American lecturer Mikhy Farrera Brochez complains to the Ministry of Health (MOH) that his Singaporean boyfriend Ler Teck Siang, then head of the National Public Health Unit, had disclosed to others information about Brochez's HIV status.
Brochez also claims that Ler had shared screenshots of his HIV status with others.
MOH attempts to engage Brochez, but he is uncooperative and evasive, and postpones meetings. At one point, he says he does not want to continue with the investigations into his allegations. MOH keeps up the investigation nonetheless.
Ler is reassigned to another role. His access to the live HIV Registry is terminated.
MOH discovers that Brochez may have submitted fake HIV blood tests to the Ministry of Manpower (MOM) to retain his Employment Pass.
MOH informs MOM and makes a police report.
Ler resigns from MOH.
The police and MOH begin investigating whether Brochez had submitted fake blood tests and whether Ler had abetted him and provided false information to investigators.
Brochez continues to be uncooperative with the police, and at first refuses to provide a statement to the police.
That month, he is stopped from leaving Singapore, and gives a police statement. In it, he lies to the police that it was his blood that was tested during a HIV test conducted in November 2013.
MOH orders Brochez to undergo a new blood test, but he refuses.
Brochez is arrested for repeatedly refusing to take a blood test. He provides police and other government authorities with a list of 75 names and particulars from the HIV Registry.
This is the first time MOH has evidence that Brochez may have access to the confidential data, said Mr Gan.
MOH makes another police report on May 16.
Police raid Ler's and Brochez's premises, seizing computers, electronic storage devices and other materials.
Police discover that Brochez had sent a further 46 records from the registry to his mother by e-mail. She agrees to let police access her account and delete the records. MOH says the police, at this point, have seized everything found in the duo's possession and have done their best to ensure no confidential information remained with them.
A decision is taken not to make a public announcement as it "would not serve the interests of the affected individuals", said Mr Gan.
Ler and Brochez are charged in court.
Ler is charged under the Penal Code and the Official Secrets Act (OSA). His charge sheet, which is public information, states he had access to the HIV Registry as part of his position at MOH, and that he had failed to take reasonable care of the information in the registry by failing to retain possession of a thumb drive on which he had saved the registry.
Brochez is charged under the Misuse of Drugs Act, Penal Code and the Infectious Diseases Act.
The Attorney-General's Chambers decides not to charge him under the OSA. It assesses that he would likely be sentenced to a fine only or at most a few weeks in jail as there had been no wide dissemination of the information at that stage, and he had primarily used the information to complain to government agencies. His other charges are more serious and carry "far heavier penalties".
Brochez is issued a stern warning under the OSA.
Brochez is convicted and jailed for 28 months, inclusive of time he had served in remand since June 2016.
Brochez is released from jail and deported.
Brochez sends a screenshot to several government authorities containing the details of 31 persons. They are found to be among the original 75 names he disclosed in 2016.
MOH makes another police report.
It also decides to contact the 31 individuals to inform them. This was because unlike before, it could not retrieve the screenshot of the 31 records in Brochez's possession.
MOH did not make a public announcement as there was still no specific evidence Brochez had more information beyond these 31 records. Also, he had shared it only with the government authorities and not with any wider audience. "A public announcement would create anxiety and distress not just among the 31 persons, but also other HIV patients whose names were in the registry," said Mr Gan.
Ler is convicted and sentenced to 24 months in jail. He appeals and is scheduled to appear in court in March 2019. His OSA charge is currently stood down, but will be dealt with after proceedings on his other charges have concluded.
MOH becomes aware that Brochez probably still possessed the entire HIV Registry beyond the 31 records. He had also put the information online and provided the link to a non-government party.
This means the likelihood of him making public the identities of affected persons rises significantly. MOH decides to make a public announcement. It also contacts affected persons and works with the police and other parties to disable access to the information quickly.