HIV data leak: MOH's data policies bolstered, fight against stigma to continue, says Gan
A Data Governance Division within MOH’s Data Analytics Group was set up to come up with policies, practices and guidelines with regard to how the ministry uses data, says Health Minister Gan Kim Yong.
SINGAPORE: The Ministry of Health (MOH) is taking steps to strengthen its data policies and practices when handling patient data, Health Minister Gan Kim Yong said on Tuesday (Feb 12) following the leak of 14,200 HIV sufferers’ information online by American Mikhy Farrera Brochez last month.
Mr Gan also called on Singaporeans to stand with affected individuals and fight against the stigma faced by people living with HIV in his ministerial statement delivered in Parliament.
Brochez had gotten his hands on the HIV Registry data from his then-partner Ler Teck Siang. Ler was the head of the National Public Health Unit (NPHU) from March 2012 to May 2013, and had authority to access information in the registry as required for his work, the minister said.
Before 2012, the HIV Registry was placed in a secured network drive; the file could only be accessed and downloaded from Government-issued computers and was password protected.
NPHU staff would need to download the registry in order to carry out routine data entry, contact tracing and analysis, and back then, they were allowed to use personal thumb drives, if they followed data protection policies, he explained.
Ler is believed to have downloaded the registry into a thumb drive and failed to retain possession of it.
The registry database was then migrated to a network-based system in 2012, and NPHU employees did not need to download the registry to do their work.
With this, the audit trail was also enhanced and this was further bolstered in 2014 when alerts of multiple failed login attempts were added, Mr Gan said.
The minister said MOH has implemented several controls to tighten the systems in accordance with government guidelines for securing classified information.
Its chief data officer, for one, conducted a security review for NPHU in 2016 and following that, enhancements were introduced, such as elevating the approval authority to download and decrypt HIV Registry data to the level of director of the Communicable Diseases Division and above.
It also designated a specific workstation for the processing of sensitive data from the HIV Registry, and the station is configured and locked down to prevent unauthorised data removal, the minister said.
The NPHU complied with a government-wide policy to disable the use of unauthorised portable storage devices on official computers in 2017, as well as using only authorised and encrypted thumb drives.
Mr Gan also revealed that a Data Analytics Group was set up in April last year, and within it, a Data Governance Division, to give greater attention to data usage and safeguards.
“The aim is to protect and secure access to health sector data, in accordance with data protection requirements in the Government Instruction Manuals and Personal Data Protection Act, and other MOH sectoral legislation,” he said, adding that the ministry will expand the role and resourcing of this unit.
FIGHTING HIV STIGMA
Besides tightening up internal policies, Mr Gan also shared how MOH is working with other agencies to promote de-stigmatisation of HIV in Singapore – a point raised by several MPs in their questions.
READ: Public attitudes of HIV have not moved beyond narratives of fear, prejudice from early years of global epidemic
The minister said MOH has increased financial support and lowered the financial barriers for HIV treatment through Medisave and MediFund, given that clinically, such treatments have improved and early treatment can delay the progression of the disease and improve quality of life.
With the introduction of MediShield Life in 2015, those with HIV are covered by the national health insurance scheme should they be hospitalised, he added.
The ministry has also made HIV testing and counselling services more widely available. Anonymous HIV testing is now available at 10 sites across Singapore, Mr Gan shared.
Support from doctors, medical social workers and healthcare workers is also widely available in the public hospitals. Generally, every HIV patient in public healthcare institutions is assigned to a medical social worker, he added.
Furthermore, MOH has been working with stakeholders to raise awareness of the disease and reduce stigma. For instance, guidelines on fair employment practices call for employers to treat employees fairly and on merit, including those with HIV.
“MOH will continue to work with partner organisations to step up efforts in public education, stigma reduction, prevention, testing, treatment and counselling support,” Mr Gan said.
“But beyond this, how each of us as individuals relate to persons with HIV also matters, a lot. I would like to appeal to Singaporeans to stand in support of these affected individuals, and our efforts to fight the stigma against persons living with HIV.”
He also called on the public and media not to share illegally obtained information and to inform the police and MOH immediately.
“As individuals and part of the larger Singaporean community, the best way for us to respond to this incident is with sensitivity, understanding and support for those affected,” the minister said.
“If we can say no to discrimination and reduce the stigma surrounding HIV, we can turn the harm and discord which the perpetrators seek to sow into a more inclusive and supportive environment for persons living with HIV.”