Minister for Health Gan Kim Yong vehemently rejected any allegation that the Ministry of Health (MOH) sought to “cover up” the HIV data leak incident, that affected 14,200 patients diagnosed with HIV and 2,400 individuals who had contact with these 14,200 patients.
The confidential information of these patients (like names, NRIC numbers, HIV status, medical records, addresses and phone numbers) were stolen from the HIV Registry by a foreigner who gained access to the server through his boyfriend, a medical doctor. Before the authorities recovered all the information, the foreigner was deported from Singapore.
Responding to ten parliamentary questions, Gan said that the decision against disclosing the incident to the public ultimately boiled down to a “judgment call,” as he delivered his ministerial statement today.
Although MOH knew that the foreigner illegally possessed the stolen information in 2016 and apparently seized the information from him, they did not inform the public of this discovery.
In 2018, MOH found that the foreigner still had the records despite police action. Again, it did not inform the public of this discovery. Last month, MOH found that the foreigner was in illegal possession of more records and that he had disclosed the records online. The Ministry finally disclosed the incident to the public late last month.
Gan revealed in Parliament today that Brochez provided the police and Government authorities with 75 confidential names and particulars from the HIV Registry. Realising that a leak had occurred, the Ministry had to decide whether to inform the affected persons and whether to inform the public about the leak.
Asserting that these were “not straight-forward decisions,” Gan said: “On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV – would it serve their interest, or harm them instead?”
Gan said that MOH ultimately made the decision it made after consulting medical colleagues who felt that particular attention must be paid to the needs and concerns of HIV patients since their health status is a “deeply emotional and personal matter”.
MOH also decided against informing the affected patients and the public since there was no evidence that the stolen records were disseminated to the public and since the ensuing police search to recover the records was “extensive and all relevant material found had been seized or deleted”.
Gan said: “Ultimately, it was a judgment call. MOH judged that, on balance, an announcement then would not serve the interests of the affected individuals, when weighed against the inevitable anxiety and distress they would experience.”
In May 2018, the foreigner sent the authorities a screenshot showing 31 stolen records from the 75 records he had been in illegal possession of. By this time, he had already been deported from Singapore.
This time, MOH decided to contact the 31 affected individuals since it could not retrieve the screenshot of the records. On why MOH did not make a public announcement in May 2018, Gan said:
“We did not make a public announcement as there was still no specific evidence that Brochez had more information beyond these 31 records. Furthermore, as on previous occasions, Brochez had only shared it with Government authorities and not to any wider audience.
“A public announcement would create anxiety and distress not just among the 31 persons but also other HIV patients whose names were in the registry.”
Gan said that the reason why MOH revealed the incident publicly now is because the foreigner showed that he illegally possessed the entire HIV Registry and had disclosed the confidential records online, thereby “significantly” increasing the likelihood that the identity of the affected persons would be made public.
On MOH’s decisions as it handled the most recent incident, Gan said: “MOH made a judgment call, balancing the various considerations. It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident.
“On all three occasions, MOH’s primary concern was the wellbeing of the persons on the HIV Registry.”
Adding that it is possible that the foreigner may have more data in his possession, Gan asked: “Should MOH now make known all that Brochez may (or may not) still have in his possession? Do we contact every person whose data may (or may not) be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?”
He stressed that MOH’s decisions were made “based on what we believe to be the interest of the potentially affected persons.”