Parliament: Gan Kim Yong explains actions MOH took over HIV data breach

Judgment call was made balancing need for transparency and impact on those affected

Remote video URL

Health Minister Gan Kim Yong yesterday defended the way the authorities handled the HIV Registry data breach, and said public disclosure of the matter was a judgment call balancing the need to be transparent and how it would affect the people on the list.

He told Parliament that while action has been taken to delete the information that had been leaked, the authorities are still monitoring further exposure of the data.

Last month, the Government revealed that details of 14,200 Singaporeans and foreigners diagnosed with HIV were stolen and posted online. The person who did it was American lecturer Mikhy Farrera Brochez, who was deported last year after serving a jail term for fraud and drug-related offences.

Brochez, who is HIV-positive, had twice used the blood of his doctor boyfriend Ler Teck Siang for an HIV test to get an Employment Pass.

Ler was head of the National Public Health Unit and had downloaded the HIV Registry onto a thumb drive. Brochez got his hands on it.

In a ministerial statement after MPs raised questions on how the matter had been handled, Mr Gan said that the well-being of those on the registry weighed heavily in how the authorities responded.

When the Ministry of Health (MOH) first found out in 2016 that Brochez had access to the confidential information, it had to decide whether to inform those affected and to publicise the matter.

"These were not straightforward decisions. On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV - would it serve their interest, or harm them instead?" he said. Doctors at MOH felt that particular attention had to be paid to the concerns of HIV patients, as HIV status is a deeply emotional and personal matter.

At that time, there was also no evidence that the confidential information had been disseminated to the public. Whatever data Brochez had revealed had also been seized or deleted by the police, said Mr Gan.

The decision in 2016 was not to inform those on the list or make the data breach public.

But last year, when Brochez sent a screenshot of 31 registry records to several government agencies, MOH decided to contact and alert the 31 affected individuals as it could not retrieve the screenshot.

Mr Gan said MOH did not disclose the leak then as there was no evidence that Brochez had more than these records. It also felt a public announcement could create anxiety and distress among all whose names were on the registry.

Then last month, when Brochez put the full contents of the HIV Registry up to January 2013 online and provided the link to a non-government party, the likelihood of the identities being made public increased significantly.

"MOH therefore decided to make a public announcement on Jan 28 even though we remained deeply concerned about the impact this would have on the affected persons," said Mr Gan.

"We sought to quickly contact each of the affected individuals to inform them of the circumstances and also offer them assistance prior to the announcement. We worked with the police and other relevant parties to disable access to the information as quickly as possible."

Mr Gan stressed that at each juncture in 2016, last year and this year, MOH had to make judgment calls.

"It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident," he said, alluding to comments that the ministry had been less than open about the matter. He added: "On all three occasions, MOH's primary concern was the well-being of the persons on the HIV Registry."

He also elaborated on how the ministry had been tightening security of the HIV Registry since 2012, even before the issue surfaced.

Wrapping up, he said this has been "a regrettable incident caused by the irresponsible and deplorable actions of two individuals".

Ler betrayed the trust of the ministry and the medical profession.

Mr Gan said: "I am sorry that the irresponsible actions of one of our officers have resulted in such distress to the affected persons."

As for Brochez, he said: "We will spare no effort in bringing him to justice again for his latest crime."


Reports from Parliament on the HIV data leak:

How the HIV data leak was handled

MOH had to exercise care, judgment in deciding whether to inform public: Gan

MOH knew only in 2016 that Brochez had access to HIV data

MPs ask about support for those affected and recourse available

Why Brochez was not charged under Official Secrets Act in 2016

2,400 Singaporeans affected by data leak contacted by MOH

HIV Registry security safeguards in line with govt policy then

People hold power to fight stigma, show compassion

Join ST's Telegram channel and get the latest breaking news delivered to you.

A version of this article appeared in the print edition of The Straits Times on February 13, 2019, with the headline Parliament: Gan Kim Yong explains actions MOH took over HIV data breach. Subscribe