The Ministry of Health has today published the Terms of Reference for its independent review into the Manage My Health (MMH) cyber security incident.
The review, developed in partnership with the Government Chief Digital Officer and the National Cyber Security Centre, will examine the causes of the incident, assess the response, and provide recommendations to strengthen protections for health information going forward. The Terms of Reference outline the full scope of this work, including a focus on improvements to help prevent similar incidents in the future.
The Ministry understands that this incident has been deeply concerning for people who use the Manage My Health portal. Publishing the Terms of Reference will help ensure the health sector, the public, and other stakeholders are informed about next steps.
The review will commence on 30 January 2026, with a final report anticipated on 30 April 2026. The Ministry of Health will not be making any public comment while the review is underway.
The Terms of Reference are available at Ministry review into the Manage My Health data breach.
