16 October 2024
Frank
[FYI request #26383 email]
Tēnā koe Frank
Your request for official information, reference: HNZ00043507
Thank you for your email on 2 May 2024, extended on 29 May 2024, asking Health New
Zealand | Te Whatu Ora for the following under the Official Information Act 1982 (the Act):
1) Any audit findings, documents, and emails pertaining to the security of
Medtech and ManageMyHealth
2) Contracts and correspondence with ManageMyHealth concerning their integration
into the health identity portal by Te Whatu Ora, and the rationale behind
selecting them over other available software.
3) Information on any public health organisations utilising Medtech, along with
associated security and auditing details.
Response
I apologise for the delay in providing our response. The time taken is not what we aspire to.
This is something we are working to get on top of as we deal with a high volume of requests
and the understandably high public interest in our work.
For the sake of clarity, I will address each question in turn.
1. Any audit findings, documents, and emails pertaining to the security of Medtech and
ManageMyHealth.
To the best of our knowledge, Health NZ does not hold audit findings or similar.
Around five years ago or so, the Ministry of Health undertook security reviews of general
practice systems, which may have included Medtech and ManageMyHealth (MMH). Health NZ
does not have access to these reviews.
2. Contracts and correspondence with ManageMyHealth concerning their integration into
the health identity portal by Te Whatu Ora, and the rationale behind selecting them
over other available software.
Health NZ can advise there are no specific contracts in scope of your request.
During the 2021/22 financial year, the Data and Digital group (then part of the Ministry of
Health) approached all the major recognised providers of primary care patient portals to
participate with My Health Account (MHA), but only MMH came back with a realistic proposal
and self-funded resources to implement integrations on the MHA health identity service.
In terms of correspondence, we have enclosed all emails in scope of your request as
Appendix One. Please note, some information within these emails has been withheld under
9(2)(a) of the Act, to protect the privacy of individual persons, as well as 9(2)(c), to avoid
prejudice to measures protecting the health or safety of members of the public.
3. Information on any public health organisations utilising Medtech, along with associated
security and auditing details.
While Health NZ does hold some information on which organisations use Medtech, we are
unable to provide these details with this response, as they are commercially sensitive. As
such, we are withholding this information under section 9(2)(b)(ii) of the Act, to protect
information where the making available of the information would be likely unreasonably to
prejudice the commercial position of the person who supplied or who is the subject of the
information.
In making this decision, we have considered the public interest in releasing the information,
and do not consider that this public interest outweighs the harm identified above.
How to get in touch
If you have any questions, you can contact us at
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz
or by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may
proactively release a copy of this response on our website. All requester data, including your
name and contact details, will be removed prior to release.
Nāku iti noa, nā
Michael Dreyer
Director Sector Digital Channels
Data and Digital
TeWhatuOra.govt.nz
Health NZ, PO Box 793,
Wellington 6140, New Zealand
