Yesterday (28 Jan), Ministry of Health (MOH) announced that confidential information from its database, regarding 14,200 individuals diagnosed with HIV up to January 2013, and 2,400 of their contacts, has been leaked.
The records were those of 5,400 Singaporeans diagnosed with HIV up to January 2013 and 8,800 foreigners diagnosed with HIV up to December 2011. Health Minister Gan Kim Yong apologised for the leak.
The information was said to have been held and leaked by Mikhy Farrera-Brochez, 33, an American who was teaching in a polytechnic in Singapore till June 2016.
Two years ago, he was sentenced to 28 months in jail for fraud and drug-related offences, including lying to the Ministry of Manpower about his own HIV status. Farrera-Brochez, who was HIV-positive, was found to have used his boyfriend’s blood for an HIV test to apply for an employment pass to stay in Singapore.
His male partner was Ler Teck Siang, a Singaporean doctor who was head of MOH’s National Public Health Unit from March 2012 to May 2013. Ler, 36, had the authority to access information in the HIV Registry at MOH. Ler has since been convicted of abetting Farrera-Brochez to commit cheating and of providing false information to the police and MOH.
However, as far back as in May 2016, MOH has already received information that Farrera-Brochez possessed the confidential data from its HIV Registry. A police report was made by MOH but it did not inform the public about it.
Farrera-Brochez and Ler’s properties were later searched by the police, and all relevant material found then were seized. But the police did not know that the American still has the data stored somewhere.
In May 2018, after Brochez was deported from Singapore upon completing his sentence in April 2018, MOH received information that he still possessed at least part of the confidential data. MOH filed yet another police report. It did not disclose this to the public but only to those affected.
Only when the police notified MOH last week (22 Jan) that the confidential information possessed by Farrera-Brochez has been leaked online that MOH decided to inform the public yesterday.
Vice-president of MARUAH, Ngiam Shih-Tung wrote about the gap between the knowledge of the dataleak and the recent announcement. He noted that while MOH knew about the dataleak and yet still tried to pushed through its proposed National Electronic Health Record (NEHR) back in 2017.
The Ministry of Health sought to have private clinics contribute data to the NEHR via a Healthcare Services Bill introduced to parliament. It said that such a move is aimed at providing better care for patients.
It was only after the cyberattack announcement of SingHealth data records in 2018, that the Health Minister declared that mandatory contributions to the NEHR were being put on hold until further notice pending a cyber-security review of the system.