Source: Radio New Zealand
Care facilities have switched back to a paper-based system to manage medication, and are dishing it out by hand, while prescription portal MediMap is offline following a hack.
MediMap is used by some health providers in the aged care, disability and hospice sectors and the community to record medication doses and coordinate with pharmacies – and it includes people’s medication histories.
It was breached on Sunday, and the company has now taken the platform offline while it investigates.
According to information sent by MediMap to care providers in the early hours of Wednesday morning, and seen by RNZ, fields that were changed included patient name, date of birth, location within the facility, assigned prescriber or pharmacy, allergy or intolerance information or discharge or deceased status.
Providers with the portal offline have told RNZ medication was now being organised the old-fashioned way – on paper.
A Nurses Organisation member at George Manning Lifecare and Village in Christchurch told RNZ they needed double the number of registered nurses on each shift just to give out medication.
Aged Care Association chief executive Tracey Martin said every care home had a “disaster” plan to fall back on in case of something like a system outage.
“Basically, they had to switch back to paper-based.”
She understood it was not having an effect on residents, who were all still receiving medication, but some facilities might have needed to bring in extra staff who were qualified to double check the medication, before it was given to residents.
“It certainly takes longer, it’s certainly more painful than the efficiencies that you get through a digital system,” Martin said.
Most of the questions being asked were: “Is my mum still getting her medication?” and “How are you making sure that she gets what she needs?”
“With regard to somebody being marked as deceased or not? Well, our facilities have got the person there, so they know they’re not deceased. So while from a system perspective that is really interesting and needs to be sorted, from a real-life perspective, that individual’s still there, still being cared for.”
FAQs released by MediMap
Among the information sent from MediMap care providers were lists of frequently asked questions those companies might be getting, and how to respond to them, along with a draft email providers could use as a template to inform patients, residents and families.
MediMap said it was working with external cyber security and forensic specialists, Health NZ, and relevant authorities to identify which facilities and resident records had been affected, and passwords were being reset across all users “as a precautionary measure”.
“Importantly, we have been advised that there is currently no evidence that medication charts or medication administration records have been altered,” it said.
“Has resident data been exposed? – At this stage, we cannot confirm whether any resident data has been accessed beyond viewing, extracted, or exposed externally. The investigation is ongoing.”
“When will our facility be brought back online? – Facilities will be restored in phases. Facilities where current resident information has not been modified will be restored first following internal validation. Facilities where resident information may have been impacted will be contacted directly by MediMap to confirm current resident details prior to restoration.”
“Why are discharged or deceased residents being reviewed? – Some resident status information may have been incorrectly modified. Historical records will be reviewed following restoration of current residents.”
What is the health agency saying?
Health New Zealand, while supporting the company’s investigation, said MediMap, as a privately owned company, was solely responsible for its security and it needed to do everything it could.
Its digital services acting chief information technology officer Darren Douglass said New Zealanders expected companies involved in healthcare to secure systems and platforms so private information was safeguarded.
MediMap has declined an interview with RNZ, but has again been approached for comment.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand
LiveNews: https://nz.mil-osi.com/2026/02/25/care-facilities-turn-to-paper-after-medimap-hack/