In a ministerial statement in Parliament on Tuesday (Feb 12), Health Minister Gan Kim Yong answered questions that have been raised since the Ministry of Health (MOH) revealed last month that confidential details of more than 14,000 people on the HIV Registry had been illegally made public by American Mikhy K Farrera Brochez.

He had obtained the information that was in possession of his partner, Ler Teck Siang, a doctor who was the head of the ministry's National Public Health Unit.

1. Why didn't the authorities act when Brochez first told them of a leak in 2012?

Mr Gan said the issue then wasn't about Brochez's access to HIV Registry information, "but a different one".

At that time, Brochez had accused Ler of disclosing information about Brochez's HIV status to others. "He later also claimed that Ler had shared screenshots of his HIV status with others," said Mr Gan.

The minister said that despite multiple attempts by MOH to engage him, Brochez did not provide any evidence to support his allegation. He was uncooperative and evasive, and rejected or postponed meetings with MOH on several occasions.

"At one point, he even informed MOH officers that he was leaving Singapore and did not want to continue with the investigation into his allegation. Due to his uncooperative attitude, the investigation could not make much headway."

Mr Gan said: "At no point in 2012 or 2013 did MOH have basis to suspect that Brochez had access to, or was in possession of, the data of the HIV Registry."

Nevertheless, Ler was reassigned to another role in May 2013 and his access to the registry terminated. The ministry also kept up the investigation which led to the discovery that Brochez may have submitted fake HIV blood tests to retain his employment pass. MOH reported this to the police.

2. When did MOH know that Brochez had confidential information from the HIV Registry?

In April 2016, said Mr Gan.

Brochez was arrested for repeatedly refusing to comply with the ministry's order to take a blood test. He then gave the police and government authorities 75 names and particulars from the registry.

"This was the first time MOH had evidence that Brochez may have access to confidential HIV related data," said Mr Gan.

MOH made a police report on May 16, 2016.

3. How thorough were the police in tracking down the leaked HIV registry data when this first surfaced?

Mr Gan said that following Brochez's revelation of the 75 names in April 2016, the police raided Brochez's and Ler's home and seized and secured "all relevant materials" including computers and electronic storage devices.

In checking Brochez's e-mail account, they found that he had sent a screenshot and a file of a further 46 records from the Registry to his mother.

The police contacted her and she agreed to let them access her account to delete those files.

"At this point, the Police had seized everything they found in Ler's and Brochez's possession, and had done their best to ensure that no further confidential information remained with Ler and Brochez, including in their known online accounts."

Said Mr Gan: "It was always recognised that there was a risk that Brochez could have hidden away some more information. Unfortunately, as recent events showed, Brochez did manage to retain at least some data which he has recently disclosed, and we cannot rule out the possibility that he has more."

4. Why didn't MOH reveal the data breach when it learnt about it in 2016?

This was not a straightforward decision, said Mr Gan, as HIV "is a deeply emotional and personal matter".

He discussed the matter with medical colleagues at the MOH and they emphasised the need to pay particular attention to the concerns and needs of HIV patients.

They pointed out how some would be highly anxious and distressed from a disclosure or announcement, or feel compelled to reveal their status to family or friends.

"Relationships can be disrupted; lives can be changed. We had to exercise care and judgment in making our decision, and the well-being of the affected persons weighed heavily in our considerations," he said.

Also, since there was no evidence that the confidential information had been disseminated to the public, the ministry decided that making the matter public would "not serve the interests of the affected individuals, when weighed against the inevitable anxiety and distress they would experience".

It was a judgment call, acknowledged Mr Gan. He added: "I reject any allegation that MOH sought to cover up the incident."

5. Did Ler Teck Siang break the law when he downloaded and took home the information from the HIV Registry?

No. As the Head of National Public Health Unit, Ler had authority to access information in the HIV Registry.

At that time, staff needed to download the HIV Registry to do routine data entry, contact tracing, and analysis. They were allowed to use personal thumb drives.

Ler "is believed to have downloaded the HIV Registry into a thumb drive, and failed to retain possession of it", said Mr Gan.

That's why the charge against him is for mishandling the information.

He has also been convicted of abetting Brochez to cheat and of providing false information to the police. He has appealed against the sentence.

Ler's charge under the Official Secrets Act (OSA) has currently been "stood down".

"It remains before the Courts and will be dealt with after proceedings on his other charges have concluded," said Mr Gan.

6. Why wasn't Brochez charged under the OSA?

At that point - June 2016 - there had been no wide dissemination of the information. Charging Brochez under the Official Secrets Act would likely result in a fine if he had been found guilty or, at most, a jail term of a few weeks. Since this would likely be concurrent with his penalties for the more serious fraud and drug-related charges, the Attorney-General's Chambers decided not to level such a charge against him.

Instead, he was given a stern warning.

7. Will MOH now bring Brochez to book for his crime?

Brochez, who is no longer in Singapore, is currently under police investigation for various offences. He is believed to be in the United States.

The police are engaging their American counterparts and are seeking their assistance in the investigations against Brochez, said Mr Gan, adding that the police will "spare no effort pursuing all avenues to bring Brochez to justice".

8. What is being done to make sure the data leak does not resurface?

In January 2019, the authorities realised that Brochez probably still possessed the entire HIV registry. He had also put the information online and provided the link to a non-government party.

Besides making public the data breach and contacting affected persons, MOH has worked with the police and other relevant parties to disable access to the information as quickly as possible.

Mr Gan said that a few parties have since come forward to say that Brochez had attempted to make contact with them in 2018, and had given them links to confidential information he had uploaded online.

"We have quickly worked with authorities to similarly disable access to the online content," he said, adding that the content that was uploaded is similar to what the authorities had found in January, "so no new individuals have been exposed".

MOH has also been working with relevant parties to scan the Internet for indications of further sharing of the information.

"There have thus far been no signs of further disclosure, but we will continue to monitor." Should it detect any disclosure or online publication of the information, MOH will work with the relevant authorities and parties to take down the content and disable access to the data.

9. What has been the reaction of the 2,400 Singaporeans on the Registry whom the MOH has succeeded in contacting?

The reactions were varied, with a few wishing they had not been told.

The medical social workers who called the patients were themselves distressed by the news they had to break. They did so "carefully and gently", but still some "became the target of anger and blame".

"These reactions are not unexpected. They were the reasons we made a judgment call in 2016 not to make a public announcement, and in 2018 to inform only the affected patients," said Mr Gan.