Waikato hack - Datix Midland Integrated Quality and Risk system

Amy S Van Wey Lovatt (Account suspended) made this Official Information request to Tairawhiti District Health Board

Response to this request is long overdue. By law Tairawhiti District Health Board should have responded by now (details and exceptions). The requester can complain to the Ombudsman.

From: Amy S Van Wey Lovatt (Account suspended)

Dear Tairawhiti District Health Board,

I am writing to request information regarding the extent to which the Datix Midland Integrated Quality and Risk system (used for reporting complaints and incidents) was compromised by the cyber attack at Waikato DHB.

I note that Lakes District Health Board, Taranaki DHB, Bay of Plenty DHB and Tairawhiti District Health Boards all use the same was Datix Midland Integrated Quality and Risk system as Waikato DHB, and some of these reports, when entered, are automatically sent to the Health Quality & Safety Commission.

Yours faithfully,

Amy S Van Wey Lovatt

Link to this

From: Te Ao Mihiata Paenga-Morgan
Tairawhiti District Health Board

Kia ora,

This email is to inform you that we have received your OIA request on Friday 10 September 2021. We will respond in due course with our answer.

Nga manaakitanga,

Te Ao Mihiata Paenga-Morgan
Communications Advisor
Waea: 06 869 0500
Waea Pukoro: 021 077 0641
Wāhi Mahi: 421 Ormond Road, Gisborne, 4010
www.hauoratairawhiti.org.nz
Facebook.com/Hauora Tairawhiti

show quoted sections

Link to this

From: Te Ao Mihiata Paenga-Morgan
Tairawhiti District Health Board


Attachment image001.png
9K Download

Attachment image002.jpg
3K Download

Attachment Response 13771 Datix.docx.pdf
629K Download View as HTML


Kia ora Amy,

 

Please see attached for Hauora Tairâwhiti’s response to your OIA request.

 

Nga manaakitanga,

 

[1]cid:image001.png@01D76CD8.6A95B1D0  
Te Ao Mihiata Paenga-Morgan
Communications Advisor
Waea: 06 869 0500
Waea Pukoro: 021 077 0641
Wâhi Mahi: 421 Ormond Road,
Gisborne, 4010
[2]www.hauoratairawhiti.org.nz
[3]Facebook.com/Hauora
Tairawhiti
[4]cid:image002.jpg@01D76CD8.6A95B1D0

 

 

show quoted sections

Link to this

From: Amy S Van Wey Lovatt (Account suspended)

Dear Te Ao Mihiata Paenga-Morgan,

Thank you very much for your response. I am pleased to hear that your agency continued to have access to the regional Datix system. I ask that you please clarify as to whether the incident reports submitted into the regional Datix system (all 5 hospitals) are shared on the same server, which is also shared with the Health Quality & Safety Commissioner. If this is the case, where is the server located? If there is more than one server which holds the regional Datix system reports, where are these servers located?

Yours sincerely,

Amy S Van Wey Lovatt

Link to this

From: Amy S Van Wey Lovatt (Account suspended)

Dear Te Ao Mihiata Paenga-Morgan,

I also ask if any of the information from the regional Datix system was leaked from the cyber attack at Waikato DHB, which is not the same as whether or not your employees still had access.

Yours sincerely,

Amy S Van Wey Lovatt

Link to this

From: Te Ao Mihiata Paenga-Morgan
Tairawhiti District Health Board


Attachment Response 13771 Datix part two.docx.pdf
635K Download View as HTML


Kia ora Amy

Please see attached for the Hauora Tairāwhiti response to your questions.

Nga manaakitanga,

Te Ao Mihiata Paenga-Morgan | Communications Advisor

show quoted sections

Link to this

From: Amy S Van Wey Lovatt (Account suspended)

Dear Te Ao Mihiata Paenga-Morgan,

I am writing for clarification because the response I received dated 8 October 2021 was not clear.
My Question 1: Please clarify as to whether the incident reports submitted into the regional Datix system (all 5hospitals) are shared on the same server, which is also shared with the Health Quality & Safety Commissioner?

Your Response: Te Manawa Taki District Health Boards have their own shared instance of Datix.

I request for clarification. Are all reports in the regional Datix system located on one server, or multiple servers? Are all reports entered by members of your DHB held locally, on your DHBs servers, or are they also located on servers located at other DHBs and the Health Quality and Safety Commissioner? If there are also located at other DHBs, are they located at Waikato DHB?

My Question 2: Where is the server located? If there is more than one server which holds the regional Datix system reports, where are these servers located?

Your Response: For security reasons, we will not be commenting on our computer systems at this time.

I request the legal reason, as set out in the OIA for refusing me this information. I do not require the specific building within the location, only the general physical location, such as your specific DHB, another DHB, within the MoH in Wellington, or some held by some other third party, such as those providing cloud archive support.

You have stated, "The Datix regional Incident, Quality & Risk system was not impacted as a result of, or during, the Waikato Security Incident." I request a copy of the official investigative report which supports your assertion.

Yours sincerely,

Amy S Van Wey Lovatt

Link to this

From: Amy S Van Wey Lovatt (Account suspended)

Dear Te Ao Mihiata Paenga-Morgan,

As a follow up, I also request copies of all contracts with suppliers who provide server (physical and cloud service) support for your DHB.

Yours sincerely,

Amy S Van Wey Lovatt

Link to this

Things to do with this request

Anyone:
Tairawhiti District Health Board only: