Health New Zealand Te Whatu Ora has begun the process of notifying around 12,000 individuals who were impacted by the alleged unauthorised data release by a former staff member.
Barry Young, 56, has denied accessing a computer system for dishonest purposes.
Health NZ chief executive Margie Apa said the first group being contacted is a large number of Covid-19 vaccinators who had their personal information made available in a downloadable file on a US-based blog.
"As soon as we found out about this, we asked for the information to be removed. It was later taken down."
A small number of vaccinated people could also be potentially identified within information earlier made publicly available through considerable effort and technical expertise, she added.
Apa said that Health NZ has "vigorously" pursued legal avenues to have the data removed in line with orders by the Employment Relations Authority to prohibit the sharing of public release of data from the unauthorised disclosure.
"We continue to cooperate with police and work closely with the Office of the Privacy Commissioner."
Local and international cyber security experts are working with Health NZ to "assist and monitor" signs of the data being disclosed online.
"This is a highly complex situation, and our investigation is ongoing."
Apa said that Health NZ is committed to learning from the incident, and that they are improving internal controls and strengthening data security measures to prevent further instances.
"We deeply regret what happened and apologise sincerely to those affected. We are making information, advice and support available to individuals being notified."
She added that "the misinformation about vaccines put in the public arena in relation to the alleged unauthorised data release is completely wrong."
"The role played by vaccinators during the pandemic was invaluable and helped to keep communities safe and save lives."
SHARE ME