You'll need your clinic computer

This walks you through settings on the Windows PC that runs your patient records, so it can't be finished on a phone. Send yourself the link and open it when you're at that computer.

Send to WhatsApp Email it to me

Not sure this applies to you? Read the 5-minute summary. That page reads fine on a phone.

Health Information Act · Cybersecurity and Data Security Essentials

Your compliance plan

MOH's CS/DS Essentials is a 13-item checklist. This page asks a few plain questions about each one and writes your clinic's policy as you answer.
Who this is for, what it costs, where it comes from
Who this is for

A GP or specialist on Windows PCs, already using a clinic management system. GPs have until 1 September 2027; specialist, dental and dialysis services each follow their own date (MOH's Implementation Guide, page 3).

What it costs

Only 2 of the 13 items need any spending: a backup drive, and a paper shredder if you keep paper records. You may also want cable locks, which CS/DS expects on any laptop holding health information, along with lockable storage for hardcopy records (clauses B.2.1 and B.2.2). It also assumes your PCs are still supported.

Where this comes from

Free and independent, built from MOH's published CS/DS Essentials and HIA Implementation Guide. It is not official MOH guidance.

0 of 13 steps done
⚡
Try it in 5 minutesStep 1 is turning on automatic Windows updates. One setting, no clinic details needed. Start there and see how this works.

Your clinic

Fill in once. Every step below reuses it.
Whoever makes your patient records software. Leave blank if unsure.

Your policy so far

What CS/DS Essentials asks of a Singapore clinic

Singapore's Health Information Act makes a list of 13 Cybersecurity and Data Security (CS/DS) Essentials binding on licensed healthcare providers. MOH publishes them as a 16-page document and expands on them across a 74-page Implementation Guide. This page turns that into plain questions about one clinic, and writes your answers into a policy you can sign.

Outpatient Medical Service (GP) clinics are Batch 1. You need to be contributing to NEHR and have the CS/DS measures in place by 1 September 2027. Specialist, dental and dialysis services each have their own date (MOH's Implementation Guide, Chapter 1, Table 1, page 3). Only two of the 13 items need any spending. The other eleven cost you time.

The 13 items

  1. Install software updates promptly Automatic updates on, every PC in the clinic. CS/DS A.1 · Free
  2. Secure and protect Anti-malware, firewall, one login per person, passwords, two-factor authentication, account lockout, logging, secure settings. CS/DS A.2 to A.12 · Free
  3. Back up essential data A copy kept separately from the PC, and a restore you have actually tested. CS/DS A.13, A.14 · About S$60 to S$100
  4. Keep an asset list Every PC, phone and piece of software, with anything End-of-Support flagged. CS/DS A.15 to A.18 · Free unless a PC is unsupported
  5. Secure your health information Know what you hold, store it safely, and copy or send it safely. CS/DS B.1 to B.7 · Free
  6. Mark your health information Label documents as health information, or define it once in the policy. CS/DS B.8, B.9 · Free
  7. Restrict access Only the people who need patient records get to them. CS/DS B.10 · Free
  8. Train your staff Security awareness training once a year, with a log. Free PDPC material counts. CS/DS C.1, C.2 · Free
  9. Manage your vendor Know what your clinic management system provider covers and what it does not. CS/DS C.3 to C.5 · Free
  10. Review yourself Check your own security on a schedule and write down what you found. CS/DS C.6 to C.8 · Free
  11. Dispose of things properly Shred paper, wipe drives before anything leaves the clinic. CS/DS C.9 · About S$30 to S$50
  12. Business Continuity Plan What the clinic does on the day the system is down. CS/DS C.10 · Free
  13. Incident Response Plan Who does what in a breach, and who you have to tell. CS/DS C.11 to C.14 · Free

The long-form written guide walks through all 13 on Windows with the page number for every instruction, and the one-page action plan fits them on a sheet you can print and tick off.

Common questions

Do I have to do this, and by when?

If you hold a licence under the Healthcare Services Act, yes. Outpatient Medical Service (GP) clinics are in Batch 1: you need to be contributing to NEHR and have the CS/DS measures in place by 1 September 2027. Specialist, dental and dialysis services each have a different date, set out in MOH's Implementation Guide, Chapter 1, Table 1, page 3, and Table 4, page 10.

What does CS/DS compliance cost a small clinic?

Two of the 13 items need money. An external drive for backups runs about S$60 to S$100, and a paper shredder about S$30 to S$50 if you still keep hardcopy records. CS/DS also expects a cable lock on any laptop that holds health information, and lockable storage for paper files (clauses B.2.1 and B.2.2). The remaining 11 items cost nothing except your time, assuming your PCs are still supported by Microsoft.

Do I need to buy antivirus or a firewall?

No. MOH's FAQ for healthcare providers, question 14, says that for solo practitioners and small clinic chains with simple setups, “Microsoft Defender may provide sufficient firewall protection”, and that the same reasoning applies to antivirus. Defender is already installed on every Windows 10 and Windows 11 machine. If a vendor tells you otherwise, that line is your answer.

Do I need to hire a cybersecurity consultant?

Not necessarily. MOH's FAQ question 23 says that “engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services to meet the necessary CS/DS requirements”. If you do want help, CSA's CISO-as-a-Service scheme covers up to 70% of the cost of a consultancy package.

Is there a CS/DS policy template for a clinic?

MOH publishes sample clauses, registers and plans in Annexes B to E of the Implementation Guide, pages 38 to 59. This page assembles them into one document with your clinic's name, your equipment and your own answers filled in, then gives you a Word file you can edit and sign.

Does my clinic's information leave this page?

No. Everything you type stays in your own browser, saved in local storage on that computer. There is no account and no server behind this page. Come back next week and your answers are still there, though clearing your browser data wipes them. You can also export them to a file and load them on another machine.

What is the NEHR Connect Grant, and when does it close?

A fixed S$8,400 for a GP clinic holding an Outpatient Medical Services licence, meant to cover roughly two years of clinic management system subscription, or 40% of the cost of upgrading the one you have. You have to choose a Synapxe-certified HIA-compliant system before you apply at oursggrants.gov.sg. Applications submitted after 31 August 2027 are rejected (the Guide, Chapter 2C, pages 9 to 10).

Is this official MOH guidance?

No. I built it from MOH's published documents and I cite the page number for every instruction so you can check me. It is free and it carries no MOH endorsement. For a live data breach, or a liability dispute with your software vendor, get a lawyer.

The four MOH documents behind this page were retrieved on 18 August 2026: the Cybersecurity and Data Security Essentials (first edition, March 2026), the HIA Implementation Guide for Healthcare Providers v2.0 (August 2026), the HIA FAQs for Healthcare Providers v1.1 (13 August 2026), and MOH Circular MOH-MHC-0018-2026. The FAQ moved from v1.0 to v1.1 in five months, so check healthinfo.gov.sg before your final sign-off if you are reading this much later.