A cyber attack on Waikato District Health Board is the latest in a string of events to test emergency planning protocols, Tairawhiti health bosses say.

At least five Tairawhiti patients who would normally have been flown to Waikato Hospital were sent to other hospitals following the ransomware attack on the DHB's medical systems on May 18.

Two were flown to Tauranga, two to Auckland and one to Palmerston North.

Hauora Tairawhiti chief executive Jim Green said others had also been affected — those who usually drove or flew to Waikato for scheduled treatment.

Hauora Tairawhiti had 'severed” links with Waikato DHB systems and applications to prevent any infections attacking its own patient systems, says Mr Green.

A report before the health board on Tuesday said patients in Tairawhiti with heart attacks had to be flown to Tauranga.

'The need to quickly arrange alternative pathways was a test of emergency planning protocols,” the report says.

'We are getting plenty of testing of this nature with recent events such as earthquakes, volcanic eruptions and a pandemic.”

It follows a malware attack from the Zeppelin virus that resulted in the shutdown of most of Waikato DHB's key IT and phone systems, a move back to manual processes and surgeries being delayed.

In an update to Hauora Tairawhiti's district health board on Tuesday, Mr Green says the attack had been extremely disruptive to Waikato's network of hospitals, but had also impacted 'quite a lot” on Tairawhiti's use of its services.

'Primarily that has been around people who have heart attacks,” Mr Green says.

'In the main, those people have been going to Bay of Plenty DHB and also to Wellington if there were capacity issues.

'That's been the most major impact.”

Other impacts on Tairawhiti people had been around planned care and radiotherapy.

'We know Waikato DHB is now back up to around 80 percent of its normal planned care capacity . . . so that will be impacting Tairawhiti people.

'The third area of particular interest for us is around people requiring radiotherapy. The radiotherapy service at Waikato has been out for this whole period.”

For Tairawhiti patients requiring more urgent radiotherapy, that meant going to Tauranga or Wellington instead.

A report that came before board members said a 'scheme of destinations” was arranged between Waikato, other Te Manawa Taki (Midland) DHBs and those in Auckland and Wellington.

People needing to be transferred were firstly discussed by the relevant team at Waikato, then referred to the pre-determined site.

Mr Green says their colleagues in Waikato are working to minimise the impact on patients, including those Tairawhiti would normally send to Hamilton for treatment.

'Our clinical staff are liaising with their Waikato counterparts. Together they agree on the best pathway to care for affected patients.

'In some cases, this means the patient is transferred to another hospital.

'Thanks to other DHBs such as Bay of Plenty and Auckland, who have supported us to ensure patients get the specialist treatment and care they need.”

Hauora Tairawhiti followed Ministry of Health advice and stopped the use of applications hosted by Waikato DHB and disabled access for Waikato's remote users.

This aligned with the steps taken by other DHBs.

Hauora Tairawhiti staff are reminded of what to look out for when using email, which is on top of normal protocol where all emails sent to employees from external accounts come with a 'cyber security warning” banner.

In response to the incident at Waikato DHB, Hauora Tairawhiti confirmed its existing backup routines and processes had operated as expected and that data is secured appropriately, should there be a need for the recovery exercise.

It has ensured its security products are up to date and is regularly checking systems and applications to detect any dormant or active malware presence.

It also deployed security updates as soon as these became available and restricted inbound connections by default to only allow connections from trusted network management hosts.

Waikato DHB is working with the Privacy Commissioner, National Cyber Security Centre and GCSB (Government Communications Security Bureau) to investigate the incident.