Category: Health systems

  • MIL-Evening Report: Tonga cybersecurity attack wake-up call for Pacific, warns expert

    By Teuila Fuatai, RNZ Pacific senior journalist

    A Tongan cybersecurity expert says the country’s health data hack is a “wake-up call” for the whole region.

    Siosaia Vaipuna, a former director of Tonga’s cybersecurity agency, spoke to RNZ Pacific in the wake of the June 15 cyberattack on the country’s Health Ministry.

    Vaipuna said Tonga and other Pacific nations were vulnerable to data breaches due to the lack of awareness and cybersecurity systems in the region.

    “There’s increasing digital connectivity in the region, and we’re sort of . . . the newcomers to the internet,” he said.

    “I think the connectivity is moving faster than the online safety awareness activity [and] that makes not just Tonga, but the Pacific more vulnerable and targeted.”

    Since the data breach, the Tongan government has said “a small amount” of information from the attack was published online. This included confidential information, it said in a statement.

    Reporting on the attack has also attributed the breach to the group Inc Ransomware.

    Vaipuna said the group was well-known and had previously focused on targeting organisations in Europe and the US.

    New Zealand attack
    However, earlier this month, it targeted the Waiwhetū health organisation in Aotearoa New Zealand. That attack reportedly included the theft of patient consent forms and education and training data.

    “This type of criminal group usually employs a double-extortion tactic,” Vaipuna said.

    It could encrypt data and then demand money to decrypt, he said.

    “The other ransom is where they are demanding payment so that they don’t release the information that they hold to the public or sell it on to other cybercriminals.”

    In the current Tonga cyberattack, media reports say that Inc Ransomware wanted a ransom of US$1 million for the information it accessed. The Tongan government has said it has not paid anything.

    Vaipuna said more needed to be done to raise awareness in the region around cybersecurity and online safety systems, particularly among government departments.

    “I think this is a wake-up call. The cyberattacks are not just happening in movies or on the news or somewhere else, they are actually happening right on our doorstep and impacting on our people.

    Extra vigilance warning
    “And the right attention and resources should rightfully be allocated to the organisations and to teams that are tasked with dealing with cybersecurity matters.”

    The Tongan government has also warned people to be extra vigilant when online.

    It said more information accessed in the cyberattack may be published online, and that may include patient information and medical records.

    “Our biggest concern is for vulnerable groups of people who are most acutely impacted by information breaches of this kind,” the government said.

    It said that it would contact these people directly.

    The country’s ongoing response was also being aided by experts from Australia’s special cyberattack team.

    This article is republished under a community partnership agreement with RNZ.

    MIL OSI AnalysisEveningReport.nz

  • MIL-Evening Report: Health chief ‘conductor of an orchestra who’s never played an instrument’

    ANALYSIS: By Ian Powell

    In February 2025, Dr Diana Sarfati resigned, not unexpectedly, as Director-General of Health after only two years into her five-year term.

    As a medical specialist, and in her role as developing the successful cancer control agency, she had extensive experience in New Zealand’s health system.

    However, she did not conform to the privately expressed view of Prime Minister Christopher Luxon: That the problem with the health system is that it is led by health.

    Responsibility for the appointment of public service chief executives rests with the Public Service Commissioner.

    In carrying out this function, Brian Roche had two choices for the process of selecting Sarfati’s replacement — run a contestable hiring process (the usual method) or appoint someone without this process.

    With the required approval of Attorney-General Judith Collins and Health Minister Simeon Brown, Roche opted for the exception rather than the rule.

    This suggests a degree of pre-determination to appoint someone without the “hindrance” of health system experience, consistent with Luxon’s view.

    An appointment from outside health
    Consequently, on April 1, Audrey Sonerson was appointed the new Director-General of Health for a five-year term.

    She had been the Ministry of Transport chief executive (including when Brown was transport minister). She also had senior positions in the Ministry of Foreign Affairs and Trade and in the Police and Treasury.

    Though she had been part of the Treasury’s health team and has a master’s in health economics, her only health system experience was in the brief hiatus between Sarfati’s resignation when acting director-general and becoming the confirmed replacement.

    ‘For a minister with no experience of the complexity of health care delivery to choose a director-general who herself has no health experience is extremely concerning.’

    — Dr David Galler, former intensive care specialist

    This is unprecedented for the director-general position. Sonerson is the 18th person to hold this position. The first 10 had been medical doctors. In 1992, the first non-doctor holder was appointed (a Canadian with some health management experience).

    The subsequent six appointees all had extensive health system experience. Three were medical doctors (two in population health), two had been district health board chief executives, and one had been the director-general in Scotland and a medical geographer.

    Dr David Galler is well-placed to comment on the significance of this extraordinary change of direction. He is a retired intensive care specialist and former President of the Association of Salaried Medical Specialists.

    He held the unique position of principal medical adviser to the health minister, the ‘eyes and ears’ of the health system for three health ministers in the mid to late 2000s. He also worked closely with two director-generals.

    Drawing on this experience, Galler observes that: “Director-generals of health must be respected, influential, knowledgeable, connected and trusted, to ensure that good policy goes into practice and good practice informs policy . . .  For a minister with no experience of the complexity of health care delivery to choose a director-general who herself has no health experience is extremely concerning.”

    Breadth of the health system
    As the director-general heads up the Health Ministry, she is responsible for being the “steward” of our health system. In this context she is the lead adviser to the government on health. In the context of seeking to improve and protect the health and wellbeing of New Zealanders, the organisation Sonerson now leads is responsible for:

    • the stewardship and leadership of the health system; and
    • advising her minister and government on health and disability matters.

    These responsibilities have to be considered in the context of how extensive the health system is beginning with its complexity, highly specialised range of health professional occupational groups, and its breadth.

    This breadth ranges from community healthcare (predominantly general practices), local 24/7 acute hospitals, tertiary hospitals (lower volume, high complexity) and quaternary care services (national services for very uncommon or highly complex even lower volume procedures and treatments, including experimental medicine, uncommon surgical procedures, and advanced trauma care).

    Another way of looking at this breadth is that it ranges in treatment from medical to surgical to mental health to diagnostic. And then there is population health such as epidemiology.

    Population health and the Health Act
    However, responsibility extends further to specific obligations under the Health Act 1956, many of which are operational. Although it is nearly 60 years old, this act has been updated by legislative amendments many times and as recently as 2022 with the passing of the Pae Ora Act that disestablished district health boards and established Health New Zealand.

    The Health Act gives Sonerson’s health ministry the function of improving, promoting and protecting public health (as distinct from personal diagnostic and treatment health). Public health is legislatively defined as meaning either the health of all New Zealanders or a population group, community, or section of people within New Zealand.

    A critical part of this role is the responsibility for ensuring that local government authorities improve, promote, and protect public health within their districts in appointing key positions (such as medical officers of health, environmental health officers and health protection officers); food and water safety; regular inspections for any nuisances, or any conditions likely to be injurious to health or offensive and, where necessary, secure their abatement or removal; make bylaws for the protection of public health; and provide reports on diseases and sanitary conditions within each district.

    The population function under the Health Act of improving, promoting, and protecting public health means that how well the health ministry under Sonerson’s leadership performs directly affects the health and wellbeing of all New Zealanders.

    This is an immense responsibility that cannot be minimised.

    Understanding universal health systems
    Universal health systems such as ours are characterised by being highly complex, adaptive and labour intensive and innovative (innovation primarily comes from its workforce). They provide a public good (rather than commodities) and their breadth is considerable.

    But, despite appearances to the contrary, the different parts of this breadth don’t function separately from each other. They are not just interconnected; they are interdependent.

    As a result, each part makes up a highly integrated system. Consequently, relationships are critical. The more relational the culture, the better the system will perform; the more contractual the culture, the poorer it will perform.

    Galler’s experience-based above-mentioned observation needs to be seen in the context of the challenging nature of universal health systems.

    In a wider discussion on health system leadership, Auckland surgeon Dr Erica Whineray Kelly got to the core of the issue very well: “You’d never have a conductor of an orchestra who’d never played an instrument.”

    Audrey Sonerson comes into the director-general position with a deficit. It will help her performance if she first recognises that there are many unknowns for her and then proceeds to listen to those within the system who possess the experience of knowing well these unknowns.

    It might go some way to alleviating the legitimate concerns of Galler and Whineray Kelly and many others.

    Ian Powell is a progressive health, labour market and political “no-frills” forensic commentator in New Zealand. A former senior doctors union leader for more than 30 years, he blogs at Second Opinion and Political Bytes. This article was first published by Newsroom and is republished with permission.

    MIL OSI AnalysisEveningReport.nz