TL;DR – Or maybe MOH was considering the feelings of those affected?
Minister for Health Gan Kim Yong finally gave a full ministerial statement in Parliament regarding the leak of confidential information of 14,200 HIV-positive people in Singapore an American called Brochez. Brochez got the data from his then boyfriend, Ler, who was, at that time, the Head of MOH’s National Public Health Unit (NPHU).
In the statement, Minister Gan emphasized that MOH did not seek to cover up the leak. Instead, MOH made judgement calls to balance competing considerations. He said:
On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV – would it serve their interest, or harm them instead?
… MOH made a judgment call, balancing the various considerations. It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident… On all three occasions, MOH’s primary concern was the wellbeing of the persons on the HIV Registry.
As expected, some Singaporeans don’t buy Minister Gan’s explanations. They remain convinced, and some are even angry, that MOH shouldn’t have waited two years before announcing that such confidential and sensitive data has been leaked.
But before you jump on the bandwagon to whack the government, consider the feelings of those who are most affected – the people whose confidential information was leaked.
Imagine you are one of the individuals whose confidential information was leaked. When Brochez provided the Police and government authorities with 75 names and particulars from the HIV Registry back in 2016, the Police very quickly raided Ler’s and Brochez’s premises simultaneously, and seized and secured all relevant materials. These included their computers and electronic storage devices containing files with confidential information from the HIV Registry, files related to hospital services and to other infectious diseases, as well as other information likely used by Ler for his work. The Police also moved quickly to seize everything they found in Ler’s and Brochez’s possession, and had done their best to ensure that no further confidential information remained with Ler and Brochez, including in their known online accounts.
At that time, would it have benefitted you to know that some clown called Brochez had access to your particulars? If you had known, how would it have made you feel? Would you feel better? Or would you start feeling anxious, stressed out, traumatised? Even if you knew, what could you have done? Or would you ended up being upset for nothing?
Now imagine that the issue had ended in 2016, that Brochez didn’t have any more sensitive data of HIV-positive people, would it have mattered to you that you didn’t know? It would probably have been better for you that you didn’t know, right? So that you didn’t have to be unduly worried, upset, traumatised.
But as things escalated, when MOH found out in May 2018 that Brochez, who had already been deported to USA, still had confidential data of 31 HIV-positive individuals, and could potentially leak the data to a wider audience, MOH decided to contact those 31 people. Presumably, this is to make sure that those 31 people don’t get a rude shock should they see their particulars and HIV status appear in some website. Again, MOH took a more conservative approach so that they didn’t end up alarming more people than was necessary.
Let’s also consider the scenario if MOH had made the information public earlier, what (else) would have happened? Would the stigma surrounding those with HIV worsen, resulting in those who are unsure about seeking help not coming forward?
So MOH’s approach of informing only when necessary was to minimise alarm and reduce the trauma that the people affected would have to suffer, and minimise the worsening of the stigma surrounding those with HIV. Maybe MOH was trying to be less cold and clinical and be more… human, more empathetic. Is that wrong? Perhaps. Perhaps we would rather MOH not care about people’s feelings, be bureaucratic, go by the book, in fact, go by every single book, and loudly, publicly announce as soon as possible and cover their own backsides. Is that really what we want? Really?
Of course, this doesn’t mean that MOH shouldn’t put in place more robust policies and safeguards to ensure such incidents don’t happen again. And it has, although a little late. These include the following:
- Elevating the approval authority for downloading and decrypting Registry data to the level of the Director of our Communicable Diseases Division (CDD) or higher.
- Implementing a two-person approval process to download and decrypt Registry data, to ensure that data could not be accessed by a single person.
- Designating a specific workstation for processing of sensitive data from the HIV Registry. This workstation is configured and locked down to prevent unauthorised data removal.
In 2017, the NPHU also complied with government-wide policy to disable the use of unauthorised portable storage devices on official computers, and only allow use of authorised and encrypted thumb drives.
Better policies and safeguards aside, it’s important for us to remember that the real culprit is Brochez. What he did was… disgusting. His actions hurt many individuals. Our response now matters.
As Speaker of Parliament, Mr Tan Chuan-Jin emphasized this in a Facebook post: “It is tremendously challenging for those whose names may be in the lists. They are fearful and traumatised. But they are fearful and traumatised because they fear the response and reactions of their loved ones, colleagues, friends. And the public. Our response.”
For some of our fellow Singaporeans, this is a difficult time. If we can help, let’s.
Meanwhile, this, just in from the Singapore authorities, in response to the social media posts by “pathological liar” Brochez,