SINGAPORE: The recent spate of cybersecurity breaches hitting the healthcare sector has not affected patient care operations, safety or care, said the Ministry of Health (MOH).
There has also been no unauthorised access of patient health records, the ministry added in a statement on Thursday (Nov 12).
On the same day, the Agency for Integrated Care (AIC) was the latest healthcare-related organisation to report a cybersecurity incident affecting one of its systems.
It said in a statement that on Nov 10, it detected that its Advance Care Planning (ACP) information technology system had been accessed by an unauthorised third party.
Data such as names, contact numbers, e-mail addresses and NRIC numbers of up to 4,064 staff of public healthcare institutions and community care providers may have been accessed as a result.
To date, there are no indications that medical records or patient data have been compromised, AIC said, adding that no other systems have been affected.
The Advance Care Planning IT system is used by facilitators to help members of the public document their ACPs, said AIC, which coordinates and supports the delivery of aged care services.
These facilitators are people who are certified to conduct ACP discussions and guide users with making decisions on their future care preferences, said AIC.
The agency said that investigations are ongoing.
A police report was lodged on Nov 10, AIC said, adding that the incident was also reported to the Cyber Security Agency of Singapore.
The ACP IT System was taken offline on the same day while investigations were conducted as a precaution, AIC said, adding that it was restored on Nov 12.
During that period, ACP facilitators were advised to continue ACP documentation using physical forms, AIC said.
The agency said: “AIC is continuing to investigate the incident, and will carry out a thorough review of its systems and work with CSA to take immediate mitigating actions to strengthen its cyberdefence.”
In its Nov 12 statement, MOH said it has asked national healthtech agency Synapxe and public healthcare institutions to stay vigilant and increase the monitoring for potential cyberthreats across public healthcare IT systems.
It said: “Private healthcare providers should likewise review and strengthen their cybersecurity measures to protect their systems and health information against potential cyberthreats.”
AIC said in its Nov 12 statement that it will contact those who might have been affected within the next three days.
Those who have been affected are advised to exercise caution should they receive suspicious and unsolicited e-mails, messages and calls.
People should also avoid sharing personal information, passwords or one-time passwords with strangers.
Additionally, those who suspect they have might have their personal information breached can contact AIC on 1800-650-6060 or e-mail enquiries@aic.sg
There has been a string of cybersecurity incidents involving unauthorised access to systems used by healthcare and healthcare-related entities in recent weeks.
Apart from the cyberbreach involving AIC, the systems of Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group and Dementia Singapore’s CARA mobile app were also targeted by unauthorised third parties.
“These incidents underscore the importance of being vigilant and despite the best of efforts, every IT system is vulnerable to the most determined attack,” MOH said on Nov 12.
“With the advancement of technology, especially AI, vulnerabilities will be easily exposed and cyberattacks more frequent, rapid and formidable.”
In its statement, MOH urged all licensed healthcare institutions and Healthcare Information Management System providers to remain vigilant, strengthen their cybersecurity posture, and ensure the security and integrity of their IT assets, systems, and patient data.
The Straits Times has contacted the Personal Data Protection Commission and CSA for comment. - The Straits Times/ANN
