Healthcare data is the highest-value target in cyber crime — worth 10x more per record than financial data on criminal markets. NZ healthcare providers, from DHBs to GP practices to allied health clinics, are actively targeted. Here's what the threat looks like and what defence must include.
Healthcare data commands a premium price on criminal markets because it combines personally identifiable information, financial information, and highly sensitive personal health details in a single record — enabling identity fraud, insurance fraud, and targeted extortion simultaneously. The IBM Cost of a Data Breach Report has consistently found healthcare as the sector with the highest average breach cost globally, year after year.
For NZ healthcare providers, this translates to real and current risk. The Waikato DHB attack in 2021 demonstrated that NZ healthcare is on the radar of ransomware groups. Community health providers, GP practices, and specialist clinics are targeted precisely because they hold the same high-value data as DHBs with significantly less security infrastructure.
The Specific Risks in Primary and Allied Healthcare Settings
Practice management systems: Cliniko, Indici, MedTech, and similar practice management systems hold patient demographic data, clinical notes, appointment history, and billing information for potentially thousands of patients. A ransomware infection that encrypts these systems doesn't just lock the business — it removes the clinical records needed to provide safe patient care. This operational risk is what makes healthcare ransomware attacks particularly dangerous: the pressure to restore access is higher when patient care is affected.
Medical imaging systems: PACS (Picture Archiving and Communication Systems) and radiology systems store enormous volumes of patient imaging data. These systems often run on older operating systems (Windows Server 2012, Windows 7) to maintain compatibility with legacy imaging software — making them prime targets for known vulnerability exploits.
Connected medical devices: Modern healthcare increasingly relies on internet-connected devices — remote monitoring equipment, infusion pumps, diagnostic devices. These devices often can't run endpoint security software and frequently can't be patched without vendor involvement. They represent an attack surface that's invisible to most network security tools.
Privacy Act Obligations in Healthcare
Health information is one of the most sensitive categories of personal information under the NZ Privacy Act 2020. Any healthcare provider who suffers a breach affecting patient health information has mandatory notification obligations — to the Privacy Commissioner if the breach is likely to cause serious harm, and to affected patients. The definition of "serious harm" in a health information context is interpreted broadly by the Privacy Commissioner.
The consequences of a notifiable breach in healthcare include: reputational damage affecting patient trust, regulatory investigation and potential penalties, civil liability to affected patients, and professional regulatory consequences for the clinical practice.
What Healthcare Security Must Include
For small healthcare providers, Optimyze recommends a security baseline that includes: network segmentation separating clinical systems from administrative and general internet access, EDR on all endpoints capable of running security software, separate network segment for medical devices with restricted internet access, immutable offsite backup of all practice management data with tested restoration procedures, MFA for all clinical system and email access, and a documented incident response plan that includes notifying relevant authorities.
In healthcare, a cyber breach isn't just a business problem — it potentially affects patient care and patient safety. The security investment required to prevent this is substantially less than the cost of responding to it.
