'We apologise': Tan Kiat How says public healthcare services disruption on Oct 13 should not have happened

The nine-and-a-half hour disruption to public healthcare services on Oct 13 affected about 4,000 outpatient appointments, said Senior Minister of State for Health Tan Kiat How in Parliament on Tuesday (Nov 3).

He was responding to questions filed by MPs Yip Hon Weng (Yio Chu Kang SMC), Poh Li Sam (Sembawang West SMC), Joan Pereira (Tanjong Pagar GRC) and Cassandra Lee (Tampines GRC).

They had asked questions ranging from the disruption's cause, to its impact, and operational resilience plans.

The senior minister of state acknowledged that the disruption caused inconvenience and concern to patients and their families, and created additional work for the country's healthcare workers.

"We apologise. It should not have happened," Tan said.

Investigation findings

He reiterated Synapxe's statement on Oct 13 that the incident was not a cyberattack and that there was no unauthorised access to, compromise, or loss of patient data.

The incident, he said, was caused by a required security update to a shared domain name system or Domain Name System (DNS) service that was not completed before a scheduled global change.

DNS is akin to the phonebook of the Internet, helping systems locate and connect to applications.

But the incident was avoidable, Tan acknowledged.

"This was a known change and a preventable lapse. Synapxe had contracted a service provider to manage the necessary update, but it was not carried out," he explained.

The national health technology agency is now reviewing the service provider's contractual obligations and will take "appropriate action" for any established lapses, Tan said.

The senior minister of state also highlighted that Synapxe remains accountable for the resilience of its critical systems regardless of outsourcing.

He noted that while monitoring had picked up abnormal activity, further time was taken to identify the underlying problem and restore services safely.

To this, he said that Synpaxe is now strengthening monitoring and fault diagnosis to enable faster recovery.

It will also look into shared dependencies and alternative recovery arrangements.

In this instance, while the systems had backup infrastructure, including two data centres, both depended on the same underlying DNS service and security configuration.

This means that switching between the data centres would not have resolved the disruption.

Synapxe will therefore review such shared dependencies and strengthen alternative recovery arrangements, Tan added

The Oct 13 disruption affected services such as appointment bookings, visitor registration, medication dispensing and billing.

Healthcare institutions had to activate downtime procedures with additional staff supporting operations, and clinicians used selected read-only patient records and manual workflows to continue essential care.

The incident did not result in any known patient safety incidents.

Meanwhile, the Ministry of Health will oversee and verify corrective actions, Tan said.

He added that an expert panel comprising representatives from other organisations that have similar engineering profiles has also been appointed to review the investigation findings and proposed remediation measures and identify further improvements.

"Digitalisation brings important benefits to healthcare, but as our systems become more interconnected, resilience must improve too.

"We must make our technology more reliable while ensuring healthcare workers can continue caring for patients safely, even when technology fails," Tan said.

卫生部高级政务部长陈杰豪周二（11月3日）在国会表示，10月13日公共医疗服务中断9个半小时，影响了约4000个门诊预约。

他是在回应议员叶汉荣（义顺单选区）、傅丽珊（三巴旺西单选区）、琼·佩雷拉（丹戎巴葛集选区）和卡桑德拉·李（淡滨尼集选区）提出的问题。

他们提出的问题涵盖了从中断的原因到中断的影响，以及运营恢复计划等各个方面。

这位高级国务部长承认，此次中断给患者及其家属带来了不便和担忧，也给该国的医护人员增加了额外的工作量。

“我们深表歉意。这本不应该发生。”谭说道。

调查结果

他重申了 Synapxe 于 10 月 13 日发表的声明，即该事件并非网络攻击，也没有未经授权访问、泄露或丢失患者数据。

他说，此次事件是由于共享域名系统或域名系统 (DNS) 服务所需的安全更新在计划的全局更改之前未完成而导致的。

DNS 就像互联网的电话簿，帮助系统定位和连接应用程序。

但谭承认，这起事件是可以避免的。

“这是一个已知的变更，也是一个可以避免的疏忽。Synapxe公司已经与服务提供商签订合同，负责管理必要的更新，但更新并没有执行，”他解释说。

谭表示，国家卫生技术机构目前正在审查服务提供商的合同义务，并将对任何已查明的违约行为采取“适当行动”。

这位高级国务部长还强调，无论是否外包，Synapxe 仍对其关键系统的韧性负责。

他指出，虽然监测发现了异常活动，但仍需更多时间来确定根本问题并安全地恢复服务。

对此，他表示，Synpaxe 目前正在加强监控和故障诊断，以实现更快的恢复。

它还将研究共同依赖关系和替代恢复方案。

在这种情况下，虽然系统拥有备份基础设施（包括两个数据中心），但两者都依赖于相同的底层 DNS 服务和安全配置。

这意味着在数据中心之间切换并不能解决中断问题。

因此，Synapxe将审查此类共同依赖关系，并加强替代恢复安排，Tan补充道。

10 月 13 日的故障影响了预约、访客登记、药品配发和账单等服务。

医疗机构不得不启动停机维护程序，并增派人员支持运营，临床医生使用选定的只读病人记录和手动工作流程来继续提供必要的护理。

该事件未导致任何已知的患者安全事故。

谭表示，与此同时，卫生部将监督和核实整改措施。

他还补充说，已任命一个由其他具有类似工程背景的组织的代表组成的专家小组，负责审查调查结果和提出的补救措施，并确定进一步的改进措施。

“数字化为医疗保健带来了重要的好处，但随着我们的系统变得越来越相互关联，韧性也必须得到提高。”

“我们必须提高技术的可靠性，同时确保医护人员即使在技术出现故障时也能继续安全地照顾病人，”谭说道。