Health Information Act · Cybersecurity and Data Security Essentials

Your one-page action plan

Windows PCs · clinic management system · GP or specialist

The 13 items below are MOH's Cybersecurity and Data Security (CS/DS) Essentials. CS/DS is used in its short form from here on.

Free and pro bono, not official MOH guidance. GPs have until 1 September 2027; specialist, dental and dialysis services each follow their own date.
Sources fetched 18 Aug 2026. The full deck has detail and citations

Your starting position Assumes your CMS is already HIA-compliant. If your clinic hasn't previously received the GP IT Enablement Grant, NHELP, or NH IT grant, you may be eligible for about 2 years of CMS subscription fees covered. Check with Synapxe. Not sure your CMS is compliant? Check the certification list.

Your ready-made policy document CSDS-Policy-Template-Solo-GP.docx: already written. Open in Word, swap in your clinic's details wherever it's highlighted yellow, done.

Do this first, this morning

Buy nothing today Open a ready-to-send email → with the questions already filled in. Just add your vendor's address.

Then open Windows Update and turn on automatic updates. Takes five minutes.

What this costs

2/13

items need any spending

11/13

need nothing bought

S$8,400

NEHR Connect Grant, if eligible

Two things to buy: an external hard drive for backups, and a paper shredder if you keep paper. MOH requires both but publishes no prices. You may also want cable locks. Everything else (Windows Defender, Windows Firewall, PDPC's free training) is already on your PC or free online. CS/DS does assume you can lock paper records away and that your PCs are still supported, so those are not nothing.

Who to ask

MOH questions: hia_enquiries@moh.gov.sg
NEHR onboarding: NEHR.Feedback@synapxe.sg
Grant applications: nehr.grants@synapxe.sg

Free and pro bono. Practical guidance built on MOH's own documents, not official MOH guidance and not legal advice. MOH's Implementation Guide says the same of itself (Annex C, page 47). Get a lawyer for a live breach or a vendor liability dispute, not for routine compliance work.

Your tracker: thirteen items, tick as you go (0/13 done)

Grouped by cost and kind of work. The step-by-step wizard at csds.kiechuan.sg/plan groups the same 13 items by what to do first.

Step is the order the wizard walks you through them. Item # is MOH's own numbering, which is what an auditor will ask for. Same 13 things, grouped here by cost and kind of work.

The paperwork: free, one afternoon

Step	Item #	What to do	Details
4	5	Health info identified, locked away, copied and sent safely	Open →
5	6	Health information marked or defined in policy	Open →
6	7	Access restricted to those who need it	Open →
8	8	Annual training done and recorded	Open →
9	9	Vendor questions sent and answered in writing	Open →
10	10	Self-review scheduled (we suggest annually)	Open →
12	12	Business Continuity Plan written (printed copy recommended)	Open →
13	13	Incident Response Plan written (printed copy recommended)	Open →

Windows settings: free unless a PC is unsupported

Step	Item #	What to do	Details
1	1	Automatic updates on, every PC	Open →
3	2	Defender, firewall, accounts, passwords, lockout, secure settings, two-factor authentication already done, certified software	Open →
2	4	Asset register filled, outdated (unsupported) equipment identified	Open →

The two items that need buying

Step	Item #	What to do	Done	Details
7	3	Backup running, drive unplugged, restore tested		Open →
11	11	Secure paper disposal in place, wipe procedure written		Open →

One gap worth knowing MOH's own incident-reporting form isn't live yet (MOH's Implementation Guide, Table 12, page 59, arrives 2027). MOH has named no interim channel. Our own fallback, not an MOH instruction: email hia_enquiries@moh.gov.sg within 2 hours and keep the timestamp. The PDPC and police channels work today. More on this in the full guide.