Parliament: MOH had to exercise care, judgment in deciding whether to inform public on HIV data data leak: Gan Kim Yong

Health Minister Gan Kim Yong said that on all three occasions when it came to light that Mikhy Farrera Brochez had data from the HIV Registry, the Health Ministry's primary concern was the well-being of the people on the registry.
Health Minister Gan Kim Yong said that on all three occasions when it came to light that Mikhy Farrera Brochez had data from the HIV Registry, the Health Ministry's primary concern was the well-being of the people on the registry.PHOTO: REUTERS

A key factor in the Government's decision not to disclose the HIV Registry data breach when it first came to light in 2016 was that there was no evidence the information had been disseminated to the public then, Health Minister Gan Kim Yong told Parliament yesterday.

Another was the sensitivity surrounding HIV status.

In April 2016, American Mikhy Farrera Brochez revealed to the authorities that he had names and particulars from the registry.

The Ministry of Health (MOH) had to decide whether to inform the affected persons and make a public announcement about this. It decided not to.

"On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV - would it serve their interest, or harm them instead?" said Mr Gan.

He discussed this with medical colleagues in MOH. "They emphasised the need to pay particular attention to the concerns and needs of HIV patients. A person's HIV status is a deeply emotional and personal matter. Some patients will experience high anxiety and distress from a disclosure or announcement," he said.

"Some will feel compelled to reveal their HIV status to family members or friends. Relationships can be disrupted; lives can be changed. We had to exercise care and judgment in making our decision, and the well-being of the affected persons weighed heavily in our considerations."

JUDGMENT CALL

It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident... We now know that Brochez retained some data after the police seized all the files they could find in 2016. Quite possibly, he still has more files in his possession... Should MOH now make known all that Brochez may or may not still possess? Do we contact every person whose data may or may not be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?

HEALTH MINISTER GAN KIM YONG

Brochez sent the names and particulars of 75 individuals to the police and government authorities in April 2016. After an "extensive" search of his residence, computers, storage devices and e-mail account, the police seized or deleted all relevant information they found.

The police also found that Brochez had e-mailed a further 46 records to his mother. She agreed to let the police access her e-mail account and delete the records.

 
 
 
 

Mr Gan said: "While there could be no guarantee, MOH had good reason to believe that the information had been secured and the risk of future exposure significantly mitigated."

Of the decision to go public, he said: "Ultimately, it was a judgment call, to be made based on the information we had, the considerations for and against an announcement, and the assessed risk of future public exposure of the information."

He said MOH judged that, on balance, an announcement then would not serve the interests of the affected individuals when weighed against the inevitable anxiety and distress they would experience.

Brochez was deported in April last year after serving his sentence for drug use and cheating offences.

Last May, he sent a screenshot containing 31 records from the HIV Registry to several government authorities, indicating that he still possessed data from the registry.

MOH then contacted the affected individuals to inform them of the leak, but it decided not to inform the public as the 31 records were part of the 75 Brochez had previously disclosed.

Mr Gan said: "As on previous occasions, Brochez had only shared it with government authorities, and not to any wider audience. A public announcement would create anxiety and distress not just among the 31 persons, but also other HIV patients whose names were in the registry."

Last month, Brochez put the entire contents of the HIV Registry up to January 2013 online and sent the link to a non-government party.

MOH then decided to make a public announcement on Jan 28 as the likelihood of the affected people's identities being made public had increased significantly, Mr Gan said.

Some individuals then told MOH that Brochez had attempted to contact them last year and had given them links to confidential information he had uploaded online.

 
 

It was similar to what he uploaded last month, and no new individuals were affected. MOH worked with other authorities to block access to this information, Mr Gan said.

He said that at each juncture when it came to light that Brochez had information from the registry - May 2016, May last year and last month - MOH had a responsibility to balance the opposing considerations and exercise judgment.

"It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident," he said.

He stressed that on all three occasions, MOH's primary concern was the well-being of the persons on the HIV Registry.

The authorities still face the same dilemma today. "We now know that Brochez retained some data after the police seized all the files they could find in 2016. Quite possibly, he still has more files in his possession," said Mr Gan.

"Should MOH now make known all that Brochez may or may not still possess? Do we contact every person whose data may or may not be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?"

He said MOH has decided to continue to manage the situation in a way that reduces the possibility of further exposure.

"This is consistent with the decision taken in 2016, and again in 2018. It is based on what we believe to be in the interest of the potentially affected persons."

 
A version of this article appeared in the print edition of The Straits Times on February 13, 2019, with the headline 'MOH had to exercise care, judgment in deciding whether to inform public: Gan'. Print Edition | Subscribe