Health Information Act and NEHR: IT Checklist for Private Clinics

What the Health Information Act requires of clinics

MOH's HIA overview describes three frameworks. Two affect private clinics directly: NEHR contribution and access, and cybersecurity and data security (CS/DS). The third, sharing of non-NEHR data, currently applies only to public healthcare bodies.

• NEHR contribution: all providers licensed under the Healthcare Services Act, plus retail pharmacies, must contribute key health information of Singaporeans, PRs and long-term pass holders. The gov.sg explainer lists allergies, vaccinations, diagnoses, medications, lab results, radiological images and discharge summaries.
• Cybersecurity and data security: providers, retail pharmacies and Health Information Management System (HIMS) vendors must put in place reasonable security measures and notify MOH of significant data breaches and cyber incidents.
• Access controls for patients: patients can monitor NEHR access and set restrictions through HealthHub. Access for employment or insurance purposes is prohibited.

These sit on top of duties clinics already have under the PDPA and the Healthcare Services Act. Our guide to clinic cybersecurity and patient data covers the existing baseline.

HIA and NEHR deadlines by clinic type

MOH's implementation support page sets three batches. The deadline is the same for starting NEHR contribution and for having the CS/DS measures in place.

MOH says non-contribution is not an offence in the first instance where there are genuine technical difficulties, and it will help providers resolve them. Deliberate or reckless non-compliance can lead to directions, and failing to follow a direction can lead to enforcement.

MOH's cybersecurity and data security Essentials, in plain terms

All HIA entities must follow the CS/DS Essentials, developed by MOH with CSA, IMDA and PDPC. They have 13 headings in three groups. Here is what they mean for a small clinic:

MOH notes that it has worked with HIMS vendors (for example clinic management system vendors) to build key controls into their systems: timely updates, two-factor authentication for configuration changes, secure configuration and protected backups. Vendors that do so are Cyber Essentials certified. The same controls are still needed on your other systems, such as billing apps, email and front-desk PCs.

Incident reporting under the HIA: the 2-hour rule

MOH's CS/DS page sets out what happens when something goes wrong. The clinic must assess any cybersecurity incident or data breach promptly to decide whether it is notifiable under the HIA.

• If notifiable, an initial notification to MOH within 2 hours of the assessment.
• If a breach is likely to cause significant harm, notify the affected patients too.
• A detailed report within 14 days of the initial notification, covering impact, findings, remediation and prevention.

Questions to ask your clinic management system vendor

For most private clinics, the clinic management system is the HIMS that will connect to NEHR. MOH's NEHR Connect Grant process starts with choosing an HIA-compliant HIMS from the certified provider directory. Ask your current vendor these questions in writing:

1. 1

   Is your system on MOH's HIA-compliant HIMS list?

   If not, ask for the date it will be and what changes you will see.

2. 2

   Are you Cyber Essentials certified?

   MOH links CE certification to the controls it has embedded with HIMS vendors.

3. 3

   What NEHR data will the system send automatically?

   Compare it with MOH's NEHR contribution requirements guide published in July 2026.

4. 4

   What will the upgrade cost, and will the grant cover it?

   Ask for a written quote you can attach to a grant application.

5. 5

   How are backups handled, and how fast can you restore?

   Get the backup frequency, where it is stored and a target restore time.

6. 6

   Who tells whom during an incident?

   Agree how fast the vendor tells you about an incident on their side, given your 2-hour MOH window.

Grants for HIA readiness: NEHR Connect Grant and EDGE

MOH lists three sources of funding. The NEHR Connect Grant (NCG) gives a fixed S$8,400 to outpatient medical clinics (GP and specialist) and to outpatient dental clinics, applied for through the OurSG Grants portal. For GP licensees, applications opened on 1 July 2026 and close on 31 August 2027.

For security measures, MOH points to the EDGE Grant, which it says replaces the Productivity Solutions Grant from 30 September 2026 and covers items such as data backup, anti-malware and firewalls. MOH's own illustration for a solo GP adds up to about S$20,000: S$8,400 NCG, an estimated S$7,500 from EDGE and an estimated S$5,800 through CSA's support. See our guides to the EDGE Grant for IT and CSA's CISO-as-a-Service and Cybersecurity Health Plan.

Do it yourself or get help?

Much of this is paperwork and vendor follow-up a practice manager can do. The technical parts, separate backups, two-factor sign-in on email and PCs, and an incident plan someone has rehearsed, are where clinics usually need help.

A Security Health Check (S$290) maps your clinic against the CS/DS Essentials. Backup & Ransomware Recovery (S$290) sets up separate, protected backups, and the Microsoft 365 / Google Security Lockdown (S$590) enforces two-factor sign-in and access controls on email and files. This guide is general information, not legal advice; check MOH's HIA site and circulars for your licence type. Our Cyber Essentials checklist overlaps heavily with the CS/DS Essentials if you want a certification as well.