Ministry of Law Sharing of data of confidential HIV patients
The Ministry of Health reported that 14,200 records of HIV patents were stolen from their database. This occurred a few years ago, but they decided to inform the public now.

These are sensitive and confidential records. If the information goes into the public domain, it can cause a lot of harm to the patients. 

What can we do about it?

I like to give my view on this matter:

a) The data was stolen from the database by a senior doctor who was part of the Ministry of Health and has access to the system. It was not stolen by a hacker from outside.

b) While we can strengthen the controls from access by intruders, it is difficult to monitor the work of trusted staff. These staff need to have access to the patient records in the course of their work.

Recognizing the difficulty of preventing the leakage of the data, we should focus on dealing with the effect of the crime. 

We should pass a law to make it illegal for any person to post or share information that they know to be stolen and are harmful to other people. They should face the consequence of the harm that occur due to their willful acts.

What does this mean?

a) If someone does not know that it is stolen and harmful, they should not be punished. However, if they are told that the  data was stolen, they should remove the post and stop the sharing of the information. They should also provide information to the authority to minimize the damage that was done.

b) If they post and share the stolen data willfully, they should be charged for the crime and face the consequence that is proportional to the harm that is done.

c)  If the act was done in another country, our authority should get the assistance of the authority in the other country to deal with this crime that is committed in Singapore. It is similar to asking for extradition of criminals that seek refuge in another country.

Let me share this analogy. We know that it is bad for a person to kill another person. It is a crime called "murder". 

Can we prevent murder from being committed. We can't. What do we do? We have follow up action to locate the criminal and bring him (or her) to face the consequence of the law. 

I am suggesting a similar approach in dealing with stolen data that can cause harm to the affected person. 

I know that we will continue to strengthen the controls and safeguards to prevent this kind of criminal activity from being committed in the first place. 

But we should not forget about appropriate measures to deal with the crime after it has been committed. 

Tan Kin Lian



 

Add Comment

---