SINGAPORE, Nov 3 — The nine-and-a-half hour disruption to public healthcare services on October 13 affected about 4,000 outpatient appointments, said Senior Minister of State for Health Tan Kiat How in Parliament on Tuesday (November 3).

He was responding to questions filed by MPs Yip Hon Weng (Yio Chu Kang SMC), Poh Li Sam (Sembawang West SMC), Joan Pereira (Tanjong Pagar GRC) and Cassandra Lee (Tampines GRC).

They had asked questions ranging from the disruption’s cause, to its impact, and operational resilience plans.

The senior minister of state acknowledged that the disruption caused inconvenience and concern to patients and their families, and created additional work for the country’s healthcare workers. 

“We apologise. It should not have happened,” Tan said.

Investigation findings

He reiterated Synapxe’s statement on October 13 that the incident was not a cyberattack and that there was no unauthorised access to, compromise, or loss of patient data. 

The incident, he said, was caused by a required security update to a shared domain name system or Domain Name System (DNS) service that was not completed before a scheduled global change.

DNS is akin to the phonebook of the Internet, helping systems locate and connect to applications.

But the incident was avoidable, Tan acknowledged. 

“This was a known change and a preventable lapse. Synapxe had contracted a service provider to manage the necessary update, but it was not carried out,” he explained.

The national health technology agency is now reviewing the service provider’s contractual obligations and will take “appropriate action” for any established lapses, Tan said.

The senior minister of state also highlighted that Synapxe remains accountable for the resilience of its critical systems regardless of outsourcing.

He noted that while monitoring had picked up abnormal activity, further time was taken to identify the underlying problem and restore services safely.

To this, he said that Synpaxe is now strengthening monitoring and fault diagnosis to enable faster recovery.

It will also look into shared dependencies and alternative recovery arrangements.

In this instance, while the systems had backup infrastructure, including two data centres, both depended on the same underlying DNS service and security configuration.

This means that switching between the data centres would not have resolved the disruption.

Synapxe will therefore review such shared dependencies and strengthen alternative recovery arrangements, Tan added

The October 13 disruption affected services such as appointment bookings, visitor registration, medication dispensing and billing.

Healthcare institutions had to activate downtime procedures with additional staff supporting operations, and clinicians used selected read-only patient records and manual workflows to continue essential care.

The incident did not result in any known patient safety incidents. 

Meanwhile, the Ministry of  Health will oversee and verify corrective actions, Tan said.

He added that an expert panel comprising representatives from other organisations that have similar engineering profiles has also been appointed to review the investigation findings and proposed remediation measures and identify further improvements.

“Digitalisation brings important benefits to healthcare, but as our systems become more interconnected, resilience must improve too. 

“We must make our technology more reliable while ensuring healthcare workers can continue caring for patients safely, even when technology fails,” Tan said. — AsiaOne