SINGAPORE - A key factor in the Government's decision whether to disclose the HIV Registry data breach when it first learnt about it in 2016 was that there was no evidence the information then had been disseminated to the public, Health Minister Gan Kim Yong told Parliament on Tuesday (Feb 12).

Another was the sensitivity surrounding HIV status, he said in a ministerial statement.

In April 2016, American Mikhy Farrera Brochez had revealed to the authorities that he had names and particulars from the registry.

The Ministry of Health (MOH) had to decide whether to inform the affected persons and make a public announcement about this, Mr Gan said. It decided not to.

"These were not straightforward decisions. On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV - would it serve their interest, or harm them instead?"

He said he discussed this with medical colleagues in MOH.

"They emphasised the need to pay particular attention to the concerns and needs of HIV patients. A person's HIV status is a deeply emotional and personal matter. Some patients will experience high anxiety and distress from a disclosure or announcement," he said.

"Some will feel compelled to reveal their HIV status to family members or friends. Relationships can be disrupted; lives can be changed. We had to exercise care and judgment in making our decision, and the well-being of the affected persons weighed heavily in our considerations."

Brochez had sent the names and particulars of 75 individuals to the police and government authorities in April 2016.

After an "extensive" search of Brochez's residence, computers, storage devices and e-mail account, the police seized or deleted all relevant information that had been found.

The police also found that Brochez had sent a further 46 records to his mother by e-mail. She agreed to let the police access her e-mail account and delete the records.

Mr Gan said the police search was extensive and all relevant material found had been seized or deleted.

"While there could be no guarantee, MOH had good reason to believe that the information had been secured and the risk of future exposure significantly mitigated."

Of the decision to go public, he added: "Ultimately, it was a judgment call, to be made based on the information we had, the considerations for and against an announcement, and the assessed risk of future public exposure of the information."

He said MOH judged that, on balance, an announcement then would not serve the interests of the affected individuals when weighed against the inevitable anxiety and distress they would experience.

Brochez was deported in April 2018 after serving his sentence for offences including cheating.

In May 2018, he sent a screenshot containing 31 records from the HIV registry to several government authorities, indicating that he still possessed data from the registry.

The MOH then contacted the affected individuals to inform them of the leak.

But it decided not to inform the public as the 31 records were part of the 75 Brochez had previously disclosed.

Mr Gan said: "As on previous occasions, Brochez had only shared it with government authorities, and not to any wider audience. A public announcement would create anxiety and distress not just among the 31 persons but also other HIV patients whose names were in the Registry."

In January 2019, Brochez put the entire HIV registry up to January 2013 online and sent the link to a non-government party. The MOH then decided to make a public announcement on Jan 28 as the likelihood of the affected people's identities being made public had "increased significantly", Mr Gan said.

Following the announcement, some individuals informed the MOH that Brochez had attempted to contact them in 2018 and had given them links to confidential information that Brochez had uploaded online.

The information uploaded was similar to what had been found in January 2019 and no new individuals had been affected. The MOH worked with other authorities to block access to this information, Mr Gan said.

He said that at each juncture when it came to light that Brochez had information from the registry - May 2016, May 2018 and January 2019 - MOH had a responsibility to balance the opposing considerations and exercise judgment.

"MOH made a judgment call, balancing the various considerations. It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident," he said.

He stressed that on all three occasions, MOH's primary concern was the well-being of the persons on the HIV registry.

It is a dilemma the authorities still face today.

"We now know that Brochez retained some data after the police seized all the files they could find in 2016. Quite possibly, he still has more data in his possession," said Mr Gan.

"Should MOH now make known all that Brochez may or may not still possess? Do we contact every person whose data may or may not be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?"

He said MOH has decided to continue to manage the situation in a way that reduces the possibility of further exposure.

"This is consistent with the decision taken in 2016, and again in 2018. It is based on what we believe to be the interest of the potentially affected persons."