When ‘Reply All’ meets patient privacy
The breach at National Cancer Centre Singapore exposes a blind spot in how our public healthcare institutions treat sensitive data
Sign up now: Get ST's newsletters delivered to your inbox
Framing the data breach at the National Cancer Centre Singapore as an administrative error undersells the seriousness of what happened, say the writers.
ST PHOTO: KELVIN CHNG
Tan Chong Huat and Rizwi Wun
On the evening of Sept 18, the National Cancer Centre Singapore (“NCCS”) sent an invitation to an event for people living with hereditary breast and ovarian cancer syndrome. It was meant to be an act of care – bringing together patients and their families for a session on managing a condition that can cast a shadow over entire bloodlines. Instead, because the sender used “CC” rather than “BCC”, the centre disclosed the email addresses of all 467 recipients to one another, and in some cases their identities and workplaces as well. The centre has apologised, notified the Ministry of Health, and referred the matter to the Personal Data Protection Commission (PDPC), which has confirmed it is investigating.
It is tempting to file this away as a minor IT mishap – the CC-versus-BCC slip that afflicts every organisation eventually. NCCS itself described it as an administrative error. But that framing undersells what happened, and what it says about how seriously Singapore’s public healthcare institutions treat the data entrusted to them.