National Cancer Centre e-mail lapse allegedly exposes patients’ details including names, workplaces

SINGAPORE – An event invitation sent by the National Cancer Centre Singapore (NCCS) has sparked privacy concerns after a mailing list exposed the identities, contact details and, in some instances, workplaces of individuals with a genetic cancer condition.

The e-mail, an invitation to a Living with HBOC event – referring to hereditary breast and ovarian cancer syndrome which can affect both genders – was sent on Sept 18 to the NCCS’ list of individuals associated with the hereditary condition, according to screenshots shared with The Straits Times.

However, instead of using the BCC (blind carbon copy) function, which keeps the list of recipients hidden, the e-mail CC’d recipients.

Those who received the e-mail could thus view the names, e-mail addresses and workplaces of others with the genetic condition, if they had used their workplace email address.

In a subsequent e-mail from NCCS, seen by ST, recipients were requested to delete the earlier e-mail with addresses visible from their inboxes and trash folders.

They were also asked not to further circulate it and also to refrain from using or saving any e-mail addresses listed.

“Please be assured that this was an administrative error that affected e-mail addresses only. We are thoroughly reviewing our internal processes to ensure that this does not happen again,” the e-mail said.

ST has contacted NCCS for more information.

Sent at 7.53pm, the original e-mail invited recipients and their loved ones to the NCCS event scheduled for Oct 31.

Checks by ST of the NCCS’ website show that it is an invite-only event from 10am to 12.30pm and is for people living with HBOC and their relatives. It will feature an “informative session” and “interactive workshops”.

Various e-mail addresses are visible in the screenshots. The sender appears to be a member of the NCCS’ Cancer Genetics Service, which provides genetic counselling to individuals with a history of cancer.

One recipient, who spoke to ST on the condition of anonymity, said the number of e-mail addresses visible was “too numerous to count”.

They estimated there could be more than 500.

They said e-mail domains identified the companies, foreign embassies and schools of those on the NCCS’ HBOC list. In the e-mail thread, they also saw a list of NCCS doctors, including their own.

“This effectively discloses each person’s association with hereditary cancer screening or counselling to a group of strangers,” they said.

“It ties identifiable people directly to a health condition, which is a more sensitive category of personal data than a typical CC mishap.”

The recipient expressed worries that people they have never met will now know about their genetic condition.

“I don’t know who they are, whether they will pass this info to someone else, or whether it will come back to affect me at work or with insurance one day,” they said.

Adding that their children have a 50 per cent chance of inheriting the genetic mutation and will need to be tested once they turn 21, they fear their kids’ future employment and insurance prospects could be affected as well.

According to them, the NCCS attempted to recall the e-mail 2 ½ hours after it was sent.

They said they had since informed the agency’s Quality Service Manager and asked for a follow-up.

HBOC is an inherited genetic condition most commonly caused by mutations in the BRCA1 or BRCA2 genes. These genes make proteins to repair damaged DNA and protect against tumour growth.

The harmful inherited mutations significantly increase a person’s lifetime risk of developing breast and ovarian cancers, as well as prostate, pancreatic, and skin cancers.

ST has also contacted SingHealth and the Personal Data Protection Commission for more details.