When ‘Reply all’ meets patient privacy
The breach at National Cancer Centre Singapore exposes a blind spot in how our public healthcare institutions treat sensitive data.
Sign up now: Get ST's newsletters delivered to your inbox
Framing the data breach at the National Cancer Centre Singapore as an administrative error undersells the seriousness of what happened, say the writers.
ST PHOTO: KELVIN CHNG
Tan Chong Huat and Rizwi Wun
On the evening of Sept 18, the National Cancer Centre Singapore (NCCS) sent an invitation to an event for people living with hereditary breast and ovarian cancer syndrome. It was meant to be an act of care – bringing together patients and their families for a session on managing a condition that can cast a shadow over entire bloodlines.
Instead, because the sender used “CC” rather than “BCC”, the centre disclosed the e-mail addresses of all 467 recipients to one another and, in some cases, their identities and workplaces as well.