TRW & Co · Healthcare and life sciences
Health Information Act in Singapore: NEHR Contribution and Data Sharing
The Health Information Act in Singapore makes NEHR contribution compulsory for licensed healthcare providers and retail pharmacies, bans NEHR access for employment and insurance purposes, and imposes cybersecurity and data security duties. Parliament passed the Bill in January 2026 and MOH intends it to take effect in early 2027, so providers should prepare now.
Key pointThe biggest practical change is not the contribution duty itself but the security and access obligations that come with it: providers become accountable to MOH for their vendors' systems and for every staff member's NEHR access, with fines of up to S$1 million described for security failures.
At a glance
Passed January 2026
Parliament passed the Health Information Bill on 12 January 2026, and MOH intends the law to take effect from early 2027 to give providers time to prepare.
Mandatory NEHR contribution
Providers licensed under the Healthcare Services Act and retail pharmacies licensed under the Health Products Act must contribute key patient information to NEHR.
Care-only access
NEHR may be accessed only for patient care. Employment and insurance uses are prohibited, apart from specified statutory medical examinations listed in the Act.
Patient controls
Patients can view access logs on HealthHub, report suspicious access and place Access Restrictions, though allergy and vaccination data stays visible to providers.
Security duties and fines
Contributors, users and sharers must meet cybersecurity and data security requirements and notify MOH of confirmed incidents; MOH described fines up to S$1 million.
Swipe or scroll →
The short answer: what the Health Information Act in Singapore requires
The Health Information Act in Singapore makes contribution to the National Electronic Health Record (NEHR) compulsory for licensed healthcare providers, tightens who may access that record and why, and imposes cybersecurity and data security duties on everyone who contributes to, accesses or shares health information under it. Parliament passed the Health Information Bill on 12 January 2026. The Ministry of Health (MOH) has said it intends the law to take effect from early 2027.
As of October 2026, providers therefore have a short preparation window. Clinics, laboratories, dental practices and retail pharmacies that do not yet contribute to NEHR need compatible systems, internal access rules and security controls in place before commencement. Insurers and employers need to understand that NEHR is off limits for their purposes, save for narrow statutory medical examinations.
This article explains who must contribute, what must be shared, how access is controlled, what the security duties involve, the penalties MOH has described and the steps providers should take now.
Why the law was needed
NEHR has existed for years, and public healthcare institutions have long contributed to it. Participation by private providers, however, has been patchy. MOH's announcement identified private specialist clinics, clinical and radiological laboratories and dental clinics as segments not yet fully on NEHR. Patients increasingly see several providers across public and private settings, so gaps in the record can mean duplicated tests, missed allergies or incomplete medication histories.
MOH has engaged the public and stakeholders on the Bill since 2022, and their feedback shaped it before it was tabled. In its press release on the Bill, MOH framed the law around coordinated care: making key information follow the patient, while adding legal safeguards to the technical controls that already govern NEHR.
The legal framework and who is covered
The Health Information Act in Singapore operates alongside the Healthcare Services Act 2020, which licenses healthcare services, and the Personal Data Protection Act 2012, which governs personal data more generally. According to the Second Reading speech by Senior Minister of State Tan Kiat How, the duty to contribute applies to all healthcare providers licensed under the Healthcare Services Act and to retail pharmacies licensed under the Health Products Act. Certain public agencies, such as the Singapore Armed Forces and the Singapore Civil Defence Force, can be gazetted to contribute.
The contribution duty covers Singapore citizens, permanent residents and long-term pass holders. MOH said transient visitors are not required to have their information contributed.
The Act also creates a legal basis for providers to collect, use and share health information for care purposes without relying on individual consent, which is a departure from the consent-based model that otherwise applies under data protection law. Providers should not assume that every PDPA process they have built transfers neatly; some will need to be redesigned.
What information must be contributed
MOH has described the key health information to be contributed as:
- allergies and vaccinations;
- diagnoses and medications;
- laboratory test results and radiological images; and
- discharge summaries.
Which items apply to a given provider depends on the type of service it is licensed for. A dental clinic will not contribute the same data set as a hospital or a radiology centre. The detail will sit in subsidiary legislation and MOH guidance, which providers should track closely in the run-up to commencement.
Who can access NEHR, and the employment and insurance ban
Access to NEHR is for patient care only. Doctors, nurses, pharmacists and allied health professionals from whom the patient is seeking care may view the record. MOH has said it has technical controls so that authorised users see only the data their care duties require, and that regular audits will flag inappropriate access.
Accessing NEHR for employment or insurance purposes is prohibited. MOH gave examples such as insurance claim reports and pre-employment medical screening forms. The only exceptions are specified medical examinations required or permitted under written law, such as fitness assessments for national service enlistment, which are listed in a schedule to the Act.
Patient controls and break-glass access
Patients can monitor who has accessed their record through HealthHub and report suspicious access to MOH. They can also place an Access Restriction so that only selected providers can view their NEHR information. MOH said this was available at public healthcare institutions and would be offered through HealthHub from the second half of 2026.
Even under a restriction, critical allergy and vaccination information remains visible. In a medical emergency, only a doctor may use the break-glass function, after re-verifying credentials and declaring the emergency. Every break-glass event is audited, and confirmed inappropriate use may be investigated and referred to the Singapore Medical Council.
Sharing non-NEHR information for community care and public health
The Health Information Act in Singapore is not only about NEHR. It also gives a legal basis for sharing certain health information outside NEHR to support national programmes. MOH gave the example of Healthier SG and Age Well SG, where healthcare clusters can share the contact details of vulnerable seniors with the Agency for Integrated Care so that it can reach out and connect them to care and community services.
MOH said this kind of sharing without consent is limited to specified entities, such as public healthcare institutions, the Agency for Integrated Care and public agencies, and to specified use cases listed in the Act. The data shared is limited to identification and contact details and broad risk indicators, such as frailty or the presence of a chronic condition, rather than specific diagnoses.
For NEHR data, MOH indicated that identifiable information may be shared for public health purposes and anonymised data for wider public interest purposes, with each request assessed for necessity and proportionality. Community care organisations and technology partners that receive information under these channels should expect to meet the same security duties as providers under the Health Information Act in Singapore.
Cybersecurity and data security duties
Providers that contribute to or access NEHR, and entities that share or receive non-NEHR health information under the Act, must meet cybersecurity and data security requirements. MOH has said these consolidate existing standards and laws for the health sector rather than inventing an entirely new regime.
Commentary for practitioners groups the obligations into three areas: system-level cybersecurity protections; data security, meaning how information is identified, classified and handled; and organisational practices such as staff training, secure disposal, vendor management, audits, business continuity and incident response. MOH has indicated it will identify NEHR-compatible clinic systems that meet the requirements and automate contribution, and that training and funding support will be available.
Incident and breach notification
Providers must assess whether a notifiable cybersecurity incident or data breach has occurred and, once confirmed, notify MOH. Where a breach causes or is likely to cause significant harm, affected individuals must also be notified. Detailed timelines will be set in subsidiary legislation and guidance, so incident response plans should be drafted to accommodate them once published rather than fixed now.
Many clinics rely on a single practice management system vendor for records, billing and NEHR connectivity. Under the Health Information Act in Singapore, that vendor's security posture becomes your compliance risk. Review the contract now for security standards, incident notification to you, audit rights, data location and exit assistance, and confirm whether the vendor's product will be among the NEHR-compatible systems MOH identifies.
Penalties and MOH's enforcement approach
MOH's Second Reading speech set out a graduated approach. The figures below are as MOH described them in Parliament; providers should confirm them against the Act and subsidiary legislation when it commences.
| Breach | How MOH described the consequence |
|---|---|
| Failure to contribute | Not an offence at first instance. MOH may issue directions for deliberate or reckless non-compliance; failing to comply with a direction is punishable by a fine of up to S$20,000, imprisonment of up to one year, or both |
| Unauthorised NEHR access (first offence) | Fine of up to S$50,000, imprisonment of up to two years, or both |
| Repeat unauthorised access, or access for employment or insurance purposes | Maximum penalties doubled |
| Failure to implement required cybersecurity or data security measures | Fine of up to S$1 million |
MOH said it will assess each case on its facts and may use composition of offences, rectification directions and warning letters as well as prosecution. Professional consequences sit alongside: inappropriate access by a doctor can also become a disciplinary matter.
Preparing for commencement: a step-by-step plan
Commencement is expected in early 2027, so the practical work should be well under way. We suggest the following sequence for a clinic group, laboratory or pharmacy chain preparing for the Health Information Act in Singapore.
- Confirm your status. Identify each licence your group holds under the Healthcare Services Act or the Health Products Act, and map which service lines will carry the duty to contribute.
- Inventory your data and systems. List where allergies, diagnoses, medications, results, images and discharge summaries are created and stored, and which systems will connect to NEHR.
- Engage your vendors. Ask system vendors for their NEHR integration and security roadmap, and update contracts for security standards, incident cooperation and audit rights.
- Set access rules. Define who in your organisation may access NEHR and for what. Remove access for roles that do not provide direct care, and train staff on the employment and insurance prohibition.
- Build security controls. Benchmark against MOH's cybersecurity and data security expectations, including staff training, secure disposal and business continuity, and close the gaps.
- Update incident response. Add a step to assess whether an incident is notifiable to MOH and whether patients must be told, and rehearse it.
- Refresh patient communications. Explain to patients how information is contributed and shared, and how they can monitor access or place restrictions through HealthHub.
An illustrative scenario
This scenario is illustrative only and does not describe any real provider.
A group of specialist clinics has never contributed to NEHR. Its records sit in a cloud-hosted practice system. Front-desk staff routinely help corporate clients complete pre-employment medical forms, and the group also performs insurance medical reports on request.
Under the new regime, the group must contribute key information for eligible patients through a compatible system, so it starts with a vendor review and an integration plan. More importantly, it must redesign its corporate and insurance workflows. Staff preparing pre-employment or insurance reports must work only from the clinic's own records and the examination they perform, not from NEHR, unless the examination is one of the statutory exceptions. The group documents this rule, restricts NEHR access to treating clinicians and audits it monthly.
Risks and common mistakes
Assuming PDPA compliance is enough
The PDPA remains relevant, but the Health Information Act in Singapore adds sector-specific duties to contribute, access controls, security requirements and notification obligations. It also changes the legal basis for sharing health information for care. A PDPA-only compliance programme will miss the contribution duty, the employment and insurance prohibition and the MOH-specific incident process.
Treat the two regimes as complementary and update policies so staff know which rules apply to which data.
Allowing access for administrative convenience
Clinics often give administrative staff broad system access to save time. Under the Act, NEHR access must be tied to patient care, and audits will flag unusual patterns. A receptionist checking a family member's record or a manager pulling records for a billing dispute could trigger an investigation.
Role-based access, logging and periodic review are the minimum safeguards, coupled with clear disciplinary consequences.
Overlooking vendor and cloud risk
Most small and mid-sized providers depend on third-party systems for storage, connectivity and support. If a vendor's weakness causes a breach, the provider remains responsible to MOH and patients. Contracts that lack security warranties, incident notification and audit rights leave providers exposed.
Our cloud and outsourcing team regularly reviews these arrangements.
Waiting for commencement to start
Integration projects, staff training and security uplifts take months, and vendors will be busy as commencement approaches. Providers that wait for the final subsidiary legislation before acting risk being non-compliant on day one, and MOH has said directions may follow deliberate or reckless non-contribution.
Start with the steps that will be required whatever the final detail, such as access rules, vendor review and incident planning.
Cross-border and group considerations
Regional healthcare groups often centralise IT, analytics and support outside Singapore. The Act does not prohibit that, but security requirements and MOH's expectations on access and incident handling will apply to Singapore-licensed providers wherever their systems are hosted. Group service agreements should allocate responsibility clearly.
For groups with operations in Bangladesh, the UAE, the UK or China, health data rules differ markedly, and a single global policy rarely fits all of them. TRW & Co can coordinate Singapore advice with our offices elsewhere. See our pages on health data governance, healthcare regulation and data protection and the PDPA, and our articles on healthcare data governance and patient confidentiality.
Checklist for providers, insurers and employers
- Providers: confirm licences in scope, appoint an internal owner and set a commencement readiness plan.
- Providers: agree NEHR integration and security commitments with your system vendor in writing.
- Providers: implement role-based NEHR access, logging, audits and staff training.
- Providers: update incident response for MOH and patient notification.
- Insurers: confirm underwriting and claims teams do not rely on NEHR, and route requests for medical information through providers case by case.
- Employers and occupational health providers: check that pre-employment and fitness processes rely only on permitted examinations or the provider's own records.
- All: track MOH guidance and subsidiary legislation, and review healthcare licensing obligations at the same time.
If you would like help preparing for the Health Information Act in Singapore, contact TRW & Co. Where Singapore court or tribunal representation is required, we work alongside Singapore-qualified counsel.
Frequently asked questions
01When does the Health Information Act take effect?
Parliament passed the Health Information Bill on 12 January 2026. MOH has said it intends the law to take effect from early 2027, with the gap intended to give healthcare providers time to understand the requirements and strengthen cybersecurity and data security. As of October 2026, providers should check MOH announcements for the commencement notification and subsidiary legislation, and should not wait for them before starting vendor, access-control and security work.
02Which providers must contribute to NEHR?
According to MOH's Second Reading speech, the duty applies to all healthcare providers licensed under the Healthcare Services Act 2020 and to retail pharmacies licensed under the Health Products Act. MOH identified private specialist clinics, clinical and radiological laboratories and dental clinics as segments not yet fully on NEHR. Certain public agencies can also be gazetted to contribute. The specific data each provider contributes depends on the services it is licensed to provide.
03Can insurers or employers access NEHR?
No. Accessing NEHR for employment or insurance purposes is prohibited, including for insurance claim reports and pre-employment screening forms. The only exceptions are specified medical examinations required or permitted under written law, such as certain enlistment fitness assessments. Insurers may still request medical information from providers case by case, but providers must prepare those reports without drawing on NEHR. MOH described heavier penalties where unauthorised access is for employment or insurance purposes.
04Can patients opt out of NEHR?
Contribution is mandatory, so the regime does not offer a general opt-out. Patients can, however, place an Access Restriction so that only providers they select can view their NEHR information. MOH said this would be offered through HealthHub from the second half of 2026. Critical allergy and vaccination information remains visible to providers, and doctors can use an audited break-glass function in medical emergencies.
05What are the penalties under the Health Information Act?
MOH described a graduated approach in Parliament. Failure to contribute is not an offence at first, but non-compliance with a direction can attract a fine of up to S$20,000, up to one year's imprisonment, or both. Unauthorised NEHR access can attract a fine of up to S$50,000 and up to two years' imprisonment for a first offence, doubled for repeat or employment and insurance cases. Failure to implement required security measures can attract a fine of up to S$1 million.
06How does the Act interact with the PDPA?
The PDPA continues to apply to personal data generally, but the Health Information Act in Singapore adds health-specific rules. It creates a legal basis for providers to collect, use and share health information for care purposes without relying on consent, imposes a duty to contribute to NEHR, restricts access and sets security and notification duties enforced by MOH. Providers should review their PDPA policies so that staff understand which regime governs which activity.
Sources and official materials
- MOH: Health Information Bill to support coordinated care across Singapore's healthcare ecosystem — MOH press release on the Bill's scope and timing
- MOH: Health Information Bill Second Reading opening speech — Coverage, access rules, security duties and penalties
- Gov.sg: What is the Health Information Bill? — Government explainer on the Bill
- Healthcare Services Act 2020 — Licensing framework for healthcare services
- Personal Data Protection Act 2012 — General personal data protection regime
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
