Mr Speaker Sir,
1. On 22 January 2019, the Ministry of Health (MOH) was alerted to a case of unauthorised possession and wrongful online disclosure of information from the HIV Registry by Mikhy K Farrera Brochez, affecting 14,200 individuals diagnosed with HIV, and 2,400 of their contacts.
2. The incident has caused anxiety and distress to the affected persons. This matter is especially delicate as it involves persons living with HIV. Our priority is their wellbeing.
BACKGROUND
3. Members have asked several questions regarding the incident. Let me first give a brief account on what happened, the actions we took, and why.
Brochez’s Complaint Against Ler (2012 – 2013)
4. Some have asked whether MOH had known about Brochez’s possible access to HIV Registry information in 2012, when he first made a complaint to MOH. Let me clarify that the issue then was not about Brochez’s access to HIV Registry information, but a different one.
5. Brochez was then a partner of Dr Ler Teck Siang who was then the Head of the National Public Health Unit, and they had lived together. In November 2012, Brochez alleged that Ler had disclosed information about Brochez to others. He later also claimed that Ler had shared screenshots of his HIV status with others.
6. Despite multiple attempts by MOH to engage him, Brochez did not provide any evidence to support his allegation. He was uncooperative and evasive, and rejected or postponed meetings with MOH on several occasions. At one point, he even informed MOH officers that he was leaving Singapore and did not want to continue with the investigation into his allegation. Due to his uncooperative attitude, the investigation could not make much headway. Nevertheless, we reassigned Ler to another role in May 2013, and kept up the investigation. Ler’s access to the live HIV Registry was terminated after his reassignment.
7. In the course of our investigation, MOH discovered in December 2013 that Brochez may have submitted fake HIV blood tests to MOM in order to retain his employment pass. We informed MOM and also made a police report. Ler resigned the following month.
8. MOH’s investigations in 2012 and 2013 were on Brochez’s allegation that Ler had revealed Brochez’s HIV status to others. At no point in 2012 or 2013 did MOH have basis to suspect that Brochez had access to, or was in possession of, the data in the HIV Registry.
Police and MOH Investigation Between 2014-2016
9. Between 2014 and 2016, Police and MOH investigated whether Brochez had submitted fake blood tests, and whether Ler had abetted this process and provided false information to investigators. These investigations were difficult as Brochez continued to be uncooperative and initially refused to provide a statement to the Police.
10. The Police eventually recorded a statement from Brochez in May 2014, after he was stopped trying to leave Singapore. When interviewed, Brochez lied to the Police that it was his blood that was tested during a HIV test conducted in November 2013.
11. MOH then ordered Brochez to undergo a fresh blood test for HIV to verify his claim but Brochez refused to cooperate.
What Happened in 2016
12. In late April 2016, Brochez was arrested for repeatedly refusing to comply with MOH’s order to take a blood test. He then provided the Police and government authorities 75 names and particulars from the HIV Registry.
13. This was the first time MOH had evidence that Brochez may have access to HIV related data. We made a Police Report on 16 May 2016.
14. The Police raided Ler’s and Brochez’s premises simultaneously, and seized and secured all relevant materials. These included their computers and electronic storage devices containing files with confidential information from the HIV Registry, files related to hospital services and to other infectious diseases, as well as other information likely used by Ler for his work such as emails, HIV studies and reports.
15. The Police searched through Brochez’s email account and found that Brochez had sent the same screenshot that he had sent to government authorities, as well as a PDF file of a further 46 records from the HIV Registry, to his mother. The Police then contacted Brochez’s mother, who agreed to let the Police access her email account and deleted those records.
16. At this point, the Police had seized everything they found in Ler’s and Brochez’s possession, and had done their best to ensure that no further confidential information remained with Ler and Brochez, including in their known online accounts. It was always recognised that there was a risk that Brochez could have hidden away some more information. Unfortunately, as recent events showed, Brochez did manage to retain at least the data which he has recently disclosed, and we cannot rule out the possibility that he has more.
17. Ler and Brochez were both charged in Court in June 2016. Ler was charged both under the Penal Code and OSA. Ler’s charge sheet, which was public information, stated that he had had access to the HIV Registry as part of his position as the Head of NPHU in MOH, and that he had failed to take reasonable care of the information in the HIV Registry by failing to retain possession of a thumb drive on which he had saved the HIV Registry.
18. Brochez was charged for offences under the Misuse of Drugs Act, Penal Code and Infectious Diseases Act (IDA). AGC decides on the charges. AGC decided not to charge him under the OSA because they assessed that he would likely be sentenced to a fine only, or at most a few weeks in jail. This was because there had been no wide dissemination of the information at that stage, and he had primarily used the information to complain to Government agencies. He was already facing numerous fraud and drug-related charges, which carried far heavier penalties. AGC also assessed that any jail term under the OSA was likely to be concurrent with jail terms that he would serve under the other offences.
19. Brochez was therefore issued with a stern warning for the OSA offence.
20. Brochez was subsequently convicted in March 2017, and sentenced to 28 months’ imprisonment. In its judgement, the Court found that Brochez had “deliberat[ly] flout[ed] the law for personal benefit”, and that there was “not a single-word of regret”.
Weighing Whether to Inform Affected Individuals and Making Public Announcement
21. Mr Speaker Sir, let me now address questions as to whether MOH should have informed the public earlier. In 2016 MOH had to decide whether to inform the affected persons and whether to make a public announcement about the incident.
22. These were not straightforward decisions. On the one hand, there is the need to be transparent. On the other hand, we need to consider the impact of an announcement on the affected persons with HIV – would it serve their interest, or harm them instead?
23. I discussed this with my medical colleagues in MOH. They emphasised the need to pay particular attention to the concerns and needs of HIV patients. A person’s HIV status is a deeply emotional and personal matter. Some patients will experience high anxiety and distress from a disclosure or announcement. Some will feel compelled to reveal their HIV status to family members or friends. Relationships can be disrupted; lives can be changed. We had to exercise care and judgement in making our decision, and the wellbeing of the affected persons weighed heavily in our considerations.
24. One key factor was that there was then still no evidence that the confidential information had been disseminated to the public. Brochez had sent the information to Government authorities. The Police search was extensive and all relevant material found had been seized or deleted. While there could be no guarantee, MOH had good reason to believe that the information had been secured and the risk of future exposure significantly mitigated.
25. Ultimately, it was a judgement call – to be made based on the information we had, the considerations for and against an announcement, and the assessed risk of future public exposure of the information. MOH judged that on balance, an announcement then would not serve the interests of the affected individuals, when weighed against the inevitable anxiety and distress they would experience.
What Happened in 2018
26. Two years later, in April 2018, Brochez was deported from Singapore after serving his sentence, and we had no basis to keep him here.
27. In May 2018, after his deportation, Brochez sent a screenshot containing 31 records from the HIV Registry to several government authorities. All 31 records were not new. They were a sub-set of the 75 which Brochez had earlier revealed to authorities in 2016. MOH lodged another Police report.
28. We considered again whether to inform the affected individuals and the public. The relevant factors were similar to those in 2016. But there was one difference. This time, we could not retrieve the screenshot of the 31 records in Brochez’s possession, because he was already out of Singapore.
29. MOH therefore decided to contact the 31 affected individuals, and alert them to the matter. We did not make a public announcement as there was still no specific evidence that Brochez had more information beyond these 31 records. Furthermore, as on previous occasions, Brochez had only shared it with Government authorities, and not to any wider audience. A public announcement would create anxiety and distress not just among the 31 persons but also other HIV patients whose names were in the Registry.
30. In September 2018, Ler was convicted of abetting Brochez to commit cheating, and also of providing false information to the Police and MOH. He was sentenced to 24 months’ imprisonment. Ler has appealed and this is scheduled to be heard in March 2019.
31. Ler’s charge under the OSA is currently ‘stood down’. That means that the OSA charge has been put aside for the moment, but it remains before the Courts and will be dealt with after proceedings on his other charges have concluded. AGC decided to go to trial against Ler on the cheating and false information charges first, as they were more serious and carried stiffer penalties. The trial for his drug charges will be held next, as these also involve stiffer penalties, including mandatory caning. So that there is no doubt, let me say again that OSA charge against Ler is still ‘live’. AGC will decide on the OSA charge, after proceedings on his other charges have concluded. This is the usual course.
Why is January 2019 Different?
32. The most recent incident in January 2019 stood on a different footing from the earlier incidents. It showed that Brochez probably still possessed the entire HIV Registry, beyond the 31 records. He had also put the information online and provided the link to a non-government party.
33. This new situation meant that the likelihood of the identities of affected persons being made public by Brochez had increased significantly. MOH therefore decided to make a public announcement on 28 January, even though we remained deeply concerned about the impact this would have on the affected persons. We sought to quickly contact each of the affected individuals to inform them of the circumstances and also offer them assistance prior to the announcement. We worked with the Police and other relevant parties to disable access to the information as quickly as possible.
Basis for Decisions and Actions
34. Mr Speaker Sir, at this point, let me reiterate the basis of our decisions and actions, especially on the issue of disclosure and announcement. At each juncture – May 2016, May 2018 and Jan 2019 – MOH had to decide whether to inform the affected persons and make a public announcement.
35. In making those decisions, MOH had a responsibility to balance the opposing considerations and exercise judgement on what would best serve the interest of the affected persons and the public.
36. MOH made a judgement call, balancing the various considerations. It is arguable that MOH should have made a different call. But I reject any allegation that MOH sought to cover up the incident.
37. On all three occasions, MOH’s primary concern was the wellbeing of the persons on the HIV registry.
38. Today, we still face the same dilemma as we did back in 2016 and 2018. We now know that Brochez retained some of the data after the Police seized all the files they could find in 2016. Quite possibly, he still has more files in his possession.
39. Should MOH now make known all that Brochez may (or may not) still possess? Do we contact every person whose data may (or may not) be at risk? And in the process inflict more harm on people even though it may ultimately turn out that Brochez in fact does not have the information?
40. Again we have to assess and make a judgement call. MOH has decided to continue to manage the situation in a way that reduces the possibility of further exposure. This is consistent with the decision taken in 2016, and again in 2018. It is based on what we believe to be the interest of the potentially affected persons.
ONGOING INCIDENT MANAGEMENT
41. Mr Speaker Sir, let me now turn to what else we are doing following the latest incident.
Police Investigation
42. Brochez is currently under Police investigation for various offences. He is believed to be in the US. The Police are engaging their American counterparts and are seeking their assistance in the investigations against Brochez. The Police will spare no effort pursuing all avenues to bring Brochez to justice.
Monitoring Further Exposure of Information
43. Following our public announcement, a few parties have come forward to inform us that Brochez had in fact attempted to make contact with them in 2018, and had given them links to confidential information he had uploaded online. We have quickly worked with authorities to similarly disable access to the online content. The content that was uploaded is similar to what we had found in January, so no new individuals have been exposed.
44. We have also been working with relevant parties to scan the Internet for indications of further sharing of the information. There have thus far been no signs of further disclosure, but we will continue to monitor.
45. Should we detect any disclosure or online publication of the information, MOH will work with the relevant authorities and parties to take down the content and disable access to the data.
46. Here, I would like to remind everyone that the Police will not hesitate to take stern action, including prosecution, against anyone who possesses, communicates or uses any of the confidential data that has been disclosed. The Police will also not tolerate any harassment or intimidation, of any form, towards any person, arising from the leak. Stern action will be taken against perpetrators.
Informing Affected Individuals
47. MOH has prioritised informing and supporting the affected individuals. We have completed attempts to contact all the affected individuals. But we are unable to reach all of them, as many had dated contact information, given that the Registry went back to 1985. Many of the foreigners were work pass applicants who never worked in Singapore, or who previously worked here but are no longer in Singapore.
48. Amongst the affected Singaporeans diagnosed with HIV and still living, we have reached 2,400 out of 3,500. Individuals who worry that they may be affected or who have concerns, can contact our hotline at 6325 9220. We seek their understanding that to maintain confidentiality of the information, we have to verify the identity of the caller. Officers manning our hotline will then provide information on the incident and direct callers to available avenues of support.
Supporting Those Who Have More Concerns
49. Ms Anthea Ong, A/Prof Theseira and A/Prof Daniel Goh asked about the measures taken to protect the psychological welfare of the affected individuals. We know that the affected persons may have concerns, and may be worried about unfair treatment arising from this incident.
50. Prior to calling patients, our medical social workers have helped to first identify those likely to require more support, so that designated officers can exercise extra care and provide additional support when calling them. If callers request to speak to our counsellors, are in distress, or require more advice and support, counsellors are on standby to speak with them.
51. Some affected individuals may prefer to discuss their concerns with those they are more familiar with, such as the medical social workers, nurses and doctors who have been supporting their ongoing care and treatment. We have arranged with the relevant public hospitals to have medical social workers and doctors on site to attend to them.
52. Agencies such as the Life Insurance Association (LIA), MOM and TAFEP have provided public assurances on common concerns. MOM shared that Singapore has employment laws to protect employees from wrongful dismissals, including on the grounds of HIV. LIA has in turn assured policyholders that insurers that receive information related to this incident will not use such information. They will inform the relevant authorities immediately.
53. Understandably, despite these efforts, some will continue to be concerned. Some may decline to return to care because of the fear of future disclosure. Some felt we should have just informed the affected individuals. A few wished they had not been called at all. The anxiety and concerns which some individuals felt have also been carried in various online, broadcast and print articles in recent weeks.
54. Our medical social workers were themselves distressed by the news they had to break, and felt the anguish that the patients experienced when they were told. They had to conduct the calls carefully and gently and be alert to signs of distress so that they could help the patients appropriately. At times, our medical social workers became the target of anger and blame. Nevertheless, they do their best to support the affected persons.
55. These reactions are not unexpected. They were the reasons we made a judgement call in 2016 not to make a public announcement, and in 2018 to inform only the affected patients.
Safeguards in the Ministry
56. Mr Speaker Sir, Members have asked about the purpose and safeguards of the HIV Registry.
Purpose of HIV Registry
57. MOH’s national HIV Registry contains information of persons diagnosed with HIV in Singapore. We are not unique in having such a registry. Countries such as the United States and Canada also maintain HIV registries containing identifiable information.
58. We need the Registry to monitor the HIV infection situation, conduct contact tracing, and assess disease prevention and management measures. The data needs to be identifiable for purposes such as contact tracing to protect those who are contacts of HIV patients.
Policy and IT Safeguards in Place in 2012/2013
59. The security safeguards for the HIV Registry in 2012-2013 were in accordance with the prevailing government policies on classified information and IT security. Staff were briefed on the policies, systems and processes, and regularly reminded of the sensitivity of the information, which they should access on a need-to-know basis. All of them signed an undertaking to observe confidentiality obligations under the OSA.
60. Prior to 2012, the HIV Registry was placed in a secured network drive. The file could only be accessed and downloaded from Government issued computers, and was password protected. NPHU staff would need to download the HIV Registry in order to carry out routine data entry, contact tracing, and analysis. Staff were allowed to use personal thumb drives at that time, subject to adherence to data protection guidelines and policies.
61. As the Head of NPHU, Ler had authority to access information in the HIV Registry as required for his work. He is believed to have downloaded the HIV Registry into a thumb drive, and failed to retain possession of it. Ler has been charged for mishandling the information.
62. Mr Seah Kian Peng asked about the additional measures undertaken to ensure data security.
63. In 2012, prior to the complaint from Brochez, the Registry database was migrated to a network-based system. NPHU staff no longer had to download a database file stored on a network drive to do their work. Instead, staff would call up records they require from the network-based system. With the implementation of a network-based Registry, the audit trail was also enhanced. In 2014, alerts of multiple failed login attempts were incorporated into the system.
64. MOH continues to follow the security policies from the Singapore Government Instruction Manual for Security of Classified Info. In tandem with the Government guidelines, we implemented several controls to tighten our systems.
65. Specifically for the NPHU, MOH’s Chief Data Officer also conducted a data security review in 2016. Following the review, enhancements were made to further strengthen the NPHU systems. These include:
· Elevating the approval authority for downloading and decrypting Registry data to the level of the Director of our Communicable Diseases Division or higher.
· Implementing a two-person approval process to download and decrypt Registry data, to ensure that data could not be accessed by a single person.
· Designating a specific workstation for processing of sensitive data from the HIV Registry. This workstation is configured and locked down to prevent unauthorised removal of data.
66. In 2017, the NPHU also complied with government-wide policy to disable the use of unauthorised portable storage devices on official computers, and only allow use of authorised and encrypted thumb drives.
What Else Going Forward
67. To give greater attention to data usage and safeguards, we had also set up a Data Analytics Group in April 2018. Within the group, a Data Governance Division was set up to formulate policies, practices and guidelines for MOH and its agencies. The aim is to protect and secure access to health sector data, in accordance with data protection requirements in the Government Instruction Manuals and PDPA, and other MOH sectoral legislation.
68. In light of the recent incident, and the increased prevalence of data use across the healthcare sector, it is important to ensure that data security and governance policies are strictly adhered to on the ground. MOH will expand the role and resourcing of this unit. We will include within it a specific mandate and team to look into compliance and audits of data access and use.
Call for De-stigmatisation of HIV
69. Several members have called for de-stigmatisation of HIV, and asked how we can protect people living with HIV from discrimination. Stigmatisation is an issue that all of us are concerned with.
70. De-stigmatisation requires efforts across our society. Let me cite some of the efforts by MOH, together with the government and non-government agencies, advocacy groups and voluntary welfare organisations.
Access and Support for Treatment
71. Persons living with HIV require lifelong treatment. HIV therefore continues to be a serious infectious disease that the MOH closely monitors and actively manages for public health reasons. But clinically, HIV treatment has vastly improved over the years, and early treatment can delay disease progression and improve quality of life.
72. Over the years, MOH has increased financial support and lowered the financial barriers for HIV treatment, through MediSave and MediFund. Since 2014, HIV anti-retroviral drugs can be supported under the Medication Assistance Fund. MAF provides means-tested subsidies for lower and middle income patients (i.e. two-thirds of Singaporean patients), covering up to 75% of the cost of anti-retroviral treatment1.
73. In 2015, with the introduction of MediShield Life, persons living with HIV are now covered by our national health insurance scheme should they be hospitalised.
Testing and Counselling
74. We have also made HIV testing and counselling services more widely available. For example, anonymous HIV testing is now available at 10 sites across the island. Special outreach efforts have also been made for specific groups. For instance, it is part of standard antenatal testing at our public hospitals.
75. Support from doctors, medical social workers and healthcare workers is also widely available in the public hospitals. Generally, every HIV patient in public healthcare institutions is assigned to a medical social worker to provide assistance upon their diagnosis.
Educating the Public and Reducing Stigma
76. It is easy to stigmatise something that we do not understand. MOH has therefore been working with stakeholders to raise awareness of the disease and reduce stigma. In 2017, SNEF, TTSH and HPB worked together to introduce “Guidelines on Managing HIV and AIDS in the Workplace” to help companies create enabling workplace environments for employees with HIV. More recently, the Tripartite Guidelines on Fair Employment Practices calls for all employers to treat employees fairly and based on merit. This would include employees with HIV.
Seeking cooperation
77. MOH will continue to work with partner organisations to step up efforts in public education, stigma reduction, prevention, testing, treatment and counselling support. But beyond this, how each of us as individuals relate to persons with HIV also matters, a lot.
78. Here, I would like to appeal to Singaporeans to stand in support of these affected individuals, and our efforts to fight the stigma against persons living with HIV. I would like to urge the public and media not to share illegally obtained information and inform Police/MOH immediately.
79. The welfare of the affected individuals in this incident would be something of deep concern for us. We would like to encourage those with concerns to contact us at our hotline at 6325 9220. You may also call the SOS2, TAFEP and AfA, or approach the healthcare institutions and professionals that have been providing you care and support.
CONCLUSION
80. Mr Speaker Sir, this has been a regrettable incident caused by the irresponsible and deplorable actions of two individuals.
81. Ler is a Singaporean doctor and ex-MOH officer who had been entrusted with the care of our patients, but he had betrayed the trust of the ministry and the medical profession. I am sorry that the irresponsible actions of one of our officers has resulted in such distress to the affected persons. Ler’s case is now before the Courts, and he will be dealt with according to the law.
82. The other – Brochez – is an American citizen who had left a trail of lies and deceit, and now perpetrated a reprehensible act that has affected thousands of persons with HIV. He had already spent time behind bars here for his earlier offences. We will spare no effort in bringing him to justice again for his latest crime.
83. As individuals and part of the larger Singaporean community, the best way for us to respond to this incident is with sensitivity, understanding and support for those affected. If we can say no to discrimination and reduce the stigma surrounding HIV, we can turn the harm and discord which the perpetrators seek to sow into a more inclusive and supportive environment for persons living with HIV.
[1] The starting cost of first-line ARV treatment ranges from about $200 to $300 per month.
[2] SOS 24-hour hotline: 1800 221 4444; TAFEP: 6838 0969; AfA: 6254 0212