Former NCMP Gerald Giam questions why MOH took two years to notify affected individuals of the HIV data theft

In the latest HIV data leak fiasco, former Non-Constituency Member of Parliament (NCMP) Gerald Giam questioned why the Ministry of Health (MOH) took more than two years to notify the affected individuals of the data theft.

Mr Giam wrote this on his Facebook page on Tuesday (29 January) saying that the “alleged theft and leak of highly sensitive medical information from MOH’s HIV Registry is most disturbing and sickening”.

On Monday (28 January), MOH revealed that the HIV-positive status of 14,200 people – along with confidential information such as their identification numbers and contact details – has been leaked online by an “unauthorised person”.

The records were those of 5,400 Singaporeans diagnosed with HIV from 1985 to January 2013 and 8,800 foreigners, including work and visit pass applicants and holders, diagnosed with HIV from 1985 to December 2011.

MOH has revealed that about 1,900 names in the leaked data were of people who had already died.

The suspect is former Singapore resident, US citizen Mikhy K Farrera Brochez who is currently residing outside of the island. He was convicted of numerous fraud and drug offences, as well as lying to the Ministry of Manpower about his HIV status, the health ministry said.

Brochez was remanded in prison in June 2016, sentenced to 28 months’ jail and deported from Singapore in April 2018. At the time of writing, Brochez is yet to be apprehended for leaking the HIV data.

In his post, Mr Giam also wondered how one individual was able to download 14,200 patient records if he was only using an end user’s account and not a system administrator.

He went on further to ask, “Can end users still export out so many records at one go?”

It appears that Brochez used his Singaporean doctor partner’s blood sample to pass blood tests so that he could work in Singapore, the health ministry said.

His partner, Ler Teck Siang, was the head of MOH’s National Public Health Unit from March 2012 to May 2013. Prior to resigning in January 2014, Ler had access to the HIV registry as required for his work, the ministry said.