Manage My Health (MMH) Cyber Incident – QMC Patient Update #4

Manage My Health Cyber Incident — Important Update

Published: 16 January 2026 (Update #4)

We are sharing an update following the recent Manage My Health (MMH) cyber incident. MMH has now completed further forensic investigation and provided new information to practices.

We also share in this blog the common questions we are hearing from patients, and our answers.

What’s new from MMH

• Updated forensic findings show fewer patients were impacted than first reported.

• Specialist referral letters were not accessed, meaning some people previously notified as “impacted” are now considered unaffected.

This means some patients who received an earlier “impacted” notification are now confirmed to be unaffected.
MMH will contact these patients directly through the app with updated information.

This is another disappointing event in MMH’s handling of the breach. QMC, along with fellow GP practices and Wellsouth, have expressed our frustrations and disappointment at this error to MMH.  

Questions we’re hearing from patients — and our answers

• “Is my data still being sent to MMH?” → We’ve stopped all new information flowing to MMH of consultation notes and lab results. However, if you continue to use secure messaging, order scripts, or book appointments with the app, then limited, new data about you will be sent to the platform (for example, your medications, and what appointments you have booked). If you wish to send nothing at all new to MMH, your options are:

1. Closing your account with MMH
2. Not using the app any longer do these things

• “Does MMH still hold my historic data even if I stop using the app?” → Yes, unless you close your account. MMH’s privacy policy states that they must delete your data within 90 days of you closing your account.

• “Can I close my MMH account?” → Yes — and if you can’t access it (e.g. because of enhanced security), we can close it for you with your consent.

• “I’m overseas and unable to access my account. Why is this? → MMH has added extra security precautions, and this appears to be disabling access for patients who are overseas.  

• “Does QMC have a list of breached patients?” → Yes – However, MMH is the breached party and must notify patients directly. We have repeatedly put pressure onto MMH with the support of Wellsouth, to communicate with all patients. This has been the most frustrating and disappointing aspect of MMH’s handling of the incident. At the time of writing, we do not know who they have contacted, and who they have not.  

• “Can QMC see what documents were breached?” → No — MMH is the breached party and despite MMH sharing the list of affected patients, we do not have visibility of the documents that have been accessed.

What we’re doing next – new patient portal

• This week we have been meeting with patient portal providers, and reviewing alternative options

• Before making a decision, we will:

• Take independent cybersecurity advice

• Confirm how data storage/retention works and how much data the platform holds about patients who sign up

• No data will be transferred to a new patient portal without your explicit consent. Much the same as the process around signing up for MMH, patients will acknowledge Terms and Conditions to sign up with a new patient portal.

• QMC will communicate transparently about the data retention aspect disclosed by the new provider.

Continuing to use MMH in the interim

It is optional for patients to continue to use MMH. In terms of safety, MMH has been independently verified as operating safely, and Te Whatu Ora continues to monitor them closely.

We are hearing of slow performance from the website/app and logging into the app automatically redirects the user to the website. In theory, you should still be able to use the script ordering and appointment booking functions. However, it may be that you need to phone us instead if you are struggling to do so.  

Important notice about ‘spearfishing’ campaigns

There are recent reports of targeted scam emails pretending to be from Manage My Health. A key warning sign is that these messages ask you (or your patients) to confirm personal details.
Manage My Health does not ask patients for this kind of verification.

If you become aware of any suspicious emails or attempted scams, please report them to:
📧 securityIMT@tewhatuora.govt.nz

Closing your MMH account

As the app is currently redirecting users to the website, you will first need to open the app and click on “help and support”. You will then see your profile at the top of the screen. Please click on this and choose the option “close account”.

If You Need Support

If you have concerns about your MMH account or your data, the MMH support line is available:
0800 747 778
info@managemyhealth.co.nz

If you need help closing your MMH account, please contact QMC — we can action this for you with your consent.

Ngā mihi,
QMC Team

‍