Te Whatu Ora says there has been a threat on social media to release private health details.
Te Whatu Ora has revealed a small number of people may have been identified in stolen COVID-19 vaccination data.
Earlier this month a former staff member released information online but Te Whatu Ora said at the time there were no identifying details and the data was anonymised.
However, its chief executive Margie Apa now says that someone with expert technical skills may be able to identify a very small number of individuals, some of whom have died.
"Once our forensic work is complete, we will contact the families of those that could be identified," she said.
The social media threat breaches the current Employment Relations Authority injunction preventing the data from being published, she said.
The health agency was also looking into the possibility the person who leaked the data took other information.
"There is no evidence at this time this information was shared publicly, or with other people, however, we are working with experts to provide us with further assurance this information was not shared more widely," Apa said.
Te Whatu Ora was working with police and the privacy commissioner regarding the new information, she said.
It had also worked with several other government agencies, including using their data experts to help.
Apa said it has successfully requested that information be taken down from various websites and internet platforms, including internationally.
Barry Young, 56, has appeared in court in relation to the initial breach, pleading not guilty.
