CORRESPONDENCE

Response to letter regarding 'Cyberattack on the National Health Laboratory Service of South Africa - implications, response and recommendations'

To the Editor: We thank Thaldar and Preiser for their letter in response to our article.^[1] We welcome the opportunity to clarify the following aspects of the article.

1. The National Health Laboratory Service (NHLS) did indeed secure an exemption from the Information Regulator, in view of the fact that aspects of the Protection of Personal Information Act 4 of 2013 (POPIA)^[2] had to be violated in pursuit of public benefit. That public benefit, in this case, included preservation of life and limb. However, as we did not know exactly when the exemption was granted, we believe that our wording is measured and fair to the NHLS. Furthermore, the well-intentioned use of sensu stricto illegal channels of private data communication by NHLS rank and file cannot be scientifically excluded, especially in the early part of the cyberattack.

2. The 'national and legal policies'^[1] we propose as future requirements do not relate to POPIA. They relate to all other legal aspects that are involved in the prevention of and response to future cyberattacks and other threats, which we regard as inevitable.

All other omissions regarding the details of the response are due to the concision that must be applied in writing articles of this nature. It remains our sincere hope that the recommendations we made will help formulate preparedness policies, strategies and tactics pertaining to future NHLS operational threats.

S Cassim, Z C Chapanduka

Division of Haematology, Department of Pathology, Faculty of Medicine and Health Sciences, Stellenbosch University and National Health Laboratory Service, Tygerberg Hospital, Cape Town, South Africa

sumaiya@sun.ac.za

References

1. Cassim S, Chapanduka ZC. Cyberattack on the National Health Laboratory Service of South Africa - implications, response and recommendations. S Afr Med J 2024;114(12):e2549. https://doi.org/10.7196/SAMJ.2024.v114i12.2549        [ Links ]

2. Protection of Personal Information Act 4 of 2013. https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf (accessed 27 February 2025).         [ Links ]