What role, if any, did Health NZ play in overseeing, monitoring, or responding to the Canopy Health cyber security incident, given Canopy Health’s role in delivering services under the government-funded BreastScreen Aotearoa programme?

Answer

I am advised that Health New Zealand provided advice to Canopy Health on its management of the incident and ensured that Canopy Health’s actions were coordinated with Health NZ. I am further advised that the initial cyber incident was considered closed once Health NZ received confirmation from Canopy Health that the situation was contained. Health NZ subsequently obtained assurance from Canopy Health that it had appropriately engaged with the Office of the Privacy Commissioner and had legal and privacy support in place. Health NZ also provided information to support Canopy Health in its notification processes. As there was no forensic evidence of data exfiltration, responsibility for privacy notifications rested with Canopy Health with guidance from the Office of the Privacy Commissioner.