Waikato DHB cyber attack: No complaints from staff, patients, health minister says

Health Minister Andrew Little visited staff and patients at Waikato Hospital this morning. Photo / Mark Mitchell

Health Minister Andrew Little says there’s “still a long way to go” in finding out how Waikato DHB was left crippled by a cyber attack.

It’s been 10 days since the attack and staff have had to resort to pen and paper in order to get patients through their doors.

Little met with staff and patients this morning and assured the public the DHB was being given added Ministry support including not only IT and data but also to ensure it was being well managed as the system remained down and patient safety was not being compromised.

Little said he’d been told the DHB was making good progress in fixing the issue but there was still “a long way to go to find out what happened”.

Asked whether staff were frustrated, he said it was understandable for the incident to add stress to staff but they were handling it remarkably and have adapted to do what they do.

“They’re doing a remarkable job. They’re getting through procedures, people are still turning up to ED.”

However, he couldn’t give any assurance about whether the country’s hospitals were safe from another attack.

“There’s no such thing as a guarantee against cyber security attacks, they are a reality of the world today.

“What we need to do is make sure that as the systems are reinstated and restored is that the best possible protective measures are put in place so that if it does happen again we don’t see this level of disruption that’s been caused by this.”

Asked about whether the DHB had spoken of its security vulnerability prior to the attack, Little accepted the systems were “reasonably old” which was the Government put money in their latest budget towards upgrading health systems.

He said he had asked other DHBs to look at their systems and provide an assurance to the director general of health that all the protective measures are put in place and that they were resilient to an attack.

“The assurances have been coming in, we’re wanting the same from the PHOs as well, 17 have provided that response and the Ministry is working with the remaining 13.”

He said he was not worried about patient safety being compromised due to the cyber attack, all the systems were operating, and the hack was about their data.

None of the patients he had met today had expressed any concern about their safety either, he said.

“They haven’t expressed any worry to me about it, they are satisfied that they can still come here and get their treatment, some have been transferred but most are here .. and are appreciative of the support they’re getting.”

The hospital was operating “well and safely even if it is below par”.

There was a sense that they would continue operating this way for “some time more yet”.

As for an under-funded health system, Little said it had been “under invested in for a long, long time”.

“Many, many years under the previous government. There were two years where there was no money spent on capital expenditure for our health system, whether it was buildings or it was IT systems.

“We have been in recovery mode since we’ve been in government.

“We put $5 billion into buildings, hundreds of million into IT systems and another $380m last week alone. We are doing our best to catch up.”

He said the cyber attack wasn’t just a wake-up call for other DHBs, it was “for any organisation with a reasonably sizeable computer network”.

“Cyber attacks are a reality and it is for any reasonably sized computer network to make sure that they’ve got protective measures in place and are resilient.”

As for how it was doing prior to the attack, that would be assessed in an independent review once the hospital was back up and running as normal.

Meanwhile, the Ministry of Health’s boss of data and digital Shayne Hunter is joining today’s 1.30pm press conference alongside chief executive Kevin Snee and executive director hospital and community services Chris Lowry.

Snee and Lowry yesterday confirmed patient and staff data sent to media from the hackers was genuine.

Hundreds of appointments and surgeries have been deferred as a result and some seriously sick or cancer patients are being sent to other hospitals around the country for treatment.

Several media agencies, including the Herald, were contacted by the group claiming responsibility for the cyber attack, via an email with attached files containing patient and staff information. The Herald has provided the email to police.

The Government has already confirmed it would not pay any ransom to the hackers.