KINIGUIDE | What PAC uncovered about MySejahtera
KINIGUIDE | The ubiquitous MySejahtera application will not be free of charge eventually.
Thus, there are many questions over who gets the contract to manage the application - which logs personal details, health status and whereabouts of 38 million users.
Much of the details on the deal would not have come to light had it not been for the Public Accounts Committee, who questioned the Finance Ministry and Health Ministry (MOH) on March 8. [View transcripts here]
This instalment of KiniGuide will look at some of the topics deliberated by the PAC, such as the players involved in MySejahtera and what is at stake...
Editor’s note: Fixed typo in para 4, fourth subheading. Fixed year in para 2, fifth subheading. The errors are regretted.
KINIGUIDE | The ubiquitous MySejahtera application will not be free of charge eventually.
Thus, there are many questions over who gets the contract to manage the application - which logs personal details, health status and whereabouts of 38 million users.
Much of the details on the deal would not have come to light had it not been for the Public Accounts Committee, who questioned the Finance Ministry and Health Ministry (MOH) on March 8. [View transcripts here]
This instalment of KiniGuide will look at some of the topics deliberated by the PAC, such as the players involved in MySejahtera and what is at stake.
Who owns the MySejahtera application?
Health Minister Khairy Jamaluddin said the MOH owns the rights to the MySejahtera smartphone application.
However, a written reply by the Science, Technology and Innovation Ministry (Mosti) and MOH to the Public Accounts Committee (PAC) suggested that things are a bit more complicated.
The MOH has formed a “MySejahtera Steering Committee”, chaired by Khairy, to decide on the management and direction of MySejahtera while considering the cost-benefit of a “complete” takeover of the application.
While the government may own the MySejahtera base application, they may not own some additional modules.
How much did the government pay for MySejahtera?
Nothing yet.
KPISoft Sdn Bhd was engaged by the Health Ministry to develop MySejahtera as a form of corporate social responsibility (CSR) from March 27, 2020, until March 31, 2021. Putrajaya will not be charged for this period.
According to the Mosti/MOH reply to the PAC, Putrajaya decided that KPISoft Sdn Bhd has to be paid from April 1, 2021, because of all the additional components added to MySejahtera which was not in the original 2020 agreement.
Additional components include the Malaysian Vaccine Administration System (MyVAS) used for the National Covid-19 Immunisation Programme.
As of yesterday, KPISoft Sdn Bhd has not been paid, according to Khairy. On Nov 26 last year, Putrajaya ordered the MOH to set up a procurement committee to look into a two-year contract to manage MySejahtera.
On Feb 28, the Finance Ministry greenlit the MOH’s procurement plan. There are no indicative costs.
Who has been offered the contract?
Rosni Mohd Yusoff, deputy secretary at the Finance Ministry's Government Procurement Division, told the PAC that on Nov 26 last year, Putrajaya greenlit the MOH’s decision to appoint MYSJ Sdn Bhd to manage MySejahtera.
This procurement was done without an open tender process.
Why are there two companies involved in MySejahtera?
Harjeet Singh, deputy secretary-general (finance) of the MOH, told the PAC that KPISoft Sdn Bhd changed its name to MYSJ Sdn Bhd.
However, Rosni clarified that KPISoft Sdn Bhd and MYSJ Sdn Bhd are two different entities.
PAC chairperson Wong Kah Woh pointed out during the proceedings that KPISoft’s directors were Rekhta Mani and Yogaraj Thuraisingam.
As for MYSJ, the directors are Heah Kok Boon, Raveenderan Ramamoothie, Anuar Rozhan, Liew Kee Sin, Shahril Shamsuddin and Megat Najmuddin Megat Khas.
Anuar is the brother to former Astro Malaysia Holdings Bhd CEO Rohana Rozhan, while Shahril is best known for being the Sapura Energy CEO.
Megat Najmuddin was a long-time Umno member who joined Bersatu in 2018. Currently, he chairs Bersatu’s disciplinary board.
Among all directors, Anuar is the only link between KPISoft (now known as Entomo) and MYSJ Sdn Bhd.
Is MYSJ a brand new company?
Yes. Incorporated in September 2020.
As for KPISoft, they have been around since 2005 and are based out of Singapore, with a Malaysian presence. Their Malaysian outfit changed its name to Entomo Malaysia in May 2020.
According to a report by Code Blue, MySJ Sdn Bhd is Entomo Malaysia’s special purpose vehicle created for a public-private partnership (PPP) project.
Khairy offered a different account. At his press conference today (March 28), he explained that there was never a contract between the MOH and KPISoft.
After becoming health minister on Aug 27 last year, Khairy said he brought the matter to the cabinet and argued that there needs to be a contract.
“That was the start of negotiations with KPISoft. They informed us that they have changed their name (to Entomo) and licensed MYSJ to run the (MySejahtera) platform.
“Thereon, the government held discussions with MYSJ because they are under licence by KPISoft. Currently, the government is in discussion with MYSJ on the way forward and the maintenance of the (MySejahtera) platform.
“The MySejahtera (application) and data are owned by the government. The maintenance (of the platform) is currently in discussion.”
According to Code Blue, citing court documents, Entomo Malaysia had proposed to the government in Dec 2020 to pay them to expand the scope of MySejahtera beyond the Covid-19 pandemic.
The report said Entomo Malaysia proposed that MySejahtera can be used to track other vaccination distribution, manage other infectious diseases, conduct predictive analysis and integrate with other existing government health systems.
Entomo Malaysia proposed that the PPP contract would last 15 years and cost the government about RM138.9 million annually.
However, as Khairy pointed out, this deal has not been finalised.
Who owns the data collected on MySejahtera?
The government claims it owns it. Khairy has promised that it would not be shared even with other government agencies.
Will personal data be compromised through the MYSJ deal?
Dr A Maheshwara Rao, Disease Control division senior assistant director-general, told the PAC that all MySejahtera data is within the full control of the Health Ministry, under the supervision of the National Cyber Security Agency (Nacsa).
“(Nacsa) looks at all our data acquisition, our data extraction to access and what not to with the permission of our director of disease control,” said Maheshwara.
He estimated that there are 30 million MySejahtera "check-in" daily and around 300,000 users flagged as "casual contacts".
“Casual contacts are determined through an algorithm. We do not extract data. All ‘check-in’ data will be archived in 30 days and deleted in 60 days.
“Every day, millions of ‘check-in’ data are deleted,” he said.
What was the PAC's recommendation?
The PAC was of the opinion that Putrajaya should not have allowed a direct negotiation contract with MYSJ Sdn Bhd because it was an entity that was separate from KPISoft Sdn Bhd.
PAC also urged the government to ensure compliance with all government procurement procedures.
Are you sure you want to delete this comment?
This action cannot be undone.