SINGAPORE - The doctor who leaked the details of 14,200 people with confirmed HIV, and another 2,400 of their contacts - including sexual partners and drug users who could also be at risk of infection - is still on the Register of Medical Practitioners.
But he no longer has a practising certificate, which is required to practise medicine in Singapore, said the Ministry of Health (MOH).
Also, unlike other doctors, Ler Teck Siang no longer has access to confidential information of patients in the National Electronic Health Records (NEHR), which includes all public sector patients.
The MOH said: "Ler remains registered as a doctor, but he currently does not have access to MOH and public healthcare IT systems with patient records. In particular, he has had no access to the NEHR system since January 2014. He will not be permitted access to any of these systems."
When asked why he has not been taken off the Register, Associate Professor Benjamin Ong, the Singapore Medical Council (SMC) Registrar, said the council has to follow "due process".
Prof Ong, who is also the Director of Medical Services at the Ministry of Health (MOH), said Ler has appealed against his 24-month conviction and the appeal will be heard in March.
Ler had given a sample of his blood in place of that of his HIV-positive boyfriend Mikhy Farrera-Brochez.
Now, he faces another charge of "mishandling" information under the Official Secrets Act (OSA) while he was head of the National Public Health Unit.
This resulted in details of all 14,200 people diagnosed with HIV here since 1985 - till 2013 for locals and 2011 for foreigners - to land in the hands of Farrera-Brochez. The American also has the details of 2,400 people who were their contacts.
The information includes their names, identification numbers, phone numbers and addresses.
He recently released these details online.
Meanwhile, the charge against Ler under the OSA is pending his appeal on the earlier charges. Historically, the SMC does not take action against a doctor until any legal appeals have disposed of.
MOH's decision to announce the leak
Mr Chan Heng Kee, permanent secretary at the MOH, said the ministry looks at several factors in deciding whether to go public on such incidents.
The key consideration is patients' interest and well being.
He said: "From there, we consider factors, (such as) whether the information was secured. Whether the information was publicly disclosed. Whether there is a continuing risk of the information being exposed even if we were able to secure.
"And also the concerns that individuals might have, should the incident be made public."
In this case, the information has been disclosed online.
He added: "Certainly in the case where the information has been contained, we would take a more conservative approach."
The other reason is that more than half those affected are foreigners who will be difficult for the ministry to contact.
"We recognise that even with our best efforts, there are a lot of individuals who we will not be able to contact," he said.
Going public may get those with concerns to contact MOH.
The confidential information can resurface in future
The authorities have blocked online access to the details put out by Farrera-Brochez. But they were not able to retrieve the information from him, as they have not been able to get in touch with him since he is no longer in Singapore.
Said Mr Chan: "He is still in possession of the information it is possible that it could still be publicly disclosed."
It is also possible that others have now got copies of the information, either after he had put it online, or were given to them by him.
MOH is open to legal action
The MOH "has no statutory immunity" and hence, cannot "rule out the possibility of lawsuits" as a result of this breach .
Mr Chan said a lot would depend on what the police uncovers in its investigation.
However, the ministry is doing everything possible to help these people, including providing them with a hotline and counsellors. Many of the 900 who have been contacted as at 1 pm yesterday were anxious, distressed and concerned, he said.
Steps taken to prevent future leaks
Associate Professor Vernon Lee, director of Communicable Diseases Division at the ministry said safeguards against such a breach has been rolled out since 2016.
Now, two people must approve before the information can be downloaded and decrypted. This has to be done at a designated workstation that is "specifically configured and locked down" to prevent unauthorised removal of information.
Correction note: The story has been edited to reflect that Ler Teck Siang currently does not have a practising certificate, which is required to practise medicine in Singapore.