For Singapore clinics · Health Information Act
Your compass, find your footing.
Answer five questions and this points you in the correct direction.
- Your deadline
- When your clinic has to be ready. GP, specialist and dental have different dates.
- Your CMS
- Healthcare providers should utilise HIA-compliant Health Information Management Systems (HIMS) to contribute health information to the NEHR.
- The grant
- The NEHR Connect Grant, money towards getting onto a certified system. A GP clinic gets a fixed S$8,400 if eligible.
- NEHR
- The national record that lets your patient’s next doctor see what you did. You have to start sending records to it.
- CS/DS
- The Cybersecurity and Data Security Essentials: thirteen measures MOH expects of anyone holding health information.
Question 1 of 5
Posts about HIA and the CS/DS Essentials are my own reading of MOH’s published documents. No MOH endorsement, and I am not a doctor or a lawyer. Every claim about the law carries its source so you can go and read the original.
- 01
What is your clinic licence type?
Everything below is paced by this. It is set by the licence you hold, not your size, and each licence runs on its own date.
GP clinic
Records flowing to NEHR and the CS/DS measures in place by 1 September 2027. Grant applications opened on 1 July 2026 and close on 31 August 2027.
Specialist clinic
By 1 September 2028. Grant applications open on 1 August 2027 and close on 31 August 2028.
Dental clinic
By 1 March 2030. Grant applications open on 1 May 2029 and close on 28 February 2030.
Eleven other licence types run on their own dates: hospitals, laboratories, nuclear medicine and pharmacies among them. This page is written for the three above. If you hold one of the others, the guide sets them all out on page 3.
Implementation guide, p.3 and p.10
- 02
Are you on a clinic management system?
This comes first because the grant will not take your application until you have selected a certified system, and NEHR onboarding cannot start without one.
Yes, we use one
Look yours up: not every system on the market is certified. Certified means three things: NEHR connectivity certification, Cyber Essentials for HIMS or equivalent, and a Code of Practice for Data Portability declaration. If it is not there, ask your provider for their plan and their date in writing.
You are not stuck with them. That portability declaration puts migration clauses into your contract and obliges the vendor you leave to help you go, even where leaving puts you in breach of their contract. It does not make the move free: the code says nothing about price. And a code is not a statute, so a vendor who stalls goes through your contract’s dispute process first, with Synapxe as the escalation.
Check your system’s statusThe Code of Practice for Data Portability
No, not yet
Pick one before you apply for the grant. If you need help deciding, ask a fellow doctor which one they run and what they would not pick again.
Pen and paper
This is your biggest job. Paper cannot contribute to NEHR, and everything else here waits on you getting onto a certified system. The grant in step 03 pays for exactly that, adoption as well as upgrades.
Implementation guide, p.7 · Code of Practice for Data Portability, cl.5.2 and 9.1 · FAQ 3.3 and 3.5
- 03
Have you taken any of the following?
The GP IT Enablement Grant (GP ITE), the Nursing Home IT Enablement Programme (NHELP), or the Nursing Home IT Grant. Taking one of them rules you out of the NEHR Connect Grant, which is worth a fixed S$8,400 to a GP, specialist or dental clinic.
No earlier grant
You are eligible. Select your certified system first: the application will not take you without one. Submit before your own deadline, because anything after it is rejected. Full payout depends on meeting MOH’s data quality standard for a month.
Had an earlier one
GP IT Enablement, NHELP and the Nursing Home IT grant each rule you out of this one. The Early Contribution Incentive Grant is the exception: its recipients can still apply. The CS/DS funding in step 05 is separate and still open to you.
Not sure
Your practice manager or accountant will know which grants the clinic has taken. Worth ten minutes before you fill anything in.
Implementation guide, p.4, p.9 and p.10
- 04
Are you contributing to NEHR yet?
Onboarding takes up to five weeks and they are not five weeks you control, which makes this the item most likely to slip your date. Count backwards from your date.
Yes, already
Check the directory lists your institution, and check with your system provider that drug inventory mapping and deployment scheduling are finished.
No, not yet
Submit the participation request, then book the onboarding session. It is mandatory and takes 30 minutes. Your system provider handles the rest.
Not sure
Search the official directory for your institution. If your clinic is on Healthier SG you are almost certainly contributing already: joining it meant signing the NEHR accession agreement and getting onto a connected system.
Implementation guide, p.6 and p.7 · Healthier SG onboarding requirements, primarycarepages.sg
- 05
The CS/DS Essentials: do it yourself, or engage a consultant?
The Cybersecurity and Data Security Essentials are thirteen measures MOH expects of anyone holding health information. Most need an afternoon of somebody’s time and nothing you have to buy.
Doing it myself
You do not need to be technical, but you will be clicking through Windows settings screens and following walkthroughs. I built a free tool that asks about your clinic and writes the policy documents the Essentials ask for, with the page number beside every instruction. Windows only, and it assumes you are on a clinic system. If you buy a firewall or antivirus, PSG covers half the cost up to S$30,000.
Paying somebody
CSA subsidises up to 70% of a qualified consultant under CISO-as-a-Service. Across the fourteen providers approved for HIA, the same work for a clinic with five or fewer computers runs from S$1,050 to S$14,107 after subsidy. You can engage someone outside these fourteen; the only downside is no subsidy. Before you engage anyone, one piece of advice that applies to picking a CMS too: ask a fellow doctor for recommendations.
Nobody is making you hire anyone. MOH’s wording is that entities “can also consider” help “if necessary”, and the guide is written to be worked through without a consultant.
What CISOaaS is, from CSAThe fourteen providers and their prices
Not decided
Settle the system and the NEHR onboarding first. Those two have a queue in front of them and this does not. Then try the free tool before you spend anything: MOH’s FAQ says Windows Defender is enough for a solo practice.
Implementation guide, p.4 · CS/DS Essentials §1.8 · CS/DS FAQ v1.1, Q14 · CSA CISOaaS listing for HIA, 1 to 5 endpoints, after funding support
When this runs out
Where to go next
If you want the thirteen items one at a time, with what each one asks of a clinic your size and the page number beside it, that is The Rules, Decoded.
If you want MOH rather than me, the implementation support page is theirs and it is kept current by the people who wrote the rules: MOH’s own implementation support page.
This site is not MOH guidance and it carries no MOH endorsement. Everything on it is my own reading of MOH’s published documents, and I cite the page number for each instruction so you can check me.
I am not a doctor and I am not a lawyer. If something here contradicts what MOH publishes, MOH is right and I will fix my page.
Subscribe
One notice a week, roughly.
Whatever I write goes up here before it goes anywhere else. Mostly compliance and cybersecurity, sometimes what it is like running IT for an organisation that has never had any. Leave an email address and the next one comes to you.
Roughly weekly. I have nothing to sell, so there is no pitch waiting at the end of it. You get one email asking you to confirm, and nothing else until you do. The unsubscribe link sits at the bottom of every email. What happens to your address is written out on the privacy page.