Text-Only Version Go to article page
The agency has stopped or delayed 136 initiatives, including a much-lauded patient information system.
Health New Zealand has stopped or deferred a raft of digital projects. Photo: 123rf
A patient information system lauded by Health New Zealand, and a child health IT platform, are among a raft of digital projects the agency has stopped or deferred.
An $11 million infection tracking solution was put on hold, and a couple of cyber security projects are also among the 136 initiatives not going ahead.
But another 732 projects worth $200m were completed or underway for 2024-25, according to a list released under the Official Information Act (OIA) by Health NZ Te Whatu Ora.
The agency told RNZ the routine revision of its projects did not introduce new clinical risks.
It had "invested more than ever before" in cyber security last year, it added.
HNZ revealed last week that someone broke into systems and stole personal information about staff in the Wellington region. A former IT staffer then made a direct link between deferred projects and cyber breaches.
HNZ rejected that.
"There is no correlation between any ongoing or deferred projects and the privacy breach," acting chief information technology officer Darren Douglass told RNZ in a statement.
On Monday, the agency stopped its restructuring processes in three areas, though not the mass layoffs it had proposed in data and digital.
Minister Simeon Brown said he had asked for assurances frontline service delivery would be protected, and said he "absolutely" considered cyber security staff to be front line.
"There is no proposed change to the structure or size of our cyber security team," Douglass said.
Last May, Douglass had told the Health Minister's office that HNZ was reliant on a lot of old IT systems, which carried "serious risks for the organisation" that included outages as well as security vulnerabilities and "associated breaches".
Last December, he told a health IT conference: "The most pressing issue for us is the reduction of funding for digital initiatives.
"It requires a significant shift in how we approach our work."
Northland IT staff had told managers late last year that the proposed staff cuts might lead to "more frequent and major cyber events, system-wide outages. Breach of privacy, loss of fidelity of digital systems and clinical records".
Douglass told RNZ on Friday: "IT systems will continue to operate with critical systems and patient safety and privacy a priority."
Health NZ said the 136 projects stopped or deferred had nothing to do with the proposed staff cuts; this was just a "standard annual process".
The scale of them was revealed in late 2024 around the time HNZ's data and digital unit was told to find another $100m of savings, on top of $380m already cut by the government, gutting the core Hira IT upgrade programme.
The new OIA list sketches out details of the 136 projects that were not public before (71 were deferred and 65 stopped - though about 30 were restarted and completed).
It shows a "turnaround committee" had wanted a $2m cyber risk mitigation project completed early and reduced in scope. This was what happened.
A $130,000 project to set national standards for security, networks and the cloud was deferred.
Health Minister Simeon Brown speaking at the BusinessNZ Health Forum in March, 2025. Photo: Calvin Samuel / RNZ
While there were few cyber-security projects on the list, it did feature a lot of projects aimed at getting patient data to doctors faster, such as:
"It is important to note that 'stop/defer' decisions do not introduce new clinical risks," said Douglass.
Yet the OIA clearly shows that many of the projects were designed to lower existing risks from fragmented systems and improve flows of clinical information, such as a $5m initiative for improving clinical workflows and documentation that was deferred.
About two dozen projects worth over $40m were put in the "pipeline", including $15m upgrades of laboratory IT system and four lots of lifecycle maintenance "that support safe and effective operation of Health NZ sites".
A $5m anaesthesia information management system, and a $15m project to replace devices that won't run on Windows 11, an operating system that debuted in 2021, were deferred.
As was a "world leading initiative" to put patients "fully in control" of their health data - because "in our current state, health consumers have little control over who can access their data".
Globally, the "cloud" has been promoted by Google, Amazon and others as a godsend for health information systems. However, Health NZ's $3.6m national cloud delivery to connect sites nationwide had not started and was now deferred, even though it is a key part of the national data platform (NDP) that HNZ last July promised would "revolutionise the management of health data nationwide".
Financial IT systems do not feature on the list. A recent independent review of the financial hole HNZ got into said the agency had been relying a lot on a single Excel file to manage $28 billion, though it was easy to manipulate, missed errors and was hard to track.
Douglass said HNZ was still working on a 10-year plan that would push for increased digital investment.
Five years ago, a government stock take warned health IT needed $2.4 billion to set right.
Previously, 100 pages of staff feedback leaked to RNZ on the data and digital restructure proposal suggested it was only the IT workers who were keeping masses of old and unreliable systems going.
"Internally, IT-related harms within HNZ's care environments are common knowledge, yet numerous false public narratives overstating the safety of HNZ's IT systems are easily identifiable," said one.
"For years, HNZ has claimed data and digital investment was necessary to reduce this risk and harm, which was also a conclusion of the 2020 HDS [health and disability] System Review. HNZ now suggests the organisation can safely 'do more with less'."
The 2020 review said: "The system needs to work differently to accelerate the digital transformation toward safer, more productive care delivery ... most patient information is in inconsistent machine-readable formats."
Health NZ has embarked on another project, the Shared Digital Health Records (SDHR) initiative, to try to link the patient info held by GPs nationwide, in order to use telehealth a lot more. It has a relatively skinny $4m budget. The project is in its initial phase and, as with the 136 projects detailed in the OIA, its future is not assured, with some GPs already pushing back on privacy grounds.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.