The Privacy Commissioners found Health NZ and Manage My Health "failed in their responsibilities" to have adequate security controls.
RNZ