Data breaches: Patient care not compromised, says MOH; AIC latest to report cybersecurity incident

The recent spate of cybersecurity breaches hitting the healthcare sector has not disrupted patient care operations, or compromised safety or care, said the Ministry of Health (MOH).

There has also been no unauthorised access of patient health records, the ministry added in a statement on Nov 12.

On the same day, the Agency for Integrated Care (AIC) was the latest healthcare-related organisation to report a cybersecurity incident affecting the Advance Care Planning (ACP) information technology system.

AIC said in a statement that on Nov 10, it detected that the system had been accessed by an unauthorised third party.

Data such as names, contact numbers, e-mail addresses and NRIC numbers of up to 4,064 staff of public healthcare institutions and community care providers may have been accessed as a result.

To date, there are no indications that medical records or patient data have been compromised, AIC said, adding that no other systems have been affected.

The IT system affected is used by facilitators to help members of the public document their advance care planning, said AIC, which coordinates and supports the delivery of aged care services.

These facilitators are people who are certified to conduct advance care planning discussions and guide users with making decisions on their future care preferences, said AIC.

The ACP IT system was taken offline on the day the breach was discovered, while investigations were conducted as a precaution, AIC said, adding that the system was restored on Nov 12. During the down time, ACP facilitators were advised to continue advance care planning documentation using physical forms, AIC added.

The agency said it made a police report on Nov 10, and the incident was also reported to the Cyber Security Agency of Singapore (CSA).

“AIC is continuing to investigate the incident, and will carry out a thorough review of its systems and work with CSA to take immediate mitigating actions to strengthen its cyberdefence,” said AIC.

In a media reply on Nov 12, a spokesperson for the Personal Data Protection Commission (PDPC) said it is aware of the incident and is contacting AIC for more information.

There has been a string of cybersecurity incidents reported of late, including on systems used by healthcare and healthcare-related entities in Singapore.

Apart from the cyberbreach involving AIC, the systems of Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group and Dementia Singapore’s CARA mobile app were also targeted by unauthorised third parties.

In its statement, MOH said it is taking these incidents “very seriously” and is following up with the affected entities to check on the full implications of these incidents.

The ministry added that the entities are also working closely with their cybersecurity consultants and the relevant authorities, including CSA and PDPC, to follow up on the incidents.

MOH said it has asked national healthtech agency Synapxe and public healthcare institutions to stay vigilant and to increase monitoring for potential cyberthreats across public healthcare IT systems.

It also urged private healthcare providers to review and strengthen their cybersecurity measures to protect their systems and health information against potential cyberthreats.

MOH urged all licensed healthcare institutions and Healthcare Information Management System providers to remain vigilant, strengthen their cybersecurity posture, and ensure the security and integrity of their IT assets, systems and patient data.

In response to queries, a spokesperson for CSA said on Nov 12 that it is monitoring the situation and working closely with MOH and PDPC on the recent healthcare incidents.

It advised organisations to implement measures to protect their systems against data breaches, and urged members of the public to remain vigilant to potential phishing attempts and scams.

The Health Ministry said of the breaches: “These incidents underscore the importance of being vigilant, and despite the best of efforts, every IT system is vulnerable to the most determined attack.

“With the advancement of technology, especially AI, vulnerabilities will be easily exposed and cyberattacks more frequent, rapid and formidable.”

AIC said in its Nov 12 statement that it will contact those who might have been affected within the next three days.

Those who have been affected are advised to exercise caution if they receive suspicious and unsolicited e-mails, messages and calls.

People should also avoid sharing personal information, passwords or one-time passwords with strangers.

Additionally, those who suspect they might have had their personal information breached can contact AIC on 1800-650-6060 or e-mail [email protected]

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

ADV: ECC-SAL International Mooting Competition 2027 Why data breaches are surging in Singapore, and why firms owe victims more than an apology