Digital primary care must be treated as critical infrastructure

Source: GPNZ

General Practice New Zealand (GPNZ) is calling for enforceable national standards to strengthen the security of digital systems that underpin primary care.

The recommendations are outlined in a new position paper, Prevention is protection: Securing digital primary care for the decade ahead (PDF), released today.

Justin Butcher, GPNZ Deputy Chair and CEO of Pinnacle Midlands Health Network, said the health system’s reliance on digital tools has grown, but the governance and standards surrounding those systems has not kept pace.

“Digital systems are now embedded in everyday care. Patient portals, shared records and electronic referrals are essential to how primary care operates,” Justin said.

“Yet the standards and oversight needed to protect those systems remain inconsistent. The health system needs to move from reacting to incidents to deliberately strengthening its digital foundations.”

Recent breaches affecting health platforms are not isolated incidents, the paper says, but reflect broader structural weaknesses in standards, governance and accountability across the digital health ecosystem. It calls for enforceable minimum security standards, independent assurance, clearer regulatory roles and oversight that reflects the scale and concentration of digital health data.

Justin said other sectors already treat digital systems as critical infrastructure, operating with clear standards and independent oversight.

“Primary care sits at the frontline of the health system. It is where patients turn for reassurance and care, and that trust must not be undermined by preventable system failures.”

He said primary care providers were committed to strengthening digital security but needed consistent national frameworks to do so effectively.

“We are focused on prevention. Digital risk cannot be completely eliminated in a connected health system, but it can and must be governed responsibly – this is an expectation and right of the public.”