Budget 2026 has allocated $153.6 million for Health NZ to expand national cyber security monitoring, strengthen data security processes and deliver IT safety upgrades.
The funding will support 24/7 cyber security monitoring, expand specialist cyber security expertise and increase oversight in primary care. Health NZ will contribute $300 million from its own budget over three years for the Health Digital Investment Plan, which will replace ageing devices, modernise radiology systems and upgrade core IT platforms.
Dr Michael Connelly from the Australasian College for Emergency Medicine said integrated IT systems could reduce administrative burden on staff. "What really helps us be more efficient is to have an integrated system that allows for radiology and medication and lab ordering from a touch of a button. Then it allows you to spend more time with the patient," he said.
The investment follows a cyber attack on patient health portal Manage My Health in December 2025, in which sensitive health information was stolen and put up for sale. The Privacy Commissioner found both Manage My Health and Health NZ failed to have reasonable security safeguards in place.
In April 2025, Health NZ confirmed cuts to a third of IT staff, reducing data and digital roles from 2000 to 1460. A document released under the OIA showed Health NZ knew the cuts would increase risks to patient care and hospital resilience.
Gehan Gunasekara, professor in commercial law at University of Auckland, said security required more than IT investment. "A lot of these breaches happen, not because of technical failures of the IT infrastructure, but due to broader governance failures where people haven't really managed [it] across the whole spectrum," he said.