In this guide · 7 sections
Short answer
Use AI for admin messages: reminders, directions, opening hours, rescheduling and general FAQs, with staff approving templates. Don't let AI give clinical advice, triage symptoms or promise outcomes. Keep patient data out of unapproved tools and check AI marketing against HCSA rules.
Admin messages vs clinical advice: where AI fits
The line that matters is whether a message affects a patient's medical care. MOH's Artificial Intelligence in Healthcare Guidelines 2.0 (AIHGle 2.0, published March 2026 with HSA) separates clinical uses, clinical-operations uses and general operations such as scheduling or inventory, and says human oversight is mandatory for all clinical and clinical-operations use of AI.
| Message type | Example | Suitable for AI? |
|---|---|---|
| Appointment reminders | 'Your appointment is tomorrow at 10am' | Yes, from approved templates |
| Directions, hours, parking | 'We're open until 9pm on weekdays' | Yes, from your own FAQ |
| Rescheduling and cancellations | 'Reply 1 to confirm, 2 to reschedule' | Yes, with a person handling exceptions |
| Pre-visit instructions | 'Please bring your referral letter' | Yes, if written and approved by clinical staff |
| Symptoms or 'should I come in?' | 'I have chest pain, what should I do?' | No: route to staff or emergency advice |
| Test results or treatment advice | 'Is my result normal?' | No: clinical, needs a doctor |
What MOH's AIHGle 2.0 asks of clinics
AIHGle 2.0 is guidance, not a new law, but it sets out what MOH expects from healthcare organisations that deploy AI. A clinic that buys an AI tool is a deployer, and its doctors and staff are users.
- Responsibilities stay with the clinic: AI is an aid that supports, not replaces, professional judgement, and healthcare professionals remain responsible for safe care.
- Risk-based approach: deployers should weigh potential harm to patients, the level of human oversight and whether the use is clinical before choosing how to deploy.
- Staff training: AIHGle 2.0 lists training on limitations, output interpretation, patient communication and data input restrictions.
- Patient communication: it notes that AI used for billing or scheduling staff time-off isn't relevant to a patient's medical management, while AI that significantly affects care should be explained to patients.
For a typical GP, dental or aesthetic clinic using AI for reminders and FAQs, this mostly means: keep AI on the admin side, have a named person approve what it says, and train staff on what they may paste into it.
Patient data in AI tools: what PDPA expects
Patient names, phone numbers, appointment types and especially medical details are personal data, and health information is among the most sensitive kinds. The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, set out what organisations deploying AI systems should do.
- You are responsible for your choice of tool: deployers bear primary responsibility for ensuring the AI systems they use can meet their PDPA obligations.
- Purpose and minimum data: define what the system is for and the personal data it really needs. The PDPC's example of a medical records triaging system limits it to its purpose and blocks access to other databases such as billing or patient contact lists.
- Protect prompts and outputs: messages, prompts, outputs and tool activity are new data sources that need safeguards.
- Tell staff what may go in: educate users on which types of personal data may be put into the system.
- Write it down: clear written policies, ideally published, demonstrate accountability.
Our clinic cybersecurity and patient data guide covers the wider security basics.
AI-written marketing and HCSA advertising rules
Anything a clinic publishes to promote its services, including website pages, social posts and WhatsApp broadcasts, is advertising under the Healthcare Services (Advertisement) Regulations 2021. AI tends to write the kind of copy these rules restrict.
| What AI often writes | Why it's a problem for a clinic | Safer approach |
|---|---|---|
| 'The best dental clinic in the East' | Superlatives and comparisons are restricted | Plain facts: services, qualifications, hours |
| 'Guaranteed results', 'pain-free' | Claims must be accurate and capable of being substantiated | Describe the procedure, not the promise |
| Invented patient quotes or stories | Patient reviews and endorsements are tightly limited | Don't use AI to create patient voices |
| Before-and-after framing | Not allowed in clinic advertising | Remove from prompts and templates |
| 'Free facial with every package' | Gifts tied to the value or type of treatment aren't allowed | List services and prices factually |
MOH says on ask.gov.sg that paid reviews are not allowed and must be removed, as they breach regulation 14 of the advertisement regulations. Our clinic website advertising rules guide goes through the regulations in detail; some breaches carry fines of up to S$20,000, imprisonment of up to 12 months, or both.
Setting up AI reminders and FAQs safely
A careful set-up keeps AI on the admin side from day one.
List the messages you send most
Reminders, confirmations, directions, rescheduling, what to bring, payment and insurance questions. These are your templates and FAQ.
Have clinical staff approve the content
A doctor or senior nurse signs off any instruction that touches preparation, medication or aftercare. AI only uses approved text for those.
Choose an approved tool
A business plan or vendor with clear data terms, admin control and the ability to limit what the assistant can see.
Set guard-rails and hand-offs
The assistant answers only from your FAQ, refuses clinical questions politely, and hands over to staff for anything else or anything urgent.
Get opt-in for WhatsApp messages
Reminders and recalls by WhatsApp need the patient's consent and approved templates; our dental recall reminders guide covers the PDPA and Do Not Call points.
Review conversations weekly
Read a sample of AI replies each week for the first month and fix the FAQ where answers were wrong or unclear.
Clinic AI messaging check
Do it yourself or get help?
Writing a reminder template with AI help and having a doctor approve it is easy to do yourself. A website assistant or WhatsApp automation that patients talk to needs more care: guard-rails, hand-offs for urgent questions, opt-in records and a data set-up you can explain to the PDPC if asked.
Our AI Website Assistant (S$790) is trained on your website, FAQ and documents, captures enquiries to your inbox, hands over to WhatsApp or email, has guard-rails so it only answers about your clinic, and includes a usage report after the first 30 days; you supply and approve the FAQ. WhatsApp Notifications (S$590) sets up a WhatsApp Business API number through an official provider, up to 3 approved templates such as reminders, triggers from your booking system, and opt-in handling for PDPA.
Frequently asked questions
For admin messages such as reminders, opening hours and directions, a business AI tool can help draft replies from approved templates. It shouldn't give clinical advice, assess symptoms or interpret results. Use a business plan with admin control rather than personal accounts, and keep patient medical details out of prompts unless the tool is approved for that data.
MOH and HSA published the Artificial Intelligence in Healthcare Guidelines 2.0 in March 2026. They are guidance rather than law, and set out responsibilities for developers, deploying organisations and healthcare professionals, including mandatory human oversight for clinical uses of AI, risk assessment, staff training and patient communication.
It can draft them, but every post is advertising under the Healthcare Services (Advertisement) Regulations 2021. Remove superlatives, guaranteed outcomes, treatment-linked gifts, before-and-after framing and any invented patient voices that AI tends to add. Keep to accurate, verifiable facts, and have someone who knows the rules approve each post.
It depends on the tool and the purpose. The PDPC's July 2026 guidelines say organisations deploying generative AI are responsible for checking the tool can meet PDPA obligations, should limit it to its purpose and the data needed, protect prompts and outputs, and tell staff which personal data may be input. Personal AI accounts are the riskiest option.
No. MOH says paid reviews are not allowed, citing guidance that licensees must not offer valuable consideration of any kind to induce patients or the public to provide endorsements, and that paid reviews breach regulation 14 of the advertisement regulations and must be removed. Google's own policy also bans incentivised reviews.