Significant enhancements to Te Whatu Ora – Health New Zealand’s cybersecurity over the past few years has the health agency “confident” in its current level of data safety.
The assurance comes in response to Pulse+IT’s questions in light of a letter to Health Minister Shane Reti, released under the Official Information Act, which details a number of concerns the agency had about pending budget cuts in May, including risks to cybersecurity and the feasibility of some digital projects.
The letter to Dr Reti two days before the government’s budget in May, came from Health NZ’s director of strategy and investment, data and digital Darren Douglass, who said the cuts to funds previously allocated to data and digital in the 2021 and 2022 budgets could see a shut down of the national terminology service, restrictions put on consumer digital health identity work and progress on the NZ Patient Summary ceased.
Dr Reti was also warned that there was “an operational risk of failure” of shared electronic health record services in three regions, and that the extension of IT systems beyond end of life was risking “ongoing security vulnerabilities and associated breaches”.
In 2021, a cyber security incident knocked out Waikato District Health Board’s IT systems, affecting clinical services across its five hospitals, including the 673-bed Waikato Hospital.
In response to Pulse+IT’s questions about his letter to Dr Reti, Mr Douglass said Health NZ had “significantly enhanced its cybersecurity capabilities over the past 3 years.”
“People can be confident that their information is safe. At the same time, Health New Zealand recognises the need for ongoing vigilance and improvement – cyber threats never stand still.
“Accordingly, we have a funded cyber-security critical investment programme to further strengthen safeguards and national response capabilities.”
Mr Douglass reiterated that Health NZ was working on a 10-year plan for infrastructure investment, which included “proposals for integrating and improving the digital and data systems we have inherited. This is well progressed.”
Part of the letter released under the OIA listed a number of sector-facing services that would be impacted from 1 July 2024, as a direct result of the budget cuts.
Additionally, Mr Douglass told the Minister that “there is an operational risk of the failure of existing shared electronic health record services in three regions, which cannot be effectively mitigated without the services outlined above and this funding,” and a “key primary care sector vendor” had signalled its intent to prevent the flow of data into the systems from the end of June 2024.
In response to a question about the strength of shared EHR services, Mr Douglass explained that the EHRs provided access to data sourced from multiple other systems curated into a single view of a patient record, and risk management was ongoing.
“We have been collaborating with relevant vendors, and with the PHOs who manage the shared EHRs, to mitigate any risk.”
Mr Douglass said this collaboration included working constructively with “the vendor previously mentioned” to ensure continued access to data.
Health NZ’s 10-year infrastructure investment plan is due to be published in December.
