NMRA SHOVED UNDER ’CLOUD’ OF GLOOM

Intentionally or unintentionally losing vital data relating to the registration of drugs during a pandemic cannot be passed as a minor mistake. But that’s exactly what the National Medicines Regulatory Authority (NMRA) is experiencing at present. Days after the revelation of missing data on NMRA’s digital storage, handled by Epic Lanka Technologies (ELT) under the consultation of the Information and Communication Technology Agency (ICTA), the Criminal Investigation Department (CID) has launched a forensic investigation with the assistance of the Moratuwa University. Even though relevant parties claim that the matter will not cause an impact on the availability of drugs or that data won’t be missing forever, medical experts and unions have raised great concerns regading the matter.

No impact on availability of drugs – NMRA Chairman 
“Since 2018 we decided to have an online database and the tender was handed over to Epic Lanka Technologies,” said NMRA Chairman Dr. Rasitha Wijewantha. “From October 2019 the system has been running,  but on July 31 st we were notified of a missing file. For sometime we had a hybrid registration process where we operated both manually and digitally. While local medicines are registered manually we registered important drugs and devices digitally. This particular system includes all evaluation documents and according to ELT they are unable to locate the file. No damage has been done to the file or data. Thereafter a complaint was lodged at the Criminal Investigation Department and a forensic investigation is now underway with the assistance of the Moratuwa University. Right now nobody can enter the system. The recovery process is underway. On the other hand the system is monitored by the ICTA and there have been no backups in the government cloud. But according to the agreement there has to be a backup.” said Dr. Wijewantha. 

This particular system includes all evaluation documents and according to ELT they are unable to locate the file. No damage has been done to the file or data. Thereafter a complaint was lodged at the Criminal Investigation Department and a forensic investigation is now underway with the assistance of the Moratuwa University

Dr. Rasitha Wijewantha
(NMRA Chairman)

When asked about granting blanket renewal for medicines Dr. Wijewantha said that no medicines or devices have been given blanket renewal. Approvals can be extended for drugs that have been registered so far; especially COVID-related drugs and devices, drugs by local manufacturers and so on. There will be a delay in registering new drugs, but this will not lead to a scarcity of drugs or devices in the market.”

Medical unions also claimed that the password to the system has been given to four persons. While denying these claims Dr. Wijewantha said that certain parties are trying to politicise the matter. “The NMRA has access to the system and because ELT is doing maintenance they also need to have access to the system. So they may have given the password to one or more people. Some even claimed that there are blacklisted drugs which are being approved etc. We only have drugs and devices that have been evaluated. These are baseless allegations,” said Dr.Wijewantha. 

If I was there I would have called for an independent overseas IT investigation team to be employed for a transparent investigation to protect the credibility of NMRA. The NMRA has the funds to do this and it’s worth an exercise to keep the credibility of the NMRA

Dr. Lakkumar Fernando
(President Association of Medical Specialists and former NMRA board member)

A serious matter that needs independent probing – Ex-NMRA board member 

In his comments Association of Medical Specialists President and former NMRA board member Dr. Lakkumar Fernando said that it is a serious matter and needs independent probing. “Ideally it has to be done independently through multiple sources. If I was there I would have called for an independent overseas IT investigation team to be employed for a transparent investigation to protect the credibility of NMRA. The NMRA has the funds to do this and it’s worth an exercise to keep the credibility of the NMRA.” said Dr. Fernando.

 A possible data scam?
“The NMRA is the apex body that oversees the health security of this country, but it has been having a monopoly for sometime,” claimed Association of Medical Laboratory Technologists President Ravi Kumudesh. “The technical committee evaluations have not been transparent. There are 48 companies that were willing to import Rapid Antigen Kits, but that was prevented and only one company was allowed to import them. According to the NMRA mandate they can import drugs and check for approvals later on. But the drug registration process has been vague. This was clear when they granted approval for the distribution of Sinopharm vaccines. One has to question why they have only allowed one company to import RATs and haven’t given sample licenses to other companies.
“Once the NMRA started storing data digitally it was done in consultation with the ICTA. But with regards to the missing data we do not know if someone at the NMRA deliberately deleted data or whether an external party was involved. If it was deliberately removed then one of the people who had the password should be responsible. The deletion of this particular data is a threat to national security as well. But why isn’t the government or the Health Ministry keen on expediting investigations?” he questioned. 

He further said that it is irresponsible on the part of ICTA for issuing a contract in an ad hoc manner. “If they are outsourcing the cloud to a third party that means they too haven’t done their task properly. There is sensitive information that is stored on this cloud and mega pharmaceutical companies don’t like disclosing their formulae etc. So like the bond scam this looks like a data scam.” he opined. 

Once the NMRA started storing data digitally it was done in consultation with the ICTA. But with regards to the missing data we do not know if someone at the NMRA deliberately deleted data or whether an external party was involved”

Ravi Kumudesh 
President Association of Medical
Laboratory Technologists 

Responding to NMRA’s denial of a scarcity of drugs Kumudesh said that when the registration process gets delayed automatically it would lead to a scarcity. “This will not happen immediately, but eventually. There needs to be a health communication beyond COVID because it is not the only health issue in this country. Since people cannot visit clinics those with severe illnesses are depended on drugs. In the event of a scarcity of drugs it would lead to a devastating situation in future,” warned Kumudesh. 

A human error 
However, ELT has another side to the story. “We received the contract in April 2018 and we were awarded the tender to provide services on document management and workflow systems,” said Epic Technology Group Executive Chairman Dr. Nayana Dehigama. “So we developed the application according to the tender requirements. It’s a competitive tender and the consultant is ICTA. We then did a Software Requirement Specification and then all three parties including Epic, NMRA and ICTA signed it. Once we developed the SRS we implemented it live and the NMRA ran a User Acceptance Test (UAT) thereafter. The UAT was successful and the NMRA officials including the CEO and Chairman said that it complies with the SRS.” “Thereafter we did day-to-day maintenance work such as updates and upgrades. The system ran live for 18 months and there were no complaints. Then there was a contractual obligation to host this system on the Lanka Government Cloud. This cloud has been setup by the ICTA and when they are doing maintenance work we too have to do our maintenance work. So our engineers enter the system regularly. But by end of July the system had a feature where an issue was escalated to us saying that certain attachments to process certain applications cannot be accessed. Thereafter we found that certain supporting documents needed for the approval of drugs were stored outside the main database. But it is still in the cloud. This particular folder contains certain PDF and JPG attachments was missing,” he continued.

“It was later found that one of our maintenance engineers have executed a wrong command by mistake and it has deleted this particular folder. So we accepted our mistake. These are Linux commands and for them to be activated, especially when deleting a file folder would take 4-5 hours. So all the data, approvals, submissions and renewals are there except these supporting documents. Therefore certain applications cannot be processed. The easiest thing would have been to resubmit attachments. Even when doing manual submissions resubmissions have been happening regularly. But since this is our mistake we have given them options.

It was later found that one of our maintenance engineers have executed a wrong command by mistake and it has deleted this particular folder. So we accepted our mistake. These are Linux commands and for them to be activated, especially when deleting a file folder would take 4-5 hours

 Dr. Nayana Dehigama
Executive Chairman Epic Technology Group

“We have recovered part of the file, but we need to do a forensic level recovery process. Therefore I instructed my team to lodge a complaint with the CID to exclude the fact that there’s no external interference in this matter. We are ready to start recoveries on August 5, but then on that day the CID has obtained a court order to conduct an investigation. So until their preliminary investigations are completed they have given us instructions to refrain from accessing the system.” said Dr. Dehigama.

Dr. Dehigama further pointed out that there’s no disaster recovery process in the system. “This company has existed for the past 23 years and this is the first time such an incident took place. Human errors can happen and unfortunately the makings of the system doesn’t support a recovery process. There are departments that have invested in a disaster recovery process such as by keeping offline backups. If a disaster recovery system was in place recovery would have been an hours job. But the tender requirements didn’t have that feature involved. We have in fact recovered all files, but the structures are missing. We accept that it’s a mistake on our part and we are ready to go to any extent to support our customer, added Dr. Dehigama. 

When asked why there were no backups Dr. Dehigama explained that the systema has a backup. “The main database has a backup, but a backup creates a mirror image of what you’re doing. In your computer if you store data in the hard disk and you delete something there, the backup will also do the same thing. But if there’s a system failure etc., this won’t take place. But when you do a deletion through a command, the system thinks it’s genuine. So even if there’s a backup you still can’t find the file. Recovering what has been deleted is the challenging part. 

“The user, which is the NMRA, is innocent and the disaster recovery system is an expensive investment. Perhaps due to budgetary constraints they have not been able to invest in it. Epic Lanka Technologies is also innocent as this is a human error, but we will rectify it soon,” said Dr. Dehigama.