Verrall AyeshaHon Dr AYESHA VERRALL (Associate Minister of Health): Madam Speaker as a worker in a district health board I've been trusted with the personal information of thousands of New Zealanders—information on their illness their family situation the investigations that they've had. Some of that information is particularly sensitive. I was an infectious diseases doctor and some of the information we collect in our histories of patients tell details of their sex life of their drug use many things people wouldn't want shared publicly. Sometimes it is that particularly sensitive information that harms people when their privacy is breached but sometimes it's not even that—it's the very fact that you were in hospital that you do not want to have known. The information we have when we provide care to people is extensive now because of the large amount of information that can be stored and collected in modern information systems—it is still personal and patients rightfully expect for it to be protected when they come to hospitals.I want to acknowledge the patients in Waikato DHB affected by this cyber-attack. They came to the district health board because they were ill and they sought care. They expected to have their privacy respected. I imagine this event is very upsetting for many people. I take heart in the fact that the DHB is reaching out to the patients notifying them whenever they hear of the information being shared by these criminals as it has been in some cases and working with the Privacy Commissioner to make sure that the people affected are treated well. There is also a 24/7 helpline available for people who have been affected by the cyber-attack. I also want to acknowledge the staff some of whom are my former colleagues. I know they are working hard working with paper-based systems and yet despite the challenges to work around the fact that IT systems are either compromised or are being built back in a slightly different way they have none the less got elective surgery at full capacity and they have got their outpatients at full service. Congratulations to the staff of Waikato DHB for their excellent efforts in that regard. I know they are working hard and it must be stressful. I want to thank them so much for their efforts in continuing to provide these services.Waikato DHB is working to remediate the effects of this cyber-attack and bringing many of its foundational systems back online. Initial concerns about the treatment of cancer patients have been addressed and the radiation therapy is also back online. Urgent breast-screening is occurring because of mobile units being brought into Waikato DHB. The DHB is working closely with the Government Communications Security Bureau to make sure that this attack is ameliorated and responded to.But the point I want to make is that this attack occurs in the context of a long period of under-investment in district health board information technology. Let me tell you a little bit about my experience as a consultant physician in the DHB system. On a regular day I could interact with at least 20 information systems. There was the emergency department system that contains the patient's triage data; the x-ray system where we would look up x-rays; the clinical information system that might contain the clinical notes sometimes—they're often also on paper—as well as investigation results. That system had patchy linkage to primary care data so it was hard to know if your patient was too unwell to tell you what medicines they were on what their general practitioner had prescribed them which creates a risk obviously in terms of safe prescriptions of medicines. We had no system for electronic ordering within the hospital and a patchy one for outpatients. Vital signs were measured by electronic monitoring systems but this was not captured in any sort of data system that might for example allow us to identify deteriorating patients early. That's not to mention the hundreds of bespoke systems that clinicians set up in order to get particular parts of their work done—for example the systems to make sure that kidney patients were monitored adequately or the type of system described by Dr Reti earlier for calculating chemotherapy doses. In other words after decades of under-investment we have a patchwork of IT systems in the health system that are in many cases old and as a result of under-investment they can cease to be serviced in some cases by their provider which does create a cyber-security risk.During my time in Government I've come to learn of this problem in much wider context. In my area of responsibility for public health for example contact tracing and information technology systems have been developed by this Government linking up 20 systems across the country some sometimes run on software like Excel for managing case contacts. We've invested in that system and you'll note that the very fact that we can trace 2600 from one case results from us having an integrated system across the entire country. We have an out-of-date system for breast cancer screening which risks not being capable of being updated and for cervical screening. Improvements to both of those systems have been funded in the last Budget. I'd also like to congratulate Minister Little on turning this pattern of under-investment around. In Budget 2021 he secured $384 million investment in the health information system.I do take exception to the comments from the former member for Whangārei. Cyber-security modernisation as is proposed by this Government does ensure cyber-security. It gets you away from multiple out-of-date systems with their pattern of patches and many of them no longer capable of being updated by their supplier. Funding for information technology in the health system has been neglected as part of the National Government's overall neglect of capital expenditure. In two years there was absolutely no money spent on capital infrastructure in the entire health system. I worked in that health system I remember exactly what it is like. Modern systems to look after vulnerable New Zealanders were not prioritised and we have now put over $5 billion into capital expenditure in the health system.In addition we are improving the cyber-security system. The director-general in June 2020 wrote to all DHBs to ask them to consider greater investment in information technology. A maturity assessment to direct future investment is also under way. I've already mentioned Minister Little's planned investment through the most recent Budget and there will be a national asset management plan developed to direct the roll-out. Following this attack we have also taken specific action. The Ministry of Health has written to all district health boards to instruct them with specific information on how to strengthen their systems in light of this attack. There is an ongoing criminal investigation under way and the Government will also have an investigation into the precise circumstances that occurred at Waikato DHB. More broadly Minister Clark has mentioned the 60 percent increase in investment in the CERT agency and our efforts to fight cyber-crime through global collaboration including joining the Budapest Convention.This Government has been working closely with Waikato DHB to get their information technology systems back online. We respect the hard work done by the staff in that DHB to keep patient care going even through what must be an incredibly stressful time. The Government is reversing the decade of under-investment in the health system capital particularly in health system information technology. My thoughts are very much with the patients and staff at Waikato at this time.The debate having concluded the motion lapsed.