nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqxw2mexzsxusn4qkglfjwjrrpgv4dn05h06ennrw3w3vnjjr4765qqfwj33 sounds like they're trying to put a spin on this when they say that 'My Health Documents' was affected and not 'GP-provided Health Records', suggesting that 'My Health Documents' might only contain information uploaded by the patient (or otherwise exclude 'GP-provided' records).
The fact that "referral-originating" practices are impacted on a national scale beyond the 45 Northland based practices strongly hints to those referrals being leaked, and those wouldn't be patient provided 'My Health Documents', but indeed originating from the GP (or other referral provider).