HIV data leak: ‘I reject any allegation MOH sought to cover up incident,’ says Gan Kim Yong
The Health Minister also gave more information on how the incident, which saw information affecting 14,200 with HIV leaked online, happened.
SINGAPORE: Health Minister Gan Kim Yong gave a strong defence of his ministry in Parliament on Tuesday (Feb 12) in the aftermath of the HIV data leak incident and rejected any allegation the Ministry of Health (MOH) sought to “cover up the incident”.
Mr Gan said in his ministerial statement that the basis of the ministry’s decisions and actions, especially on the issue of disclosure and announcement of the incident, was weighed against opposing considerations such as what would best serve the interest of those affected and the public.
He was responding to 10 parliamentary questions filed by MPs during this sitting.
The HIV-positive status of 14,200 people, along with confidential information such as their identification numbers and contact details, were leaked online by US citizen Mikhy K Farrera Brochez. This was revealed late last month by the ministry, which added that access to the information was disabled and it is working with other parties to scan the Internet for further disclosures.
Since then, the American was charged in the US with trying to trespass into his mother’s house in Clark County last December.
“A JUDGMENT CALL”
MOH first had evidence that Brochez may have access to confidential HIV-related data in 2016, after he provided the police and Government authorities 75 names and particulars from the HIV Registry. A police report was subsequently made.
This revelation came after Brochez was arrested for repeatedly refusing to comply with MOH’s order to take a blood test, Mr Gan said.
READ: The leaking of Singapore’s HIV registry records and the hunt for Mikhy Farrera Brochez: A timeline
The ministry then had to decide whether to inform the affected persons and whether to make a public announcement about the incident, which the minister said were “not straight-forward decisions”.
“On the one hand, there is the need to be transparent,” he elaborated. “On the other hand, we need to consider the impact of an announcement on the affected persons with HIV – would it serve their interest, or harm them instead?”
Mr Gan said he discussed the matter with medical colleagues in the ministry, who emphasised the need to pay particular attention to the concerns and needs of HIV patients as the health status is a “deeply emotional and personal matter”.
He added that one key factor was there was no evidence the confidential information had been disseminated to the public. Brochez had sent the information to Government authorities, and the police search was “extensive and all relevant material found had been seized or deleted”.
MOH had good reason to believe then that the information had been secured and the risk of future exposure “significantly mitigated”, he said.
“Ultimately, it was a judgment call,” Mr Gan said.
“MOH judged that, on balance, an announcement then would not serve the interests of the affected individuals, when weighed against the inevitable anxiety and distress they would experience.”
The 31 records were a sub-set of the 75 records he had previously revealed in 2016, and the ministry filed another police report.
This time, though, it decided to contact the 31 affected individuals to alert them to the matter because of one difference: It could not retrieve the screenshot of the 31 records in Brochez’s possession, Mr Gan said.
READ: ‘I am sorry’: Gan Kim Yong says health ministry providing support to HIV sufferers affected by data leak
“We did not make a public announcement as there was still no specific evidence that Brochez had more information beyond these 31 records,” he added. “Furthermore, as on previous occasions, Brochez had only shared it with Government authorities and not to any wider audience.
“A public announcement would create anxiety and distress not just among the 31 persons but also other HIV patients whose names were in the registry,” the minister said.
Nominated Member of Parliament (NMPs) Associate Professor Walter Theseira had asked why the data leak was not publicly disclosed when the first police report was made in 2016. Others who asked questions include fellow NMPs Lim Sun Sun and Anthea Ong, Workers’ Party’s Png Eng Huat, Leon Perera, Dennis Tan and Daniel Goh and Mr Seah Kian Peng from the ruling People’s Action Party (PAP).
MORE DATA IN BROCHEZ’S HANDS?
So why did the ministry decide to reveal the incident publicly in January this year?
Mr Gan said the most recent incident “stand on a different footing” from the earlier incidents as it showed Brochez still possessed the entire HIV Registry beyond the 31 records. He had also put the information online and provided the link to a non-government party, he added.
This means the likelihood of the identities of affected persons being made public by him had “increased significantly”, the minister said.
The Health Ministry made a public announcement on Jan 28 even though it “remained deeply concerned” about the impact this would have on those affected, he said.
“MOH made a judgment call, balancing the various considerations. It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident,” Mr Gan said.
“On all three occasions, MOH’s primary concern was the wellbeing of the persons on the HIV Registry.”
The minister said the same dilemma faced in 2016 and 2018 remained today, given the knowledge that Brochez had retained some data after the police seized all the files they could find in 2016. It is also possible he has more data in his possession, he added.
“Should MOH now make known all that Brochez may (or may not) still have in his possession? Do we contact every person whose data may (or may not) be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?” Mr Gan said.
This is why MOH decided to continue to manage the situation in a way that reduces the possibility of further exposure, and is consistent with the decisions made in 2016 and 2018.
“It is based on what we believe to be the interest of the potentially affected persons,” he reiterated.