Little AndrewHon ANDREW LITTLE (Minister of Health): The member who's just resumed her seat Brooke van Velden is right: in this day and age cyber-security should not be an afterthought. It is absolutely integral or it should be absolutely integral to the design and implementation of information systems regardless of the enterprise. The bigger the enterprise the higher the expectation that systems will be well designed have good architecture and be able to protect the data that flows through it. Of course for public organisations that have a public duty to citizens in some cases who acquire data about individuals because those individuals are compelled to do so arguably the duty to maintain and to protect the integrity of that data is even greater.So these are important principles when it comes to the health system. It is important that we have systems information systems that protect people's information that protect their privacy. We are not immune and no country and no enterprise is immune to cyber-attacks and indeed just four days before the ransomware attack on the Waikato District Health Board a very similar very comparable attack took place on the whole of the Irish health system. That system or the IT systems for the Irish health system went down and a month later they were still not fully remediated and it is very comparable to what has happened to just one of our district health boards.I want to acknowledge the patients and staff whose information was held by the Waikato District Health Board who have now had that information compromised and we now know had that information placed on other websites and other platforms now accessible to others around the world. The Waikato District Health Board tell me that they have a system in place so that once they identify the identities of people who have had their information compromised and their privacy breached a proactive step is taken to contact that person to let them know and to the best extent possible to let them know of the nature and extent of the information that has been compromised and then to work with that person to provide the support that is necessary.In addition to that of course people are entitled to go to the Office of the Privacy Commissioner and exercise their rights under the Privacy Act 2020. One of the things that we did in our previous term in Government was to beef up the Privacy Act and the obligations on information holders to make sure that there are good incentives to afford proper protection. Nevertheless even with the best protections in the world now the reality of the world now is that cyber-security—there is no cast-iron guarantee. Cyber-attacks are a reality of the modern-day world and the expectation is on those stewards of information systems to be taking every possible step every proportionate and appropriate step to provide protection to information held by organisations.The Waikato DHB is still in the process of remediating what has happened. Many systems are back online. Patients were disrupted; their care was disrupted. The staff working for the DHB were clearly disrupted and were put under great pressure in the early days of that system and actually in the weeks since reverting to paper-based systems reverting to more manual systems. But it is pleasing to see that the DHB managed to keep their patient care going. The occupancy rate for the principal Hamilton hospital was kept at around 85 percent—that is pretty standard for that hospital. They managed to continue much of the care that was required the emergency care and even a large chunk of the elective care. The care for some patients had to be delegated out to other hospitals to other DHBs. That was naturally a source of inconvenience but it did mean that care could continue. Now care is gradually being returned to the Waikato DHB and that includes many of the radiology services that were put out of action and other services that were interrupted and disrupted are now slowly returning to normal. But there is no question: the Waikato DHB is not back to normal yet.We have known for some time and ours would not be the first Government—previous Government would've known—that the ongoing need to maintain investment in IT systems is absolutely crucial. What I think is stunning when the history books come to be written about this time is just the appalling neglect that the health system suffered under the previous Government. When you look at capital expenditure under the previous Government compared to what we have done the previous Government scrimped and frankly nickelled and dimed capital spending for hospitals. Implementing and upgrading IT systems is a matter of capital spend and actually the DHBs were starved of those resources. If you have a look at two years under the previous Government no money at all was appropriated for capital spending. No money at all went into upgrading and renewing IT systems in our health sector. That's how neglectful the previous Government was.I'm very proud to be part of a Government that has put over $5 billion into capital spending in our health system. There is a major catch-up job to do and it's not just buildings. It's not just the buildings that were neglected and the mental health facilities that were neglected repeatedly year after year by the previous Government; it's the IT systems as well. Now we're in a situation where across our network of 20 DHBs we have about 120 different IT platforms operating. Somehow we're trying to make sense and the front-line clinical staff and other staff are trying to make sense of that cobbled-together network of systems. You talk to those who are on the front line they turn up to a hospital and they tell you about just the stress that is associated simply with having to skip from one platform to another just to get the job done.Well that position is under review has been for a wee while now under this Government. That is why we appropriated this year $385 million for a serious upgrade of all of the IT systems across our DHB network. Not because we can start from scratch with a super-duper brand new kind of from-the-ground-up IT system for our health system—that would be a phenomenal exercise—but we can do better at upgrading what we've got and making what we've got the systems we've got talk to each other so we can get some coherence and coordination when it comes to IT systems across our health sector. But as part of that and as the member who has moved this motion and raised this urgent debate identifies you can't do that without making sure that cyber-security is woven into every aspect of the upgrade of the system that we now have to embark upon. Security of information is a fundamental foundation and principle of IT systems. It's no longer an add-on and it can no longer be an afterthought. So the approach we are taking is to make sure that security is embedded in the design of information systems.As I said the growing sophistication and just the constancy of cyber-offensive activity is such there will never be a cast-iron guarantee and as we know of IT systems at least of software no software design is ever complete. It is the best it possibly can be at a point in time and then it is constantly upgraded renewed patched and repaired when that is necessary to keep it current and hopefully to keep it safe. But it is incumbent on system owners system stewards to make sure that they are doing the basics every step of the way to keep their systems going and to keep their systems safe and ultimately to protect the integrity of those whose data they are holding at any particular point in time. That's where we're going with IT and IT security. It's where we're going with systems that have to be installed not only in our health system but across all Government agencies. In fact we know of course that it's not just public organisations that are victims of and subject to cyber-attacks; it's private organisations as well. The member who has resumed her seat expresses surprise about some of these things but the reality is there are plenty of organisations public and private who have still not wised up to the threat that cyber-offensive activity now poses here and around the world. The whole nature of information technology now is it doesn't matter where you are in the world no one is immune. Those attacks can come from any quarter of the world at any time and so we must be prepared.Once the Waikato DHB has remediated their systems returned to business as usual then there will be—because there has to be—an appropriate inquiry an independent inquiry into the state of the system before the ransomware attack and then the quality of their response to it. At that point and only at that point will we have an understanding about the extent to which that system was vulnerable the extent to which any steps that might have been taken to provide further protection could have been taken or whether indeed it was a DHB that had done everything expected of it and had met the appropriate standards expected of it. We have in Government the protective security standards that apply to a whole range of activities but also including in information technology. Those standards are promulgated throughout the public sector and organisations and particularly organisations of significance and scale are expected to meet those standards to comply with those standards as they run their information systems. Most organisations have and make sure they have installed appropriate protective software. But it is of course the case that once installed those programmes those platforms also have to be maintained so that protection is maintained and a standard of protection is maintained throughout. So whenever we suffer an attack like this it is always timely to provide appropriate scrutiny to understand what has happened. And I am confident that once the Waikato DHB is back operating as expected then the thoroughgoing independent inquiry that will need to take place will take place and will give us a very clear picture about what happened why it happened and what more could be done. Of course as we embark on the health reforms and we prepare ourselves for a new entity that will be responsible for all of our hospitals there will be stuff that we can learn that will apply. But I might add for those who worried at the time that Gee this was an attack on the Waikato DHB. What if there had been a nationwide organisation in place?" well we have nationwide organisations with nationwide systems throughout Government the ACC the Ministry of Social Development and IRD. They're all large organisations. They are duty bound to make sure that the platforms that they operate have proper protections in place for proper security because of the extraordinary amount of personal information that they hold. We expect nothing less of every public organisation and for those organisations holding the most sort of intimate details of our citizenry then we expect a very high standard to be kept. That's what we expect of those Government agencies. It's what we expect of health organisations public and private and it is the standard that we must ensure applies and is complied with.In the health sector we've had major data breaches before. We had the Tū Ora Compass Health breach a couple of years ago where the details of up to 1 million patients were compromised and an appropriate response was set up in relation to that. Obviously that organisation that private organisation found then that actually you don't take cyber-security for granted; you actually have to keep at it. That is a lesson that we know is now abroad in the health sector in New Zealand. It's abroad in the health sector worldwide thanks to what's happened in Ireland and it'll be once again a reminder that we must always be on our mettle and do the best because the people who suffer when we get it wrong or when systems get it wrong are citizens who put their faith in organisations to keep their data safe.This scrutiny is welcome. It is important that this House also understands its role in ensuring that at least public agencies are supported morally and in other ways to make sure that they are maintaining the integrity of their information systems. So we eagerly await the conclusions of the inquiry into the Waikato DHB. We support the Privacy Commissioner in the work that his office will do to support those whose privacy has been breached and we hope that all people affected by this dreadful action will get the proper support and their minds put at rest about their details."