." 24 September 2026. https://www.insurancebusinessmag.com/nz/news/cyber/privacy-commissioner-splits-cyber-responsibility-between-two-organisations-590844.aspx
[6] idm.net.au. "Compliance notices follow NZ health breach." September 2026. https://idm.net.au/article/0015803-compliance-notices-follow-nz-health-breach
[7] Reseller News. "Manage My Health inquiry exposes breach response and vendor accountability gaps." 30 October 2026. https://www.reseller.co.nz/article/4242552/manage-my-health-inquiry-exposes-breach-response-and-vendor-accountability-gaps.html
[8] RNZ. "Pace of government digitisation a real cause for concern, says Manage My Health inquiry." 30 October 2026. https://www.rnz.co.nz/news/health/2230243/pace-of-government-digitisation-a-real-cause-for-concern-says-manage-my-health-inquiry
[9] 1News. "Manage My Health breach: 50% of affected patients contacted." 8 January 2026. https://www.1news.co.nz/2026/01/08/manage-my-health-breach-50-of-affected-patients-contacted/
[10] Office of the Privacy Commissioner. "Information for people impacted by the Manage My Health data breach." January 2026. https://www.privacy.org.nz/tuhono-connect/statements-media-releases/information-for-people-impacted-by-the-manage-my-health-data-breach/
[11] Office of the Privacy Commissioner. "Final report into Manage My Health inquiry a wake-up call for agencies." 30 October 2026. https://www.privacy.org.nz/tuhono-connect/statements-media-releases/final-report-into-manage-my-health-inquiry-a-wake-up-call-for-agencies/
[12] HL7 International. "FHIR, Fast Healthcare Interoperability Resources." https://www.hl7.org/fhir/
[13] HAPI FHIR Project. "HAPI FHIR, the open source FHIR API for Java." https://hapifhir.io/
[14] US Department of Health and Human Services. "Healthcare and Public Health Sector Cybersecurity Performance Goals." https://hhscyber.hhs.gov/cybersecurity-performance-goals.html
[15] SecurityWeek. "Google says Gemini 4 Carbon leads in finding, exploiting and fixing vulnerabilities." 30 October 2026. https://www.securityweek.com/google-says-gemini-4-carbon-leads-in-finding-exploiting-and-fixing-vulnerabilities/amp/
[16] Forbes. "Google limits Gemini 4 Carbon to vetted cyber defenders." 30 October 2026. https://www.forbes.com/sites/janakirammsv/2026/10/30/google-limits-gemini-4-carbon-to-vetted-cyber-defenders/
[17] Ministry of Justice. "Statement on ZenTech cyber security incident." 27 October 2026. https://www.justice.govt.nz/about/news-and-media/media-releases/statement-on-zentech-cyber-security-incident/