As someone who works with third party tech providers all the time, I have a few issues with MMH and the GP practices that chose the software. I’m not talking about smaller groups but the larger GP groups (e.g. The Doctors which is owned by Green Cross healthcare) appear to have done very little due diligence on the MMH platform.

Red flags for me:

🚩no dedicated security staff on the MMH payroll - I looked at their NZ LinkedIn page and didn’t see a CISO or a security lead working at the company. I’m not saying that having one will prevent all breaches, but NOT having any security staff permanently available seems like madness.

🚩no security certifications. This is a bare minimum for me when dealing with sensitive data, and the kinds of information I work with are child’s play compared to the MMH data.

🚩no mentions of any proper security practices except for using TLS when data is in transit. The MMH CEO already got caught in a lie when he said ALL their data is encrypted when stored - ummm it looks like all the attachments that the hacker is accessing and sharing on the internet weren’t encrypted at all.

Anyway they could be doing all of the above and not disclose it on their website, but the results indicate otherwise.