Statement attributable to Margie Apa, Chief Executive Te Whatu Ora

 

Te Whatu Ora – Health New Zealand has taken a number of urgent steps, including legal action, in light of unauthorised disclosure and misuse of data by one of its staff members.

 

From what we have established to date, the individual downloaded a large amount of vaccine related information. We are still working to confirm the full extent of this activity.

 

The data, as published on an overseas site, appears to have been anonymised. Analysis of the released data is ongoing but work so far has not found any National Health Index Numbers or personally identifiable information.

 

We sought and were granted an injunction through the Employment Relations Authority that prevents any publication of the data to ensure that we can take all steps to protect the privacy of individuals.

 

We have already used the injunction to have information taken down from an overseas website and cyber security specialists are continuing to scan extensively for any other places where the information may appear.

 

In addition, a police complaint has been laid, an employment investigation is underway, and the person is no longer at work. 

 

The individual has worked in the health system for a number of years. He was authorised to access data as part of his work and was locked out of our systems as soon as we became aware of the unauthorised use.  

 

We take the security of our data very seriously and are extremely disappointed at this gross breach of trust by this individual and his alleged involvement in spreading harmful misinformation.

 

We can assure the public that we are doing everything we can to respond to this incident and to safeguard their information.

 

We are in the response stage right now and that requires very detailed analysis of the data that was released. A thorough investigation is also underway to identify any learnings from this incident.

 

What this individual is trying to claim about vaccines is completely wrong and ill-informed and their comments demonstrate this. The person has no clinical background or expert vaccine knowledge and appears to be trying to spread misinformation.

 

Vaccination is safe and effective, and everyone should keep up to date with their shots to protect themselves, whanau, and their communities.

 

We assure people there is no evidence whatsoever that vaccination is responsible for excess mortality in New Zealand.

 

We have had a team working through the weekend to respond to this incident and are working closely with other agencies, including the National Cyber Security Centre, the Police, Department of Internal Affairs and Office of the Privacy Commissioner.

 

We have also been offering advice and support to some individual pharmacies and vaccination sites that were identified in an early video published in relation to the unauthorised disclosure and misuse of data.

 

ENDS

 

Editor’s note:

1.               In relation to this matter a non-publication order was made on 1 December 2023 by the Employment Relations Authority (Orders).  The Orders restrict all access, use and publication of information held by Te Whatu Ora on the National Vaccination Database, or any copies, extracts or information derived from it. 

 

2.               The Orders apply to you if you have obtained, or may obtain, access to or otherwise may be or have been provided with information from the Database. 

 

3.               The orders are effective immediately and require that you:

 

(a)             Must not disclose to any third party or publicly release any information held by Te Whatu Ora on the National Vaccination Database (Database) or any copies, extracts or information derived from it (Information).

 

(b)             Must not access or perform any set of operations on the Information or any copies, extracts or other sets of information derived from the Information, including using, accessing, searching, reviewing, copying, sharing, publishing, making available to any member of the public, transferring or disclosing the Information.

 

(c)              Must permanently delete any and all copies of the Database, any versions of the Information and any other unlawfully obtained information in your possession and control.