17 January 2025
Rodney Parsons
[FYI request #29457 email] Tēnā koe Rodney
Your request for official information, reference: HNZ00074208
Thank you for your email on 5 December 2024, asking Health New Zealand | Te Whatu Ora for the
following under the Official Information Act 1982 (the Act):
Inphysec undertook a report into the Waikato DHB data breach. The data systems
breached were not isolated to Waikato DHB. Since this is a public request, I won't detail
those systems, nor the implications, at this stage.
Outline the security classification of these government data systems. Provide the risk
assessment on Waikato's IT systems, on the national health IT systems, and provide the
updated risk assessment based on the extensive job and project cuts planned and
undertaken already, within Health New Zealand.
Outline what, if any, delays there are to addressing the ongoing risks to New Zealander's
data.
Response
The information you have requested on Waikato district’s IT systems and on national health IT
systems is withheld under section 9(2)(c) of the Act, to avoid prejudice to measures protecting the
health or safety of members of the public.
You have also requested an updated risk assessment based on “
the extensive job and project cuts
planned and undertaken already, within Health New Zealand”.
In relation to future changes to roles in the Data and Digital area, we are currently consulting on a
proposal and no decisions have been made. The Act does not require an agency to form an
opinion or create new information to answer a request. This part of your request is therefore
refused under section 18(g) of the Act.
In relation to data and digital programmes and projects, these have been prioritised in accordance
with the annual capital planning exercise. This is not part of the current change proposal, and is out
of the scope of your request for information related to “
the extensive job and project cuts planned
and undertaken already”.
In relation to cyber security, we can advise that there are no delays at this point. The Cyber
Security Uplift programme was completed in June 2024. We are delivering the security services
that were developed through that programme and we have approved a minimum critical cyber
improvement programme that runs until the end of this financial year, June 2025.
How to get in touch
If you have any questions, you can contact us at
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz or
by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may proactively
release a copy of this response on our website. All requester data, including your name and
contact details, will be removed prior to release.
Nāku iti noa, nā
Gaynor Bradfield
Group Manager, Business Support
Data and Digital
TeWhatuOra.govt.nz
Health NZ, PO Box 793,
Wellington 6140, New Zealand
