On 5 November the Singapore Ministry of Health introduced the Health Information Bill (the “Bill”) in Parliament, marking a major step towards achieving a centralised digital health ecosystem in Singapore. If enacted, the Bill will require licensed healthcare providers to contribute key patient data to the National Electronic Health Records (“NEHR”) system and will establish tailored legal, privacy and cybersecurity safeguards to govern health data. The Bill responds to the problems of fragmented clinical records and low private sector participation in the NEHR, by requiring licensed providers to contribute specified health data. Its purpose is to create a comprehensive, current national health record that improves continuity of care, enables co-ordinated clinical decision making and supports national health programmes.

The Bill imposes cybersecurity and data security obligations on any person who is subject to or who uses the statutory frameworks it creates. It defines roles such as contributors, users, requestors, system operators, health data intermediaries, disclosers and recipients and assigns specific duties and responsibilities to each role based on how they handle health data. You will be subject to the Bill to the extent you engage with any of those frameworks or perform functions described by those roles. The regime is distinct from but conceptually aligned with the Personal Data Protection Act 2012 (“PDPA”) and the Cybersecurity Act 2018 (“CSA”).

The Bill’s core objectives:

• Ensure NEHR records are accurate, current and accessible for authorised purposes.
• Provide a sectoral legal basis for sharing health information to support continuity of care.
• Impose minimum data protection and cybersecurity obligations on those that process health information.

In terms of oversight and enforcement, the Ministry of Health will implement and enforce the new regime. The Bill requires the reporting of security and cybersecurity incidents to the Minister for Health, which will sit alongside existing reporting duties under the PDPA and the CSA to the relevant regulators.

We go into further detail on the Bill’s key sections below.

The national electronic health records system: Part 2 of the Bill

Summary of the NEHR

The NEHR is a Singapore Government established electronic system holdi...