Little AndrewHon ANDREW LITTLE (Minister of Health): Madam Chair thank you and I thank the member for raising that question. That is a very big question that not just public health entities deal with but private as well. I think the single biggest compromise of health data we had was actually a private health provider. It was a primary health organisation where the health records of a million patients were potentially compromised through an encroachment by a bad actor. Upon investigation it was found more likely than not that information wasn't exfiltrated but certainly the person who compromised the system had the opportunity to do so over a considerable period of time. And then you've got the situations like the Waikato District Health Board where a ransomware attack happens and data is exfiltrated and is placed on the dark web. So those are real things that have happened. That really highlights the need for high-quality IT systems and that's why we've invested nearly half a billion dollars in upgrading and renewing health IT systems but also the need for high-quality data security and cyber security.I think to the extent that clause 93 signals anything it is that we do respect the need for a high degree of confidentiality and respect for the confidentiality of personal health information. It is important for the Director-General—as the head of the ministry which is the steward of the system and needs good information to understand what's going on—to get information but not in a way that identifies individuals so that individual patients can be sure that their personal health details are not being placed in data storage or data systems somewhere that people unknown to the patient could get access to them.One of the challenges we've got and we're working with—and I think most members of the House would agree—is that of health information. We want patient health information to be available to health practitioners who are authorised to have access to it—authorised by patients—at a time when it makes sense to. So we want to build a system where if a patient agrees then whichever health practitioner they're turning up to—whether it's somebody in a hospital somebody in their GP practice or if they're out of town an after-hours practice somewhere—that health practitioner can get that person's health information to fully understand the health profile of that person.A system that can do that has been sought for a long time. That is the system that we're trying to create. It's what the health sector says will make such a big difference in terms of health service provision and preventing the need for patients to tell their story multiple times particularly if they are a patient seeking treatment for example for a traumatic injury or a traumatic violent injury or an injury incurred as a result of a violent act. Patients in that situation seldom want to repeatedly tell their story because just telling it can be traumatising. So the more that we can do to ensure that the trusted health practitioner in front of a patient can get the right information so that health practitioner can give the best possible advice and treatment—that is where we want to get to but it has to be done in a way that is respectful of the patient's privacy rights. That's the system that we're trying to build.