Health Information Act: cybersecurity and data security essentials
The Health Information Act (HIA) sets cyber and data security rules for licensed healthcare providers in Singapore. The Ministry of Health (MOH) has published Cybersecurity and Data Security (CS/DS) Essentials that explain what to put in place. We check your clinic against them, fix the gaps with you and keep the records that show you comply.
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Regulators“Has this licensee put the required cyber and data security measures in place by its batch deadline?”The provider has put in place the CS/DS measures MOH requires of HIA entities.MOH, read 12 Oct 2026
- Management“If we have an incident, can we report it to MOH within 2 hours?”Incident reporting and response meet the CS/DS Essentials timeline.MOH, read 12 Oct 2026
- Employees“What am I expected to do day to day with patient records?”Staff training and access rules are covered: both are CS/DS domains.MOH, read 12 Oct 2026
- Partners and multinational clients“Is the clinic system we supply, or depend on, up to standard?”HIA-compliant clinic systems must hold the Cyber Essentials mark, and some measures rely on such a system.MOH, read 12 Oct 2026
- Competitors“Can you prove compliance, not just claim it?”Providers can be independently certified through the Cyber Security Agency’s Cyber Essentials mark for HIA entities.CSA, read 12 Oct 2026
MOH’s enforcement options under the Health Information Act include directions, letters of warning, composition notices and prosecution.
MOH, read 12 Oct 2026Who it is for
Clinics, dental practices, medical centres and other providers licensed under the Healthcare Services Act, and contributors to and users of the National Electronic Health Record. Practice managers and IT vendors get a clear list of controls and evidence.
Who does what
- You
You name a project lead, list your systems and vendors, and adopt the agreed fixes.
- Us: we prepare you
We prepare you: gap check against the CS/DS Essentials, fix plan, policies, incident plan and evidence pack.
- Independent body: audits and certifies
An independent assessor audits your controls for the Cyber Essentials mark and, if you meet it, certifies you.
What you get
Deliverables mapped to what the assessor tests.
- A gap report against the 13 CS/DS Essentials domains
- Measures put in place, sized to your clinic or practice
- An incident plan that meets the 2-hour first report to the Ministry of Health
- Evidence mapped to each measure, ready for review
What drives the time and the effort
- How many clinics, staff and devices are in scope
- Your clinic system and other systems holding patient data
- How many vendors can reach patient records
- What policies, backups and incident plans already exist
- The assessor’s audit fee for the Cyber Essentials mark
S$750,000 and S$250,000 in penalties followed one Singapore healthcare data breach. PDPC, Jan 2019.
Common questions
Who must comply with the Health Information Act?
Providers licensed under the Healthcare Services Act, contributors to and users of the National Electronic Health Record, and other entities MOH prescribes. If you run a licensed clinic or dental practice, expect the Act to apply to you.
When do the HIA rules apply?
MOH is rolling the Act out in stages through early 2027. Starting now gives you time to fix gaps in order, rather than all at once.
How does the HIA relate to the PDPA?
The Personal Data Protection Act (PDPA), enforced by the Personal Data Protection Commission (PDPC), still applies to patient data. The HIA adds health-specific cyber and data security rules. One programme can cover both, and we often pair the work with a named data protection officer.
What does HIA readiness cost?
The fee follows the scope: clinics, staff, devices, systems and vendors, and what already exists. You get a fixed-fee proposal after a short scoping call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2025-07-03 · Healthcare · Voluntary undertaking
An outsourced developer's misconfigured open port exposed a database with no login of its own; check vendor configurations and protect databases with credentials.
Read the PDPC decision of 3 July 2025, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)