The Senate Committee on Finance on Thursday approved the proposed P311.3 billion budget of the Department of Health for the upcoming fiscal year without the attendance of Health Secretary Teodoro "Ted" Herbosa.

Herbosa skipped the DOH's budget deliberation, normally led by the agency's head, days after he failed to secure the approval of the Commission on Appointment.

During the budget deliberation, DOH senior officials led by Undersecretary Lilibeth David, former Officer-in-Charge Maria Rosario-Vergeire, and Undersecretary Gloria Balboa, presented the agency's proposed budget.

Senator Francis Tolentino specifically questioned Herbosa's absence in the budget deliberation, fearing that the agency is now in an "auto-pilot mode".

Senator Pia Cayetano, who presided over the agency's budget deliberation, quickly clarified that the DOH is not "headless".

"Actually, all of the senior members of the team approached me a while ago and they acknowledged that of course, it is a bit of an awkward situation," Cayetano said.

"But as you all know, Usec Dr. Vergeire was the OIC for many years and was very actively exercising her leadership not just in the past year, but even during the time of President Duterte. Dr. Usec. David is the most senior undersecretary. So I'm quite confident in the presentation today that they can answer," she added.

Tolentino explained that he is asking for Herbosa's presence because "budget presentations would require answers concerning accountability."

"And perhaps the head of the department should be the one doing that. Otherwise, it would be in an auto-pilot mode," he said.

For her part, Senator Loren Legarda also expressed her confidence in the senior officials of the DOH.

"Let me just say that I'm certain that our very competent Usecs. and Asecs. down the line would be able to communicate the policies of the secretary who still has to be confirmed," Legarda said.

"I don't think that the DoH body institution system comprised of career people who — it may be a headless agency this is insofar other secretaries concerned — but all the systems are covered by the Usecs. and Asecs," she added.

She continued: "I am very confident that they will be able to answer our questions. I do not think that they would divert from any policy of the secretary or say anything that would be against his policies."

Cyber-attack on PhilHealth

Senators also touched on the recent cyber-attack on the Philippine Health Insurance Corporation or PhilHealth.

Legarda quizzed PhilHealth officials about the effect of the cyber-attack on the state-run health insurer's operation, as well as the steps being taken by the agency to prevent encountering a similar case in the future.

Responding to the lawmaker's query, Atty. Eli Dino D. Santos, PhilHealth's Executive Vice President and Chief Operating Officer, said that the agency has yet to return its online system.

"All systems now are all transactions are offline and we resume operations meaning membership, employer submission, and payment over the counter," Santos said.

"Our benefits availment continues. We have already informed our partner providers that while the system is turned off, they can still submit claims or prepare the submission of claims," he added.

He continued: "At present, to confirm the statement of our President, we are set to turn on our systems today, but we are still completing the preventive measures before we turn it on. We are targeting to turn on our PhilHealth website, member portal, as well as the e-claims."

Over the weekend, PhilHealth confirmed reports that there was an "information security incident" on its online system, which prompted them to turn it off as part of its "containment measures".

The Department of Information and Communications Technology previously stated that the agency's system was attacked by Medusa ransomware.

A multinational cyber security software company, Trend Micro defined "ransomware" as a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files until a ransom is paid.

The Medusa ransomware group was demanding $300,000 from PhilHealth in exchange for access to its system. The group threatened to leak the personal information of PhilHealth members if it did not pay the ransom.

The state-run health insurer previously stated that it would not give in to the group's demand.