HSA sets up panel to review handling of sensitive data
Singapore
THE Health Sciences Authority (HSA) has set up a board committee to review its current policies and processes for managing sensitive data, and recommend appropriate measures. This comes on the heels of a data breach involving the personal information of more than 800,000 blood donors, said Senior Minister of State for Health Edwin Tong on Monday.
The Ministry of Health (MOH) and its agencies will also review the lifecycle management of the data being handled by its existing information technology (IT) vendors.
"The measures to be taken to prevent a similar occurrence will be shaped by what specific findings arise from the ongoing investigations into the incident," he added, in response to questions from Members of Parliament on the additional steps that MOH and HSA can take to reduce the risk of data mismanagement.
The breached information had been uploaded to a server in October last year without appropriate safeguards by HSA's vendor, Secur Solutions Group, which was appointed to maintain and enhance the queue management system for blood donors.
Initially, it was thought that the data had been accessed only by a US cybersecurity expert who spotted the vulnerability in the server in March.
But subsequent forensic analysis showed that the server was also accessed suspiciously from several other IP addresses between October 2018 and March this year, Secur Solutions Group said last Saturday.
Mr Tong said investigations are continuing, and a further update will be provided when available.
The HSA's board committee is being chaired by Mr Max Loh, chairman of HSA board's audit and risk committee and includes members from the Government Technology Organisation (GovTech).
MOH and its agencies will cooperate fully with the public sector data security review committee, Mr Tong added. The committee was formed by Prime Minister Lee Hsien Loong to conduct a comprehensive review of data security practices across the entire public service. This was announced on Sunday.
In response to questions about the cybersecurity expert who spotted the HSA vulnerability, Mr Tong said the expert works for a company that specialises in identifying and reporting vulnerabilities of IT systems and was not employed or engaged by HSA or MOH.
The expert informed HSA on March 16 that he had deleted his copy of the data and has no intention of disclosing its contents. He did not seek any compensation, either.
"We will not be taking any legal action against him because he had reported the vulnerability to us straight away, and had no intention to keep, use or expose the contents of the database, and has not done so," said Mr Tong.
Non-Constituency MP Dennis Tan wanted to know why the data was placed on a server accessible through the Internet; how the cyber security expert gained access to the data and whether his conduct was in breach of any law.
Mr Tong replied that these matters are covered by the ongoing investigations and information will be provided when it is verified.
Minister for Communications and Information S Iswaran said the Personal Data Protection Commission (PDPC) is investigating Secur Solutions Group.
If found to be in breach of the Personal Data Protection Act (PDPA), the commission will take the appropriate enforcement actions against the company, such as issuing directions and imposing financial penalties.
As HSA is a government agency, the Smart Nation and Digital Government Group is also conducting an investigation into the incident, he added.
