Singapore · Health Information Act
The Ministry of Health (MOH) takes a calibrated approach. Could your clinic comply with a direction to rectify?
MOH’s published enforcement approach is explicit: for contribution requirements, non-compliance “is not an offence in the first instance”, and enforcement runs through directions to rectify, letters of warning and notices of composition. So the question worth asking is not what the fine is. It is whether your clinic could actually comply with a direction to rectify — and for most things that means producing a record you can only produce if you kept one.
Ten questions. You’ll get your licence type’s actual dates, the funding open to you, and which practices are worth reviewing first.
This guide covers the Personal Data Protection Act (PDPA), Health Information Act (HIA), Healthcare Services Act (HCSA), National Electronic Health Record (NEHR), and NEHR Connect Grant (NCG). Health Information Management Systems (HIMS) support clinic records. Healthcare Institution (HCI) codes identify providers. Cybersecurity and data security (CS/DS) measures protect their information. Relevant agencies include the Ministry of Health (MOH), Cyber Security Agency of Singapore (CSA), Infocomm Media Development Authority (IMDA), and Personal Data Protection Commission (PDPC).
Every date and figure on this page is quoted from a named MOH document, listed at the foot. This is general information, not legal advice. MOH notes that dates may change — check healthinfo.gov.sg.
First, your licence
What service type does your clinic hold a licence for?
MOH’s timeline is batched by service type, not by clinic size. This one answer decides every date you see. A practice holding several licences follows each service’s own timeline, so it has more than one date.
Ten questions, about 90 seconds. No email needed to see your result.
Sources
Everything stated on this page is drawn from the following. Where we could not source a claim, we left it out rather than paraphrase it — including any figure for penalties, which MOH’s published material does not give.
- • MOH, Implementation Support — Implementation Timelines for Healthcare Providers and NEHR Connect Grant — healthinfo.gov.sg/implementation-support
- • MOH, About Cybersecurity & Data Security, including the Calibrated Enforcement Approach — healthinfo.gov.sg/csds
- • MOH, Cybersecurity and Data Security Essentials for Healthcare Providers, developed with CSA, IMDA and PDPC — linked from the page above
- • MOH, Health Information Act Implementation Guide, Version 2.0, August 2026 — healthinfo.gov.sg/resources-links
- • Personal Data Protection Act 2012 and Healthcare Services Act 2020, which MOH states the HIA builds upon
General information only, not legal advice, and not a statement of your obligations. Ekko is not a certified Health Information Management System and does not contribute to NEHR. MOH notes dates are subject to change. Dates and grant figures checked 13 October 2026.