HNZ00043507 Appendix 1 Part 3.pdf

From:
Asfahaan Mirza
To:
Jeanette Elley; Digital Health Identity Integration; Alan Monnox; Sanju Nannuri
Cc:
Samuel Wong; Rama Kumble
Subject:
Re: MHA production redirect URLs please?
Date:
Monday, 10 October 2022 10:28:48 am
Attachments:
image001.jpg
image002.jpg
Dear Alan
Please send them through to me and Sanju.
If it can only be one person, send them through to me.
Thank you.
Kind Regards
Asfahaan
From: Jeanette Elley 9(2)(a)
1982
Date: Monday, 10 October 2022 at 9:59 AM
To: Digital Health Identity Integration <[email address]>, Alan Monnox
Act
<[email address]>, Sanju Nannuri 9(2)(a)
Asfahaan
Mirza 9(2)(a)
Cc: Samuel Wong 9(2)(a)
Rama Kumble 9(2)(a)
Subject: RE: MHA production redirect URLs please?
Thanks @Alan.
I suspect that will be fine to send the production credentials to @Asfahaan.
Information
We’ll let you know promptly if it should be anyone else.
Regards
Jeanette E.
From: Megan Robinson <[email address]> On Behalf Of Digital Health Identity
Official
Integration
Sent: Monday, 10 October 2022 9:55 am
the
To: Alan Monnox <[email address]>; Sanju Nannuri 9(2)(a)
Cc: Jeanette Elley 9(2)(a)
Subject: RE: MHA production redirect URLs please?
Good morning all,
under
Once the Prod Details and Credentials are available these will be sent through via encrypted
email.
We usually send these details through to the contact person listed on the onboarding request
form - in this case that would be Asfahaan. If you would like these details to be sent to someone
else just let us know.
Many thanks,
Released
Digital Health Identity Integration Team
Te Whatu Ora – Health New Zealand
From: Alan Monnox <[email address]>
Sent: Friday, 7 October 2022 2:14 pm

To: Sanju Nannuri 9(2)(a)
Cc: Jeanette Elley 9(2)(a)
; Digital Health Identity Integration
<[email address]>
Subject: RE: MHA production redirect URLs please?
Hi Sanju,
Thanks for confirming. We’ll set you up in prod for Web and SPA.
Alan
From: Sanju Nannuri 9(2)(a)

Sent: Friday, 7 October 2022 1:31 pm
To: Alan Monnox <[email address]>
Cc: Jeanette Elley 9(2)(a)
Subject: RE: MHA production redirect URLs please?
Hi Alan
1982
Please enable for both.
Regards
Act
Sanju
From: Alan Monnox <[email address]>
Sent: Friday, 7 October 2022 9:03 AM
To: Sanju Nannuri 9(2)(a)
Cc: Jeanette Elley 9(2)(a)
Subject: RE: MHA production redirect URLs please?
Hi Sanju,
Information
For production do you need support for Web app and SPA or is it just Web?
Currently we have you set up for both Web and SPA in the INT environment.
Can you confirm?
Thanks,
Alan
Official
From: Sanju Nannuri 9(2)(a)

Sent:
the
Wednesday, 5 October 2022 6:14 pm
To: Alan Monnox <[email address]>
Cc: Jeanette Elley 9(2)(a)
Subject: FW: MHA production redirect URLs please?
under
Hi Alan
Here are the redirect Url for MMH Production site.
9(2)(c)
Regards
Sanju
Released
From: Jeanette Elley 9(2)(a)

Sent: Tuesday, 4 October 2022 10:07 AM
To: Sanju Nannuri 9(2)(a)
Cc: Asfahaan Mirza 9(2)(a)
; Rama Kumble 9(2)(a)
Manvir Singh 9(2)(a)
Subject: MHA production redirect URLs please?
Hi @Sanju,
You are probably the best person to provide Alan with the redirect URLs for MHA production I
expect.

See email below.
Thanks & Regards
Jeanette E.
From: Alan Monnox <[email address]>
Sent: Tuesday, 4 October 2022 1:04 pm
To: Jeanette Elley 9(2)(a)
Cc: Robyn Tipene <[email address]>; Digital Health Identity Integration
<[email address]>
Subject: RE: Manage My Health | Onboarding Status Update
Hi Jeanette,
If you know the redirect URIs for production can you send them through and I can get the
paperwork started to set up your access.
Cheers,
1982
Alan
From: Robyn Tipene <[email address]>
Act
Sent: Tuesday, 4 October 2022 11:40 am
To: Jeanette Elley 9(2)(a)
Asfahaan Mirza 9(2)(a)
Alan
Monnox <[email address]>; Sushant Balajee <[email address]>
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject: RE: Manage My Health | Onboarding Status Update
Information
Morena all,
Jeanette, really appreciate you pushing this forward on your end. Please find the attached fully
approved versions of the NDA and Systems Terms of Use. Once we have the security side of
things nailed down, Alan will submit a service request to generate your production credentials.
@Alan Monnox please include me on the service request / comms to Unify. I have given the
Official
Unify Head of Managed Services, a heads up that this coming and that it is a priority.
Thanks again everyone! Almost there.
the
Robyn
From: Jeanette Elley 9(2)(a)

Sent: Monday, 3 October 2022 3:18 pm
under
To: Robyn Tipene <[email address]>; Asfahaan Mirza 9(2)(a)
Alan Monnox <[email address]>; Sushant Balajee
<[email address]>
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Released
Subject: RE: Manage My Health | Onboarding Status Update
Hi @Robyn,
Please find signed contract attached.
Regards
Jeanette E.
From: Robyn Tipene <[email address]>
Sent: Monday, 3 October 2022 11:21 am
To: Jeanette Elley 9(2)(a)
Asfahaan Mirza 9(2)(a)
Alan
Monnox <[email address]>; Sushant Balajee <[email address]>

Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject: Manage My Health | Onboarding Status Update
Importance: High
Good morning,
@Jeanette Elley any progress on your end regarding commercial approvals. Do we have an ETA?
@Alan Monnox and @Sushant Balajee can you please confirm if we are happy with the Security
Details provided.
We need to close this out as soon as possible please.
Regards,
Robyn
From: Jeanette Elley 9(2)(a)

1982
Sent: Wednesday, 28 September 2022 6:05 pm
To: Robyn Tipene <[email address]>; Asfahaan Mirza 9(2)(a)
Cc:
Act
Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject: RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Hi Robyn,
Apologies for the delay. I have been chasing this today, and I understand that signing is
Information
underway.
Be back in touch soon.
Regards
Jeanette E.
From: Robyn Tipene <[email address]>
Official
Sent: Wednesday, 28 September 2022 6:02 pm
To: Jeanette Elley <9(2)(a)
Asfahaan Mirza 9(2)(a)
the
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject:
under
RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Kia ora,
Any update on progressing the Terms of Use sign-off.
Robyn
Robyn Tipene
Released
Product Delivery Manager
Data & Digital
waea pūkoro: 9(2)(a)
īmēra: [email address]
133 Molesworth Street, Wellington | PO Box 5013, Wellington 6140
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
From: Robyn Tipene

Sent: Friday, 23 September 2022 11:56 am
To: Jeanette Elley 9(2)(a)
Asfahaan Mirza 9(2)(a)
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject: RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Importance: High
Morena Jeanette, Asfahaan,
We really appreciate you turning this around quickly. We have reviewed, made some minor
amendments for greater clarity, in the appendix section.
The finalised version is attached for your internal approval. If you could return the approved
document and we will finalise approvals on our end.
1982
Many thanks again.
Nga mihi
Robyn
Act
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 22 September 2022 5:22 pm
To: Robyn Tipene <[email address]>; Asfahaan Mirza 9(2)(a)
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
; Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Information
Subject: RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Hi Robyn,
Thanks for your prompt reply.
I attach a second draft of the “Terms of Use” document, with all required sections completed by
Official
MMH as requested.
Please let us know if we have missed anything, or whether you require any further changes or
the
additions.
We will be all ready to sign once you have approved our revisions.
Thanks & Regards
Jeanette E.
under
From: Robyn Tipene <[email address]>
Sent: Thursday, 22 September 2022 4:55 pm
To: Jeanette Elley 9(2)(a)
Asfahaan Mirza 9(2)(a)
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
; Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Released
Robinson <[email address]>
Subject: RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Kia ora Jeanette,
Thank you for your inquiry regarding clause 9.2.4.
As you have indicated that the access to the information would be in relation to a support
function only, and that the consumer in question will authorise access to their own information,
we confirm that we do not consider that this will breach the requirements that MHA data not be
transferred or stored outside New Zealand. As you indicate, the data is ultimately MMH
information, which you are responsible for managing securely. A consumer would be required to

provide the details that MHA can make available to MMH, whether or not the consumer chooses
to use the MHA mechanism of identifying themselves. Once the information is in use within
MMH we consider that it would not be a breach of clause 9.2.4 if a consumer was to seek
assistance from your support services.
Hopefully this clarifies your query.
Nga mihi,
Robyn
Robyn Tipene
Product Delivery Manager
Data & Digital
waea pūkoro: 9(2)(a)
īmēra: [email address]
133 Molesworth Street, Wellington | PO Box 5013, Wellington 6140
1982
Act
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 22 September 2022 1:11 pm
To: Robyn Tipene <[email address]>; Asfahaan Mirza 9(2)(a)
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Information
Robinson <[email address]>
Subject: RE: REVIEW | Draft My Health Account Service Terms of Use - query re overseas MMH
support team
Hi Robyn,
Thanks for the draft Terms of Use contract.Official
We are working through it and should have it back to you shortly.
We just have one question in regard to clause 9.2.4 which states –
the
“9.2.4 that no MHA Data will be transferred or stored or made available to any person outside
New Zealand by the Supplier unless in compliance with the Privacy Act and as authorised by HNZ
in writing”.
As far as data storage and general use is concerned, MMH is fully compliant with this clause.
under
However, MMH does have a support team based in India who under some conceivable
circumstances may, in the course of assisting a user (and with their consent), be exposed to their
live MMH data, which may have been originally sourced from MHA.
We are wondering whether you consider that this is a situation which needs to be “authorised by
MHA in writing”?
Thanks for your assistance.
Released
Regards
Jeanette E.
From: Robyn Tipene <[email address]>
Sent: Monday, 19 September 2022 11:13 am
To: Asfahaan Mirza 9(2)(a)
; Jeanette Elley 9(2)(a)
Cc: Dylan Nyika <[email address]>; Fiona 9(2)(a)
Fiona Wakefield
<[email address]>; Gerard Keenan <[email address]>; Megan
Robinson <[email address]>
Subject: REVIEW | Draft My Health Account Service Terms of Use

Importance: High
Good morning,
Please find the attached My Health Account system terms of use for review and consideration.
Please let me know if you would like us to organise a meeting to discuss collectively.
Apologies for the delays getting this through to you.
Regards,
Robyn
Robyn Tipene
Product Delivery Manager
Data & Digital
waea pūkoro: 9(2)(a)
īmēra: [email address]
133 Molesworth Street, Wellington | PO Box 5013, Wellington 6140
1982
Act
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
Information
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
Official
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
the
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
under
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
Released
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.

If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
1982
****************************************************************************
Act
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
Information
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
Official
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
the
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
under
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
Released
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.

From:
Alan Monnox
To:
"Jeanette Elley"; Dylan Nyika; Bhumika Talsania; Robyn Tipene
Cc:
"Asfahaan Mirza"; "Sanju Nannuri"; "Rama Kumble"; "Karanti Kaur Shergill"; "Samuel Wong"
Subject:
RE: No meeting needed today?
Date:
Friday, 16 September 2022 2:48:00 pm
Attachments:
image001.png
Hi Jeanette,
That’s understood with the nickname. We will keep the claim enabled in your app registration.
With the security assessment, our preference is to receive a report that has been prepared by an
independent party. However, if that is a problem due to timeframes then we would accept an
internal review.
If internal, the report needs to cover the baseline questions on the compliance page as well as
either the low risk or medium risk solution questions. In the case of MMH, the medium solution
is probably appropriate but you can make this call as you work through your assessment.1982
Here is the link to the compliance page:
9(2)(c)
Act
Please let me know if you have any questions.
Cheers,
Alan
From: Jeanette Elley 9(2)(a)

Sent: Friday, 16 September 2022 12:09 pm
To: Dylan Nyika <[email address]>; Bhumika Talsania
Information
<[email address]>; Alan Monnox <[email address]>; Robyn
Tipene <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
; Sanju Nannuri 9(2)(a)
Rama Kumble 9(2)(a)
; Karanti Kaur Shergill 9(2)(a)
Official
Samuel Wong 9(2)(a)
Subject: RE: No meeting needed today?
the
Hi Alan,
Thanks for checking. Yes, we are using Nickname. At our end we store it into our pre-existing
field called “Preferred Name”.
Apologies for the ambiguity.
under
In the report I grouped all name fields together and just referred to “Full Name”. That was
intended to include First Name, Middle Name, Surname, and Nickname.
Thanks & Regards
Jeanette E.
From: Dylan Nyika <[email address]>
Sent: Friday, 16 September 2022 12:04 pm
Released
To: Jeanette Elley 9(2)(a)
; Bhumika Talsania
<[email address]>; Alan Monnox <[email address]>; Robyn
Tipene <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Rama Kumble 9(2)(a)
; Karanti Kaur Shergill 9(2)(a)
Samuel Wong 9(2)(a)
Subject: RE: No meeting needed today?
Thanks Jeanette.
@Alan Monnox, is currently confirming the requirement around the internal vs external report

and will come back to you.
One other question that has popped up while working on the business contract: are you
currently using the ‘Nickname’ attribute? It was not listed in your Brief Privacy Analysis, but I
believe it was one of the attributes you are configured to receive. If you don’t need it we will
remove it from the attribute list.
Many thanks,
Dylan
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 15 September 2022 9:45 am
To: Dylan Nyika <[email address]>; Bhumika Talsania
<[email address]>; Alan Monnox <[email address]>; Robyn
Tipene <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
; Sanju Nannuri 9(2)(a)
;
1982
Rama Kumble 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Samuel Wong 9(2)(a)
Subject:
Act
RE: No meeting needed today?
Hi Dylan,
Thanks for the update. I see no need for a meeting today.
1.  Regarding the PIA, MMH has a full system PIA document, but it is not currently publicly
available. An updated version is underway and should be completed shortly. I’ll keep you
posted on availability for that one.
2.  For the business contract, that’s fine, just let us know when ready.
Information
3.  For the security report, I’d just like to check that, as outlined on your compliance page,
either an external report or an internal report would be acceptable?
Thanks & Regards
Jeanette E.
From: Dylan Nyika <[email address]>
Official
Sent: Thursday, 15 September 2022 9:33 am
To: Bhumika Talsania <[email address]>; Jeanette Elley
the
9(2)(a)
Alan Monnox <[email address]>; Robyn Tipene
<[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
under
Rama Kumble 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Samuel Wong 9(2)(a)
Subject: RE: No meeting needed today?
Hi Jeanette,
Regarding the PIA, the team has reviewed and are happy with the content in relation to the
MMH / MHA integration. Can you please confirm that you’ve previously completed a PIA for the
Released
Manage My Health product itself? Is this publicly available?
Regarding the Business Contract/Terms of Use – apologies, this is still in progress. We have a
version however are just trying to align with any other standard contracts in use at Te Whatu
Ora. Hopefully this will be resolved soon and we’ll be able to get this over to you.
We’re happy to cancel the meeting unless you would like to discuss any of the above?
Many thanks,
Dylan
From: Bhumika Talsania <[email address]>
Sent: Thursday, 15 September 2022 8:55 am
To: Jeanette Elley9(2)(a)
; Dylan Nyika <[email address]>; Alan

Monnox <[email address]>; Robyn Tipene <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
;
Rama Kumble 9(2)(a)
; Karanti Kaur Shergill 9(2)(a)
;
Samuel Wong 9(2)(a)
Subject: RE: No meeting needed today?
Hi Jeanette,
There might be a need to have a quick catch up, but I will discuss with the team internally and
get back to you.
Thanks and Regards,
Bhumika Talsania
Delivery Lead
Data & Digital
9(2)(a)
1982
E [email address]
From: Jeanette Elley 9(2)(a)

Sent:
Act
Thursday, 15 September 2022 8:45 am
To: Bhumika Talsania <[email address]>; Dylan Nyika
<[email address]>; Alan Monnox <[email address]>; Robyn Tipene
<[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Rama Kumble 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Samuel Wong 9(2)(a)
Information
Subject: No meeting needed today?
Hi @Bhumika,
At our end we don’t feel that we need a meeting today. Do you agree?
However, if you have anything you need to raise then we could still meet if it seems that would
be beneficial.
Official
As far as I am aware, there are two tasks outstanding –
1. Business contract (from MHA)
the
2. Security report (from MMH)
With regards to the security report, according to your guidelines, MMH appears to have two
options, either an external report, or an internal report (answering the questions listed at the
bottom of the page). under
Note that, as mentioned in the privacy assessment, we consider our solution to be low risk,
because the data provided by My Health Account to Manage My Health is no different from
personal data that MMH already collects, stores, and manages.
My understanding is that MMH is still pursuing the external report option at this stage, but if
that appears to be taking too long, we may consider the alternative of the internal report, as
suggested on your page.
Released
Let me know if you require, or have, any further clarifications.
Thanks & Regards
Jeanette Elley PhD
Senior Business Analyst / Project Manager
9(2)(a)

W: managemyhealth.co.nz

1982
Act
Information
Official
the
under
Released

From:
Jeanette Elley
To:
Robyn Tipene; Bhumika Talsania; Asfahaan Mirza; Sanju Nannuri; Karanti Kaur Shergill; Rama Kumble;
Dylan Nyika; Alan Monnox
Cc:
Fiona Wakefield (MoH); Fiona
Subject:
RE: Manage My Health | Onboarding
Date:
Thursday, 8 September 2022 10:14:44 am
Attachments:
image001.jpg
Hi All,
Thanks for the update.
1.  As far as we are concerned the privacy report is complete, but I suspect you will need to
check it at your end.
2.  We look forward to receiving the business contract from you.
3.  We are still working on the security report. I hope to have an update on that within a few
days.
1982
Thanks & Regards
Jeanette E.
Act
From: Robyn Tipene <[email address]>
Sent: Thursday, 8 September 2022 10:02 am
To: Bhumika Talsania <[email address]>; Asfahaan Mirza
9(2)(a)
Sanju Nannuri 9(2)(a)
Karanti Kaur Shergill
9(2)(a)
Rama Kumble9(2)(a)
Jeanette Elley
9(2)(a)
Dylan Nyika <[email address]>; Alan Monnox
<[email address]>
Information
Cc: Fiona Wakefield <[email address]>; Fiona 9(2)(a)
Subject: RE: Manage My Health | Onboarding
Hi all,
With regards to my action below, Dylan is reviewing/making some updates. I will send through a
Official
draft today for our MMH team to work through. Asfahaan, I will send this through to you.
Regards,
Robyn
the
From: Bhumika Talsania <[email address]>
Sent: Thursday, 8 September 2022 9:57 am
To: Robyn Tipene <[email address]>; Asfahaan Mirza 9(2)(a)
;
under
Sanju Nannuri 9(2)(a)
Karanti Kaur Shergill <9(2)(a)
Rama Kumble 9(2)(a)
Jeanette Elley 9(2)(a)
Dylan
Nyika <[email address]>; Alan Monnox <[email address]>
Subject: RE: Manage My Health | Onboarding
Hi All,
Jeanette has proposed that we cancel the meeting today, and I just wanted to go through
Released
pending items and get an update:
Test results in INT à Complete. This activity is now complete as all onboarding tests have
been marked as compliant
Complete Privacy Impact Assessment à Jeanette has sent through the Privacy Analysis via
email. What are the next steps on this?? Can this be marked as complete??
Complete certification and accreditation à Pending. Could you provide an update on that
@Jeanette Elley
Complete commercials and terms of use à Pending. @Robyn Tipene was working on
that. In Progress.
Is there anything else we need to follow up on??

1982
Act
Information
Official
the
under
Released

This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway
1982
Act
Information
Official
the
under
Released

From:
Jeanette Elley
To:
Bhumika Talsania; Dylan Nyika; Alan Monnox
Cc:
Asfahaan Mirza; Karanti Kaur Shergill; Manvir Singh; Sanju Nannuri; Rama Kumble
Subject:
Privacy analysis document
Date:
Thursday, 8 September 2022 9:44:57 am
Attachments:
image001.png
MMH MHA Identity Integration -Brief-Privacy-Analysis 1 Sep 2022.pdf
Hi @Bhumika,
Please find the required privacy analysis document attached.
This report is based upon a template provided by the Privacy Commission.
Thanks & Regards
Jeanette Elley PhD
Senior Business Analyst / Project Manager
1982
9(2)(a)

W: managemyhealth.co.nz
Act
Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email,
any use, forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error,
immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will
Information
preserve the contents of any email message that you send us if we believe that we have an obligation to do so and we will otherwise
comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us
may be monitored for the purposes of quality control, systems administration and compliance. You should check for virus and other
harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this
email as content can become corrupted in transmission. Our liability is limited only to re-supplying any affected attachment if
applicable
Official
the
under
Released

From:
Bhumika Talsania
To:
Jeanette Elley
Cc:
Asfahaan Mirza; Sanju Nannuri; Alan Monnox; Dylan Nyika; Robyn Tipene; Manvir Singh; Karanti Kaur Shergill; Rama
Kumble
Subject:
RE: No meeting needed today - list of remaining tasks
Date:
Monday, 5 September 2022 3:01:34 pm
Attachments:
image001.jpg
image002.png
Hi Jeanette,
Alan, Dylan and I came together to discuss the items listed in your email. Please find below some
responses and next steps:
1.  Thank you for the suggested (optional) improvements that Alan emailed through last week. We
propose incorporating some of your suggestions into the next phase of the project.
a.  Thanks for that and we acknowledge that we are happy for you to incorporate the changes
in the next phase
2.  We emailed a video link demonstrating the change of MHA email requirement. Let us know if that
will suffice?
1982
a.  We have checked the video and are happy with that.
b.  Based off that, we did an evaluation for our compliance test scenarios and there is one more
to tick off the list. Could you please send us a demo recording for that
Act
Test Case
Objective
Outcome
1
Login - Confirm your application is correctly integrated Compliant
Sign-in or with the Digital Health Identity service and that
sign-up
a My Health Account holder can either login
success
securely from your application or login by
following the sign-up flow.
Information
2
Login - Demonstrate how your application can handle Pending
Consent
the scenario where the My Health Account
declined
holder declines to give consent to share claim
information.
Official
3
Login - In the case of a RealMe account holder failing to Compliant
RealMe
authenticate, demonstrate your application can
the
errors
successfully handle the errors returned by
RealMe.
4
Login - Confirm that a user of your application can still Compliant
email
login after changing the email address
under change associated with their My Health Account using
the self-service portal.
5
Claims - Demonstrate your application can retrieve the Compliant
Retrieval
account holder’s confidence level from the
Digital Health Identity service.
Released
6
Claims - Show your application can prevent the account Compliant
Confidence
holder from accessing restricted information if
level
their identity confidence level is not at the
required level.
7
Claims - This scenario covers the capability of your Compliant
Self-service
application to respond to changes made by the
attribute
My Health Account in the self-service portal
change
after they have authenticated. For example, the
account holder may bind to their CPN number
or increase their confidence_level after
completing the login process.

Using either a walkthrough of a business
process or through demonstration, where
applicable, show how your application handles
changes to claims made during the current end-
user session.
8
Branding - Demonstrate your application complies with the Compliant
Compliance My Health Account branding guide.
Note: You can log into MHA and then “revoke” sharing with a connected
application, in case you do not receive the consent page on login
3.  I have written the privacy analysis document. I will send it to you shortly.
a.  Pending action on MMH prior to completing compliance
4.  We still need to get you a security report including evidence of a pen test.
a.  Pending action on MMH prior to completing compliance
5.  We still need to draw up a business contract. If you have a draft format you would like us to use for
1982
this, then please let us know.
a.  Action is with Robyn. Will keep you informed on progress
6.  Our mobile app is not yet ready to go, so we may need to make contact with you again in the
Act
future for mobile app sign-off, once it is ready.
a.  Acknowledged
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
Information
From: Robyn Tipene <[email address]>
Sent: Thursday, 1 September 2022 10:02 am
To: Bhumika Talsania <[email address]>; Jeanette Elley 9(2)(a)
;
Dylan Nyika <[email address]>; Alan Monnox <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
; Manvir
Official
Singh 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
; Rama Kumble
9(2)(a)
Subject: RE: No meeting needed today - list of remaining tasks
the
Hi all,
Regarding point 5 below, this action is with me. I am waiting for our lawyer to return from leave. She will
be back on deck next week.
Robyn
under
Robyn Tipene
Product Delivery Manager
Data & Digital
waea pūkoro:
īmēra: [email address]
9(2)(a)
133 Molesworth Street, Wellington  |  PO Box 5013, Wellington 6140
Released
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
From: Bhumika Talsania <[email address]>
Sent: Thursday, 1 September 2022 9:52 am
To: Jeanette Elley 9(2)(a)
Dylan Nyika <[email address]>; Alan Monnox
<[email address]>; Robyn Tipene <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
; Sanju Nannuri <9(2)(a)
Manvir
Singh 9(2)(a)
com>; Karanti Kaur Shergill 9(2)(a)
Rama Kumble
9(2)(a)
Subject: RE: No meeting needed today - list of remaining tasks

Adding @Robyn Tipene into the loop with this conversation as well.
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 1 September 2022 8:46 am
To: Bhumika Talsania <[email address]>; Dylan Nyika <[email address]>;
Alan Monnox <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
; Manvir
Singh 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Rama Kumble
9(2)(a)
Subject: No meeting needed today - list of remaining tasks
Hi @Bhumika,
1982
I don’t think we need a meeting today, so I suggest that we cancel it. Would that be ok?
Here’s where we are at with the remaining tasks –
Act
1.  Thank you for the suggested (optional) improvements that Alan emailed through last week. We
propose incorporating some of your suggestions into the next phase of the project.
2.  We emailed a video link demonstrating the change of MHA email requirement. Let us know if that
will suffice?
3.  I have written the privacy analysis document. I will send it to you shortly.
4.  We still need to get you a security report including evidence of a pen test.
5.  We still need to draw up a business contract. If you have a draft format you would like us to use for
this, then please let us know.
Information
6.  Our mobile app is not yet ready to go, so we may need to make contact with you again in the
future for mobile app sign-off, once it is ready.
If you have anything else to add to this list, please let me know?
Thanks & Regards
Jeanette Elley PhD
Official
Senior Business Analyst / Project Manager
9(2)(a)
the

W: managemyhealth.co.nz
under
Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email, any use,
forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error, immediately contact
us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will preserve the contents of any email
message that you send us if we believe that we have an obligation to do so and we will otherwise comply with the provision of the Privacy Act
1993 and any amendments thereto to the extent that it applies. Email sent from or to us may be monitored for the purposes of quality control,
systems administration and compliance. You should check for virus and other harmful components before opening or using any attachments to
this email. No reliance may be placed upon the contents of this email as content can become corrupted in transmission. Our liability is limited
only to re-supplying any affected attachment if applicable
Released

From:
Dylan Nyika
To:
Bhumika Talsania; Jeanette Elley; Alan Monnox; Alexandra Hawkhead
Cc:
Asfahaan Mirza; Sanju Nannuri; Manvir Singh; Karanti Kaur Shergill; Rama Kumble; Robyn Tipene
Subject:
RE: MHA integration project phase 1 - Revised wording for sign-up and sign-in error messages
Date:
Friday, 26 August 2022 2:00:54 pm
Attachments:
image001.png
image016.png
image005.png
image006.png
image007.png
image008.png
image017.png
Hi Jeanette,
As discussed, I’ve provided some Alternate Messages for the error scenarios (I’ve added a column to your table below). As mentioned
yesterday, we’re happy for you to take or leave the feedback.
In addition I’ve just added some of the other feedback we mentioned yesterday. Again, up to you how / if you want to take on the feedback:
Making it clear to users what information coming from My Health Account can be updated (e.g. grey out the un-editable fields)
Consider providing some info to the user on why you’re asking them for a password – e.g. so they understand that they will be able to
sign in with both My Health Account and the email + password in the future
Consider if the email verification is needed for My Health Account sign-ups
For the website, consider a re-direct to the My Health Account log in page rather than a pop-up
1982
Feel free to reach out for a chat.
Many thanks,
Dylan
Act
From: Bhumika Talsania <[email address]>
Sent: Tuesday, 23 August 2022 11:25 am
To: Jeanette Elley 9(2)(a)
Dylan Nyika <[email address]>; Alan Monnox <[email address]>;
Alexandra Hawkhead <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Manvir Singh 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Rama Kumble 9(2)(a)
Subject: RE: MHA integration project phase 1 - Revised wording for sign-up and sign-in error messages
Looping @Alexandra Hawkhead in.
Thanks and Regards,
Bhumika Talsania
Information
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Jeanette Elley 9(2)(a)

Sent: Tuesday, 23 August 2022 11:08 am
Official
To: Bhumika Talsania <[email address]>; Dylan Nyika <[email address]>; Alan Monnox
<[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Manvir Singh 9(2)(a)
the
Karanti Kaur Shergill 9(2)(a)
Rama Kumble 9(2)(a)
Subject: MHA integration project phase 1 - Revised wording for sign-up and sign-in error messages
Hi Team,
Please find below a summary table of business rules, then revised error messages, with their conditions. Then below that, example
wireframes for error messages for sign-up, then sign-in.
under
As per MHA feedback, an attempt has been made to make the error messages more user friendly.
Feedback welcome
Business Rules Overview
Req
Description – Phase 1
BR-1
If MMH user elects to authenticate via MHA, they are sent to the MHA sign-in page (audit all actions)
BR-2
After MHA authentication attempt, user is redirected back to MMH
BR-3
If MHA (or RealMe) authentication unsuccessful, redirect user to start page with failed message
Released
If MHA authentication is successful, extra MHA data validation is still needed before acceptance, as follows
If supplied MHA sub = another saved MHA sub (sign-up), or missing (sign-in) redirect to sign-in page with
BR-4
failed message
BR-5
If supplied MHA email = another saved MMH email, redirect to sign-in page with failed message
BR-6
If supplied MHA email = another saved MHA email, redirect to sign-in page with failed message
BR-7
If supplied MHA NHI = another saved MMH NHI, redirect to sign-in page with failed message
BR-8
If supplied MHA confidence level < 3, redirect to start page w failed message
If MHA data valid and new MMH user (user story 1), then
BR-9n
Redirect to registration page & fill with MHA user data. Do not allow user to change copied MHA data.
BR-10n
New MMH user must select a password & confirm to add MMH account
Else if MMH user already exists, matching on MHA sub (user story 2), then
If sub, NHI, surname, first name, or DoB do not match btw MMH & MHA, redirect to sign-in page with failed
BR-9e
message (note that email may differ, but both must be unique).

BR-10e
If MHA data is valid, redirect user to MMH patient portal home page for their account
Error Message Summary
Ref
US-1 signup condition
US-2 sign-in condition
Message
Alternate Message
MHA or RealMe
MHA or RealMe
My Health Account login failed
We couldn’t log you in
authentication was
authentication was
“My Health Account” couldn’t log you in.
We couldn’t log you in using your My Health
1
unsuccessful, or an error code
unsuccessful, or an error
Please choose an alternative method to [sign-in Account. Please try again or choose another
was returned
code was returned
/ sign-up] to Manage My Health.
way to [sign in / sign up] to Manage My Health.
You already have an account
MHA authorisation for sign-up
My Health Account exists
The My Health Account you’ve tried to sign up
signup
was successful but the MHA
Your "My Health Account" already matches a
2a
sub is already stored against
Manage My Health account. Please sign-in to
with is already in use with another account.
an existing MMH account
that account. [Where sign-up should be sign-in] Please sign in to your existing Manage My
Health account.
My Health Account not found
We couldn’t find an account
MHA authorisation for sign-
Your "My Health Account" does not match a
The My Health Account you’ve tried to sign in
sign-in
in was successful but MHA
Manage My Health account. Please sign-up
with is not currently linked to an account.
2a
sub not found in MMH
instead. [Where sign-in should be sign-up. Note Please sign up instead.
[Phase 1 only]
that US-3 in Phase 2 will allow an existing MMH
user to initiate their first MHA authentication]
signup
MHA authorisation for sign-up
My Health Account match found
You already have an account
1982
2b
was successful but the MHA
Your "My Health Account" [email/NHI] already
Your My Health Account [email/NHI] is already
(email)
email or NHI is already stored
matches a Manage My Health account. Please
in use with another account. Please sign in to
2c
against an existing MMH
sign-in to that account. [Where sign-up should
your existing Manage My Health account.
(nhi)
account
be sign-in]
Act
MHA authorisation for sign-
You have more than one account
sign-in
in was successful and
My Health Account mismatch
2b
Your My Health Account [email/NHI] is already
(email)
matched on MHA sub, but
Your "My Health Account" [email/NHI] matches in use with another account. Please contact
MHA NHI, or email is stored
to a different Manage My Health account.
2c
MMH to merge your accounts.
against a different MMH
Please contact MMH to merge your accounts.
(nhi)
account
My Health Account incomplete
MHA authorisation for sign-up
MHA authorisation for sign-
Please load additional proof of identity into
My Health Account incomplete
was successful but MHA
in was successful but MHA
your My Health Account and then try again.
3
Please load additional proof of identity into
confidence level is lower than
confidence level is lower
your "My Health Account" and then try again.
(Is it possible to have a link on the error
3
than 3
message to My Health Account self-service
Information
portal)
This one would confuse me as a user. How to I
MHA authorisation for sign-
My Health Account mismatch
align the data? What data doesn’t currently
in was successful but the
align? MHA does not allow a user to update
Your "My Health Account" doesn't match your
4
MHA user data does not
their NHI, surname or DOB. NHI can only be
Manage My Health profile. Please align the
match the MMH profile data
updated by an NHI admin. Does MMH allow
data then try again.
(for NHI, surname or DOB)
these attributes to be updated? How would a
Official
user get to them to update them?
UI/UX for sign-up error messages
the
under
Graphical user interface, text Description automatically generated
Released

1982
Act
Information
Official
the
under
Released

Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Alexandra Hawkhead <[email address]>
Sent: Thursday, 11 August 2022 11:01 am
To: Dylan Nyika <[email address]>; Bhumika Talsania <[email address]>; Alan Monnox
<[email address]>
Subject: RE: Revised MMH UI/UX wireframes
Hey Dylan,
The log in page looks really good to me how they’ve laid it out, but it would be nice if we could see a version where that button text is
written in title case (My Health Account) rather than in uppercase, just to compare. I think it looks really good how they’ve designed it and
I’m happy with it.
I would recommend making a few small layout changes to the sign up page. I’ve attached a slightly butchered version of their design
(apologies) where I’ve just slightly moved the elements around with information hierarchy in mind (namely moving the sign in link to the
bottom as on this page it’s the secondary action).
I think the error messages may need some editing. Typically we try and make our error messaging sound as friendly and simple as possible
1982
while making it clear what’s gone wrong and how to fix it. For example we would probably use something like “We couldn’t log you in” as
the heading for all of those scenarios, rather than mentioning authentication (to make it sound friendlier).
I’ve edited one of the examples below, which may still need some wordsmithing but identifies the core thing what we want the user to
Act
know:
9(2)(c)
"My Health Account (MHA) authentication was unsuccessful because your "My Health Account (MHA)" confidence level is insufficient for
MHA verification status to be granted within Manage My Health (MMH). Please independently log in to your "My Health Account", add
identity documents there, then try MHA authentication from MMH again.”
“We couldn't log you in
You need to confirm your identity in My Health Account before you can continue to Manage My Health.” (probably still needs some
wordsmithing)
Because we don't currently tell users what their confidence level is, we tend to keep our messaging about the action they need to perform
rather than the level they're at.
Information
And just one final note: I think we need to avoid shortening the name My Health Account to the acronym MHA as well, as it’s not inherently
clear what MHA means (for example, “MHA” has been in the news a lot in the past year to mean Māori Health Authority).
I’m more than happy to help the MMH team rewrite the error messaging if they are pressed for time or resources
Ngā mihi,
Alex
Official
the
under
Released

From:
Bhumika Talsania
To:
Jeanette Elley; Dylan Nyika; Alan Monnox; Alexandra Hawkhead
Cc:
Asfahaan Mirza; Manvir Singh; Sanju Nannuri; Karanti Kaur Shergill
Subject:
RE: Demo for approval this afternoon?
Date:
Thursday, 25 August 2022 8:52:40 am
Attachments:
image001.png
Hi Jeanette,
That sounds good.
I will invite @Alexandra Hawkhead to it as well, so that she can look into the UI/UX aspects of
this as well. Hoping Dylan and her get a chance to review what you sent earlier this week as well.
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
1982
9(2)(a)
E [email address]
Act
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 25 August 2022 8:45 am
To: Bhumika Talsania <[email address]>; Dylan Nyika
<[email address]>; Alan Monnox <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Manvir Singh 9(2)(a)
Sanju Nannuri 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Subject: Demo for approval this afternoon?
Information
Hi @Bhumika,
We have our regular catch-up meeting scheduled for this afternoon so we would like to use this
opportunity to demo our MMH-MHA integration changes to you in order to gain your approval
and sign-off, for the browser version.
Official
The mobile app version is not ready yet, so we will need to seek approval for that one at a later
date, but if we could go through the browser version this afternoon that would be great.
the
We have the list of expected tests from your confluence page. Let us know if there is anything
else you need to see.
I’d like to give you a heads up for the MHA-authenticated MMH account creation process (user-
story 1) in that we have kept to our existing process flow for now, which includes the following 2
under
extra security measures
1. MMH password creation (which will allow the user to log-in via MHA or MMH in future)
2. Email verification (even though MHA email address is already validated, MMH is validating
it again)
Looking forward to catching up this afternoon.
Thanks & Regards
Released
Jeanette Elley PhD
Senior Business Analyst / Project Manager
9(2)(a)

W: managemyhealth.co.nz

Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email,
any use, forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error,
immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will
preserve the contents of any email message that you send us if we believe that we have an obligation to do so and we will otherwise
comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us
may be monitored for the purposes of quality control, systems administration and compliance. You should check for virus and other
harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this
email as content can become corrupted in transmission. Our liability is limited only to re-supplying any affected attachment if
applicable
1982
Act
Information
Official
the
under
Released

From:
Bhumika Talsania
To:
Jeanette Elley
Cc:
Dylan Nyika; Alan Monnox; Manvir Singh; Karanti Kaur Shergill
Subject:
RE: Do you have some dummy NHI numbers that we can enter in INT?
Date:
Friday, 19 August 2022 1:29:58 pm
Attachments:
image001.png
Hi Jeanette,
All good. That now makes sense
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
1982
From: Jeanette Elley9(2)(a)

Sent: Friday, 19 August 2022 1:25 pm
Act
To: Bhumika Talsania <[email address]>
Cc: Dylan Nyika <[email address]>; Alan Monnox <[email address]>;
Manvir Singh 9(2)(a)
; Karanti Kaur Shergil 9(2)(a)
Subject: RE: Do you have some dummy NHI numbers that we can enter in INT?
Hi @Bhumika,
Don’t worry. It’s all good. We can test failure and success for RealMe so we’re happy.
When I created my one RealMe test account, I didn’t go via the MMH app, I went in via the back
Information
end, from 9(2)(c)
and from there to RealMe Sign up.
From the long sign-up SAML page I was offered, I entered all of the patient data so that I could
create the account, and after that it took me to RealMe style screens where it asked me for NHI,
and address, before confirming that I had successfully created my RealMe account.
Official
I saved the FLT so that we could then use it for our RealMe authentication test, and after that
when we used it, it offered us the consent form as you describe.
the
I suspect if you do what I did you would have the same experience! But if you need screen shots,
I have those as well …
Let me know. Hope this helps
Thanks & Regards
under
Jeanette E.
From: Bhumika Talsania <[email address]>
Sent: Friday, 19 August 2022 1:00 pm
To: Jeanette Elley 9(2)(a)
Cc: Dylan Nyika <[email address]>; Alan Monnox <[email address]>;
Manvir Singh 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Released
Subject: RE: Do you have some dummy NHI numbers that we can enter in INT?
Hi Jeanette,
I will be interested in understanding exactly what steps are you taking in this scenario.
Ideally how this would work is:
User hits the Manage My Health website in INT
They click on sign-up
Sign-up with RealMe
In INT, you enter the data fields in MTS env and click initiate SAML response
It prompts you to accept Tc & Cs

You enter and verify an email address
“Allow” permission for My Health Account to share attributes with Manage My Health
As soon as you hit continue it redirect back to your website
So no where in the scenario above does the user see a screen to add the NHI number. Hence I
am inquisitive about the steps you are taking.
If you are signing up straight from MHA, then that is a separate scenario, but I would suggest you
try the scenario I stated above.
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
1982
From: Jeanette Elley 9(2)(a)

Sent: Friday, 19 August 2022 11:33 am
To:
Act
Bhumika Talsania <[email address]>
Cc: Dylan Nyika <[email address]>; Alan Monnox <[email address]>;
Manvir Singh 9(2)(a)
; Karanti Kaur Shergill 9(2)(a)
Subject: RE: Do you have some dummy NHI numbers that we can enter in INT?
Hi @Bhumika,
We can test RealMe login failure without adding any accounts, but to test RealMe login success I
had to add a new RealMe test account.
Information
While doing that it asked me for NHI, and I thought it would be good to add an NHI in there if I
could.
But if that’s awkward then don’t worry. The Real Me test account doesn’t need to have an NHI.
I just wondered if you had any NHIs available to play with, but if not, no problem.
Yes, we can manage with the ones you have already given us.
Official
Thanks & Regards
Jeanette E.
the
From: Bhumika Talsania <[email address]>
Sent: Friday, 19 August 2022 11:01 am
To: Jeanette Elley 9(2)(a)
Cc:
under
Dylan Nyika <[email address]>; Alan Monnox <[email address]>;
Manvir Singh 9(2)(a)
; Karanti Kaur Shergill 9(2)(a)
Subject: RE: Do you have some dummy NHI numbers that we can enter in INT?
Hi Jeanette,
Is there a reason you a trying to add an NHI number to the data?
I have provided a few test accounts already which should be bound to an NHI number.
Released
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Jeanette Elley 9(2)(a)

Sent: Thursday, 18 August 2022 6:11 pm
To: Bhumika Talsania <[email address]>
Cc: Dylan Nyika <[email address]>; Alan Monnox <[email address]>;

Manvir Singh 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Subject: Do you have some dummy NHI numbers that we can enter in INT?
Hi Bhumika,
Do you have some dummy NHI numbers that I can enter in INT for my Real Me created MHA
account?
It complains about any that I invent!
Thanks & Regards
Jeanette Elley PhD
Senior Business Analyst / Project Manager
9(2)(a)

W: managemyhealth.co.nz
1982
Act
Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email,
any use, forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error,
immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will
preserve the contents of any email message that you send us if we believe that we have an obligation to do so and we will otherwise
comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us
may be monitored for the purposes of quality control, systems administration and compliance. You should check for virus and other
harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this
email as content can become corrupted in transmission. Our liability is limited only to re-supplying any affected attachment if
applicable
Information
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
Official
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
the
immediately and delete this message.
****************************************************************************
This e-mail message has been scanned for Viruses and Content and cleared by
under
the Ministry of
Health's Content and Virus Filtering Gateway
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
Released
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of
Health's Content and Virus Filtering Gateway

From:
Jeanette Elley
To:
Bhumika Talsania
Cc:
Alexandra Hawkhead; Alan Monnox; Dylan Nyika
Subject:
RE: Revised MMH UI/UX wireframes
Date:
Thursday, 18 August 2022 3:45:08 pm
Attachments:
image001.png
image002.png
image003.png
image004.png
image005.png
Thanks
From: Bhumika Talsania <[email address]>
Sent: Thursday, 18 August 2022 3:36 pm
To: Jeanette Elley 9(2)(a)
Cc: Alexandra Hawkhead <[email address]>; Alan Monnox <[email address]>; Dylan Nyika <[email address]>
Subject: FW: Revised MMH UI/UX wireframes
Hi Jeanette,
Please find attached below some feedback from our UI designer. I have cced her into the email in case you want to reach out for further questions.
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Alexandra Hawkhead <[email address]>
Sent: Thursday, 11 August 2022 11:01 am
To: Dylan Nyika <[email address]>; Bhumika Talsania <[email address]>; Alan Monnox <[email address]>
1982
Subject: RE: Revised MMH UI/UX wireframes
Hey Dylan,
The log in page looks really good to me how they’ve laid it out, but it would be nice if we could see a version where that button text is written in title case (My Health Account) rather than in
uppercase, just to compare. I think it looks really good how they’ve designed it and I’m happy with it.
Act
I would recommend making a few small layout changes to the sign up page. I’ve attached a slightly butchered version of their design (apologies) where I’ve just slightly moved the elements
around with information hierarchy in mind (namely moving the sign in link to the bottom as on this page it’s the secondary action).
I think the error messages may need some editing. Typically we try and make our error messaging sound as friendly and simple as possible while making it clear what’s gone wrong and how to
fix it. For example we would probably use something like “We couldn’t log you in” as the heading for all of those scenarios, rather than mentioning authentication (to make it sound
friendlier).
I’ve edited one of the examples below, which may still need some wordsmithing but identifies the core thing what we want the user to know:
“MHA authentication unsuccessful
"My Health Account (MHA) authentication was unsuccessful because your "My Health Account (MHA)" confidence level is insufficient for MHA verification status to be granted within Manage
My Health (MMH). Please independently log in to your "My Health Account", add identity documents there, then try MHA authentication from MMH again.”
“We couldn't log you in
You need to confirm your identity in My Health Account before you can continue to Manage My Health.” (probably still needs some wordsmithing)
Because we don't currently tell users what their confidence level is, we tend to keep our messaging about the action they need to perform rather than the level they're at.
And just one final note: I think we need to avoid shortening the name My Health Account to the acronym MHA as well, as it’s not inherently clear what MHA means (for example, “MHA” has
been in the news a lot in the past year to mean Māori Health Authority).
Information
I’m more than happy to help the MMH team rewrite the error messaging if they are pressed for time or resources
Ngā mihi,
Alex
From: Dylan Nyika [email address]
Sent: Thursday, 11 August 2022 7:24 am
To: Alexandra Hawkhead [email address]; Bhumika Talsania <[email address]>; Alan Monnox <[email address]>
Subject: FW: Revised MMH UI/UX wireframes
Hey Alex,
Official
Could you please take a look at the sign-in/sign-up images below and let me know if you think this looks OK? I have questions about the messages which will discuss in the session today – to
me it is not all that clear what the error scenarios are or what the user should do. Not sure how much of the messaging should be dictated by us vs their UX people…
Cheers,
Dylan
the
From: Jeanette Elley 9(2)(a)

Sent: Wednesday, 10 August 2022 5:19 pm
To: Bhumika Talsania <[email address]>; Dylan Nyika <[email address]>; Alan Monnox <[email address]>
Cc: Manvir Singh 9(2)(a)
Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Subject: Revised MMH UI/UX wireframes
Hi All,
In advance of our meeting tomorrow, please find below the revised MMH UI/UX for Sign-up (User story 1) and Sign-in (User story 2) incorporating the MHA authentication option.
under
Feedback welcome.
Released

1982
Act
Information
Official
the
under
Released

48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email, any use, forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error,
immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will preserve the contents of any email message that you send us if we believe that we have an obligation to do so and we will otherwise
comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us may be monitored for the purposes of quality control, systems administration and compliance. You should check for virus and
other harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this email as content can become corrupted in transmission. Our liability is limited only to re-supplying any affected attachment if
applicable
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
This e-mail message has been scanned for Viruses and Content and cleared by the Ministry of Health's Content and Virus Filtering Gateway
1982
Act
Information
Official
the
under
Released

From:
Jeanette Elley
To:
Bhumika Talsania; Dylan Nyika; Alan Monnox
Cc:
Asfahaan Mirza; Sanju Nannuri; Karanti Kaur Shergill; Manvir Singh
Subject:
RE: Updated BRD as at today
Date:
Thursday, 18 August 2022 2:45:33 pm
Attachments:
image001.png
BRD - MMH MoH MHA Integration (Identity) v1 6 18-Aug-2022.docx
And again, with contents refreshed. My apologies. Please refer to this latest version
From: Jeanette Elley
Sent: Thursday, 18 August 2022 2:23 pm
To: Bhumika Talsania <[email address]>; Dylan Nyika
<[email address]>; Alan Monnox <[email address]>
Cc: Asfahaan Mirza 9(2)(a)
Sanju Nannuri 9(2)(a)
Karanti Kaur Shergill 9(2)(a)
Manvir Singh 9(2)(a)
1982
Subject: Updated BRD as at today
Hi All,
Act
Please find attached an updated BRD for Phase 1 of this project, as at today.
The main things to note are the updated wireframes, the table of business rules, and the
updated error messages, all as part of a focus on phase 1 of the project.
I have left the remaining phase 2 user stories in there for now, for reference, but I have mainly
endeavoured to provide clearer comprehensive information about phase 1.
Apologies for not leaving much time for anyone to review this before our meeting at 3pm, but
feel free to come back to me at any time subsequently if you have any questions or want to
Information
suggest further additions.
Catch up soon.
Thanks & Regards
Jeanette Elley PhD
Official
Senior Business Analyst / Project Manager
9(2)(a)
the

W: managemyhealth.co.nz
under
Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email,
any use, forwarding, printing or reproduction of it or any attachment, is prohibited. If you have received this communication in error,
immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will
preserve the contents of any email message that you send us if we believe that we have an obligation to do so and we will otherwise
Released
comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us
may be monitored for the purposes of quality control, systems administration and compliance. You should check for virus and other
harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this
email as content can become corrupted in transmission. Our liability is limited only to re-supplying any affected attachment if
applicable

From:
Jeanette Elley
To:
Alan Monnox; Bhumika Talsania; Dylan Nyika
Cc:
Sanju Nannuri; Asfahaan Mirza; Karanti Kaur Shergill; Rama Kumble; Manvir Singh
Subject:
RE: Manage My Health | Onboarding - Phase 1 MVP project plan
Date:
Wednesday, 17 August 2022 7:23:47 pm
Attachments:
image001.png
MMH MHA Integration Project Plan 18-Aug-22.pdf
Hi All,
Please find below and attached a revised project plan.
We are running more or less to time, just a day or two of slippage, so all is good.
Catch up soon
MMH MHA Integration (Phase 1) Project Plan at 18-Aug-22
Seq
Description
Date/ETA
Rem
Who
Status
1982
1.
BRD document broadly agreed
27-Jul-22
N/A
MMH
Done
Act
2.
NDA documentation finalised
4-Aug-22
N/A
MMH
Done
PoC completed in Integration
MMH
3.
11-Aug-22
N/A
Done
environment
MMH UI/UX draft design provided to
MMH
Done
4.
11-Aug-22
N/A
MHA
MMH sign-up form development
MMH
Underway
5.
18-Aug-22
0w
Information
with UI/UX
MMH sign-in form development with
MMH
Underway
6.
19-Aug-22
0w
UI/UX
7.
MMH internal unit testing (QA) by
23-Aug-22
1w
MMH
Estimated
Official
MMH UI/UX final design approved
MHA
Estimated
8.
25-Aug-22
1w
by MHA
the
MHA UAT / QA / approval testing
MHA
Estimated
9.
25-Aug-22
1w
process by
MMH internal re-work and re-testing
MMH
Estimated
10.
under
25-Aug-22
1w
(QA) by
11.
MHA sign-off
26-Aug-22
1w
MHA
Estimated
MMH / MHA production deployment
both
Estimated
12.
31-Aug-22
2w
test by
MMH / MHA full production
both
TBA
Released
13.
TBA
deployment
Thanks & Regards
Jeanette Elley PhD
Senior Business Analyst / Project Manager
9(2)(a)

W: managemyhealth.co.nz

1982
Act
Information
Official
the
under
Released

From:
Bhumika Talsania
To:
Alan Monnox; Jeanette Elley; Dylan Nyika
Cc:
Asfahaan Mirza; Manvir Singh; Sanju Nannuri; Karanti Kaur Shergill
Subject:
RE: A few questions
Date:
Tuesday, 16 August 2022 4:55:07 pm
Attachments:
image001.png
image002.png
image003.png
Apologies for the staged response, just wanted to elaborate on getting the error from RealMe login:
Go to your app
Click login
Chose login with RealMe
From the dropdown select “AuthnFailed” to generate an error scenario:
1982
Act
Information
Official
Thanks and Regards,
Bhumika Talsania
Scrum Master
Data & Digital
the
9(2)(a)
E [email address]
From: Bhumika Talsania
Sent: Tuesday, 16 August 2022 4:40 pm
To: Alan Monnox <[email address]>; Jeanette Elley
; Dylan Nyika <[email address]>
9(2)(a)
Cc: Asfahaan Mirza
Manvir Singh
Sanju Nannuri
Karanti Kaur Shergill
9(2)(a)
9(2)(a)
9(2)(a)
9(2)(a)
under
Subject: RE: A few questions
Hi Jeanette,
With the regards to the consent piece:
Yes it is enabled in INT
You will be asked to consent when you first log into the accounts through your website.
If you have consent once, you will not be asked again (Unless you go to MHA and stop sharing!)
Here is a screenshot of how it might look like based in the attributes that you are registered to receive, when you first log in from your application
Released
Thanks and Regards,

Bhumika Talsania
Scrum Master
Data & Digital
9(2)(a)
E [email address]
From: Alan Monnox <[email address]>
Sent: Tuesday, 16 August 2022 4:13 pm
To: Jeanette Elley 9(2)(a)
; Bhumika Talsania <[email address]>; Dylan Nyika <[email address]>
Cc: Asfahaan Mirza9(2)(a)
Manvir Singh9(2)(a)
Sanju Nannuri9(2)(a)
Karanti Kaur Shergill
9(2)(a)
Subject: RE: A few questions
Hi Jeanette,
A few answers…
Qu 1: Sign Up
If the user doesn’t have an MHA account and chooses to sign up, then they will be taken through the process to either set up with an email address or RealMe. They can only get
to a level one account from the sign up screen (unless using RealMe verified) at which point control returns to your app with an id and access token (as if they’d just signed in). For
the user to upgrade their account to level 2 and above then they need to visit the MHA self-service portal.
Qu 2: Consent
This should be in the INT environment but I will confirm. The consent is different to the acceptance of the T&Cs for creating an account.
Qu 3: RealMe
You can choose to create a RealMe account on sign up. This then allows you to set test data using the MTS screen. You can event have MTS return a RealMe error. I’ve attached an
internal doc on the topic.
Cheers,
Alan
1982
From: Jeanette Elley 9(2)(a)
Sent: Tuesday, 16 August 2022 3:53 pm
To: Bhumika Talsania <[email address]>; Dylan Nyika <[email address]>; Alan Monnox <[email address]>
Cc: Asfahaan Mirza9(2)(a)
Manvir Singh9(2)(a)
; Sanju Nannuri9(2)(a)
>; Karanti Kaur Shergill
Act
9(2)(a)
Subject: A few questions
Hi MHA team,
A few questions that I’m hoping you can help me with –
1.  In our work thus far, we have been assuming that the new user already has a MHA account. However, on your login page, there is a link to “Sign-up”. If the user elects that
option, and goes down that path to set up their MHA account from scratch, will they still be returned to us (MMH) at the end of that process? In other words, do we need to
factor in this scenario as well? (We had not been planning to). If not, then do we lose the user at that point, and they just go off and do the sign-up thing without coming
back at all?
2.  As discussed at our last meeting, one login failure condition is where the user declines consent. This is also mentioned in the MHA Testing Requirements document as
follows “Demonstrate how your application can handle the scenario where the My Health Account holder declines to give consent to share claim information”. My
understanding is that as part of OICD process the user needs to give consent to share their data with MMH (our claim), but I have not yet seen the screen where the user is
asked this question. Are you able to send a screen shot please? (I presume that this is for an existing user agreeing to share a limited amount of their data and is unrelated
Information
to the acceptance of T&C that a new user goes through).
3.  I believe we briefly discussed the need to handle the Real Me login scenario (success and failure) but I don’t think we currently have any Real Me logins that we can use for
testing. Please correct me if I am wrong? How can we test this? Do you have a dummy Real Me account that we can play with?
Thanks & Regards
Jeanette Elley PhD
Senior Business Analyst / Project Manager
9(2)(a)

Official
W: managemyhealth.co.nz
the
Level 1, Cereus Health House 
48 Market Place, Viaduct Harbour, Auckland 1010 
This communication is and may be privileged and/or contain copyright material. If you are not the intended recipient of this email, any use, forwarding, printing or reproduction of it or any attachment, is proh bited. If you have received this
communication in error, immediately contact us by return email or by calling +6493799166 and then irretrievably delete it and any attachments. We will preserve the contents of any email message that you send us if we believe that we have an
obligation to do so and we will otherwise comply with the provision of the Privacy Act 1993 and any amendments thereto to the extent that it applies. Email sent from or to us may be monitored for the purposes of quality control, systems
administration and compliance. You should check for virus and other harmful components before opening or using any attachments to this email. No reliance may be placed upon the contents of this email as content can become corrupted in
transmission. Our liability is limited only to re-supplying any affected attachment if applicable
under
Released