Mornington Health Centre was ultimately unsuccessful in having the information removed, even though it no longer uses the portal.
The patient information is still kept by Manage My Health.
Manage My Health was the victim of a data breach late last month and was told by the hackers they would release 400,000 files from 120,000 patients if the health portal did not pay a $US60,000 ($NZ104,000) ransom.
Manage My Health has been telling general practices whether their patients have been affected, and is working on telling individual patients.
In its latest update at 5pm yesterday, the company said it would begin notifying affected patients within the next 24 hours and hoped to complete that process by early next week.
Notifications would be sent initially by email to the address that was used to register the account, and would include an 0800 number to call "for support and assistance".
Mornington Health Centre general manger Marian Rillstone said the decision to end its contract with Manage My Health had been made well before the breach incident.
The centre thought it would be appropriate for Manage My Health to delete all patient details as they were already duplicated on its patient management system.
But Manage My Health said under its terms and conditions it would hold on to the information as its agreement was between itself and patients.
Ms Rillstone said she saw the holding on to information as a privacy issue.
"I was coming at it from the Privacy Act perspective, which is you shouldn’t hold data unless there’s a specific purpose for holding that data and so our view was, well, there isn’t.
"We actually went and sought advice from the Privacy Commission and they told us that it was something that we should take to lawyers, so we actually went to our insurer and got an opinion from our insurer’s lawyers on that."
The lawyers came back with the advice it would have to comply with the portal’s terms and conditions — patients would have to deal with Manage My Health.
The timing was unfortunate as it happened just before Christmas which made it difficult to get the message out to patients, she said.
Patients should go to the Manage My Health app, sign in and go to "my account" and then choose the "close account" option.
Lots of patients had contacted the practice to find out what was happening, Ms Rillstone said.
"Patients are concerned. And that was the point we were trying to make with the Privacy Commission is that patients see us as custodians of their health information. People these days, they don’t necessarily go in and read all that fine print about what it means when they’re typing to agree to something on an app or whatever and what that might mean for their data.
"We felt that there was an extended responsibility for Manage My Health to delete that data or at least be more proactive about how they were going to manage it."
People had been contacting the centre with concerns and it had been a very frustrating exercise, she said.
The centre was using a new portal, MyIndici.
Manage My Health was contacted yesterday but did not reply.
Manage My Health chief executive Vino Ramayah told RNZ the company held on to records unless a patient cancelled their account.
It was up to patients to cancel their accounts, not their GPs, he said.
WellSouth chief executive Andrew Swanson-Dobbs said yesterday WellSouth was still waiting to hear exact numbers of patients impacted.
It was advising general practices as best it could.
As of yesterday some people in the South had been affected and WellSouth was trying to assist them, Mr Swanson-Dobbs said.
"We know that it has affected a significant number of practices in our region. The numbers are likely to be low, but still there are people that have had their data breached and we’ll work with those practices to make sure. Anyone that needs support will get support."
WellSouth was looking to assist practices and patients should they need it.
Mr Swanson-Dobbs previously said the data breach had been a complete failure by Manage My Health and most of the affected patients were in Northland.
