The Privacy Commissioner has given Health NZ and patient portal Manage My Health until next year to comply with health privacy rules after a massive data breach last year.

Almost 100,000 individuals had data leaked after the portal was targeted by hackers in December.

About 90 percent of those individuals were based in Northland.

The commissioner had found in May Health NZ and Manage My Health "failed in their responsibilities" to have adequate security controls when hundreds of thousands of medical files were stolen in the cyber attack.

The hackers compromised 403,730 Health NZ documents and 22,609 documents that had been uploaded by patients.

Now, Commissioner Michael Webster has put the two organisations on notice, and set deadlines for them to meet requirements.

The notices were issued for failing to comply at the time of the breach with the security requirements of rule 5 of the Health Information Privacy Code.

The rules required Manage My Health to ensure there were reasonable safeguards to prevent loss, misuse or disclosure of personal information.

Webster noted some changes had already been completed.

Manage My Health had already improved on the effectiveness of multi-factor authentication, as well as restricting user access to information and controlling unauthorised external access, the commissioner's office said.

Webster said he was thinking particularly of Māori in Northland, where 90 percent of the affected patients whose data was stolen live.

"These Compliance Notices will ensure, and confirm to me, that Manage My Health and Health NZ are treating patient data securely and it will give New Zealanders assurance that we take these breaches seriously and that strengthening systems is vitally important," he said.

Manage My Health has until the end of August 2027 to make the changes, while Health NZ has until the end of January.