New Health Information Bill Creates a National Database of Medical Records

In a landmark move towards a digitally integrated healthcare system, Singapore’s Ministry of Health is introducing the Health Information Bill, set to be tabled in Parliament later this year. This legislation aims to mandate the contribution of key patient health data into a centralised digital system, and introduces robust legal, privacy, and cybersecurity safeguards to support this transition.

This article will cover the following topics:

• What is the Health Information Bill?
• What are the key legal aspects/mechanics of the Bill?
• What are the impacts (both the positive and negative) on key stakeholders (patients, healthcare providers, government/regulators, employers/insurers) as a result of the Bill?

What is the Health Information Bill?

As Singapore’s population ages and healthcare needs grow more complex, patients increasingly rely on multiple providers across different institutions. Currently, however, key health information is fragmented across separate systems, hindering seamless patient care. This led to the establishment of the National Electronic Health Record (NEHR) in 2011 to centralise health records across public and private providers.

However, as participation by private providers is voluntary, only 15% of private providers contribute to the NEHR as of October 2023. Thus, health data in the NEHR remains incomplete. To resolve this, the Health Information Bill (HIB) was proposed to make data contribution to the NEHR mandatory for all licensed healthcare providers, with the aim of ensuring that we have a comprehensive, up-to-date, and accessible health record system for better coordinated care. This represents a significant shift towards integrated, secure digital healthcare in Singapore.

The Bill aims to achieve the following three main objectives:

1. Ensure that health information is kept updated, accurate and accessible. This will be done by mandating healthcare providers to contribute key patient health data into a centralised digital system, the National Electronic Health Record (NEHR).
2. Establish a robust framework for the sharing of health information between healthcare providers, to ensure continuity in patients’ care, even if they switch healthcare providers.
3. Set out basic data security and cybersecurity requirements that healthcare providers must comply with to protect such health information.

The Ministry of Health (MOH) will have oversight of the Bill and its enforcement.

What are the Key Legal Aspects/Mechanics of the Health Information Bill?

This section will discuss the key legal aspects of the Bill.

Mandatory Contribution

All licensed healthcare providers under the Healthcare Services Act (HCSA) as well as MOH-approved care providers, must contribute designated key health information to the NEHR:

• Licensed healthcare providers: You may refer to the Healthcare Directory on the Health Hub website to access the list of licensed healthcare providers. Examples of such healthcare providers include hospitals, clinics and labs.
• MOH-approved care providers: MOH-approved care providers are organisations, other than the licensed healthcare providers, which provide some form of patient care. They would thus be expected to also generate data which would be useful to store in the NEHR. Examples of such MOH-approved care providers are retail pharmacies.

Health information can generally be separated into the following two categories:

• Administrative data: This includes patients’ personal information such as their name, address, contact details, as well as other demographic data (e.g. age, gender, ethnicity, income, education level, occupation).
• Clinical data: This refers to all information about or in relation to patients’ physical and mental health, or the diagnosis, care and treatment of the patients. This includes information such as prescriptions, investigation reports, procedures and discharge summaries.

When patients visit a licensed healthcare provider or approved care provider, their health information will first be recorded in the healthcare / care providers’ internal health record system. This will continue to remain unchanged. Where the Bill comes in is that it makes it mandatory for the licensed healthcare provider or approved care provider to contribute a selected subset of the health information gathered from patients to the NEHR. This subset of health information encompasses both administrative and clinical data, and includes information such as:

• Patient demographics (e.g. name, address, contact details)
• Allergies and adverse drug reactions
• Medication history
• Medical diagnosis
• Admissions and visit history (e.g. admission to a hospital, GP visit)
• History of surgeries or procedures (including operating theatre notes / procedures / treatments)
• Investigation reports (e.g. laboratory test results like blood tests, radiological investigation reports like X-Ray reports)
• Discharge summaries

These represent the minimum set of information that healthcare professionals would generally need to know about their patients’ health in order to deliver care to them. There will be more detailed information in the licensed healthcare providers’ records that will not need to be contributed to the NEHR, as such detail would make the NEHR difficult to navigate, and is not necessary to ensure consistency of care. Such information includes day-to-day progress and clinical notes that may be maintained by the licensed healthcare provider.

Regulated access framework

Generally, only care providers (including HCSA licensed healthcare providers and MOH-approved care providers) may access the NEHR. Additionally, care providers may only access the NEHR if they are directly caring for the patient, and if the information contained in the NEHR is relevant for patient care.

For example, if a patient visits a clinic claiming that a previous ailment has relapsed, the clinic may then access the NEHR to obtain the patient’s previous admissions and visit history, medical diagnosis, medication, discharge summaries etc., to get a better picture of the patient’s medical and treatment history. This would ultimately result in better patient care.

Using another example of a retail pharmacist, if a patient comes looking for a certain medication, the pharmacist may access the NEHR to obtain the patient’s medication and allergy records to flag any potentially unsafe drug interactions between the medications that the patient is already consuming, and the medication that the patient is intending to purchase.

Conversely, the care provider cannot access the NEHR for a person’s health information if they are not directly caring for the patient. For example, a doctor cannot access the NEHR data of their family member, even if the family member has requested the doctor to do so. The family member is not registered as a patient under the doctor’s care. Using another example, if a doctor is asked by a colleague to provide an informal opinion on a patient, the doctor should also not access that patient’s information on the NEHR, as that doctor does not have a care relationship with that patient.

Enhanced safeguards for Sensitive Health Information

There is a category of health information known as Sensitive Health Information (SHI), which will be subject to enhanced safeguards to prevent unauthorised access and use. SHI refers to health information that could lead to severe, long-lasting stigmatisation or discrimination. Examples of SHI include:

• Sexually transmitted infections, HIV Infection
• Mental disorders (e.g. schizophrenia)
• Substance abuse and addictions (e.g. drug addiction, alcoholism)
• Biological parenthood (e.g. sperm donor, sperm recipient, egg donor, egg recipient)
• Voluntary sterilisation and termination of pregnancy (e.g. contraception operation, abortion information)
• Organ donation (e.g. identity of donor, identity of organ receiver)
• Suicide (e.g. attempted suicide)
• Abuse (e.g. domestic abuse, child abuse or sexual abuse)

It is still mandatory for care providers to contribute patients’ SHI to the NEHR. However, there will be additional safeguards in place to protect the patients’ privacy, including:

• Only authorised healthcare professionals are allowed to access SHI, as they may require this information to make proper decisions regarding the patient’s treatment. Such authorised healthcare professionals include doctors, selected nurses and pharmacists.
• All authorised healthcare professionals are required to respect the confidentiality of their patients and are expected to safeguard SHI, by complying with the cybersecurity and data security requirements discussed below.
• Authorised healthcare professionals can still only access SHI of patients that they are providing care for, and if the SHI is relevant for patient care.
• Lastly, SHI in the NEHR is protected by a “double login” feature. This means that the authorised healthcare professionals are required to re-login when accessing SHI and provide reasons for access before the SHI is shown to them. All instances of access are also monitored.

Patient autonomy (to a degree) and access restrictions

While patients cannot restrict their own health information from being contributed to the NEHR to prevent any gaps in their records, they can exercise some degree of control over their health information in the NEHR, by choosing to restrict all healthcare providers from accessing their NEHR data. If a patient chooses to do so, no one will be allowed to access his/her information within the NEHR, not even his/her own attending doctor.

Even with access restrictions in place, the Bill allows for such restrictions to be overridden in cases of medical emergencies, provided the following requirements are met:

• The patient must be assessed by a doctor to be at risk of immediate and significant harm unless medical intervention is given; and
• The patient is unable to provide consent (e.g. he/she is comatose) or give consent for the care provider to access his/her NEHR data for the purpose of the medical emergency (e.g. the patient is awake but is not in a right mental state to answer the doctor’s questions). Conversely, if a patient is capable of providing consent, the healthcare professional should ask the patient for consent to access his/her NEHR data. If the patient continues to refuse, the access restrictions cannot be overridden.

However, do note that imposing access restrictions on your NEHR data may hinder your care. For example, you may have to repeat laboratory or radiological tests even though you have done them before, and you would also have to repeat essential information, such as allergies and other medical history, every time you meet a healthcare professional.

Additionally, in cases of medical emergencies, where you are capable of providing consent for the healthcare professional to access your NEHR data, but refuse to do so, you are presumed to have considered the risk of not enabling access to your NEHR data, including if the consequence may be life or death. For example, if you have sustained severe injuries in an accident, and refuse to grant access to your NEHR data despite your severe injuries, you will be assumed to have taken the risk of not granting the healthcare professional access to your NEHR data, including the risk that your refusal to grant access may result in death.

Data sharing beyond the NEHR

Under the Bill, patients’ health information contained in systems other than the NEHR (e.g. in the healthcare / care providers’ internal systems) can be shared for three purposes:

1. Outreach under national health initiatives (e.g. Healthier SG). For example, with Healthier SG, the various community partners (e.g. SportSG, Active Ageing Centres) oversee various community care services and run a range of community programmes and healthy lifestyle activities. Data sharing beyond the NEHR allows healthcare providers to share information with such community partners so that they can reach out to patients and assist them with basic care needs.
2. To support continuity of care (e.g. telecollaboration, where healthcare professionals communicate with each other and coordinate patient care remotely). For example, where a patient moves house and decides to switch from one general practitioner to another, the two general practitioners may communicate remotely to share the patient’s contact information and relevant clinical information, to ensure continuity of care despite the switch.
3. For assessment of eligibility for healthcare financing schemes.

Cybersecurity, data security & incident reporting

In order to deal with concerns over the security of the healthcare information contained in or outside of the NEHR, the Bill also puts in place cybersecurity and data security safeguards.

All entities under the Bill (including healthcare providers contributing to or accessing the NEHR, and care providers participating in data sharing beyond the NEHR i.e. HIB entities) will have to abide by a unified set of cybersecurity and data security requirements to protect such information.

The Cyber & Data Security Guidelines for Healthcare Providers (Guidelines) was developed by MOH in consultation with the Cyber Security Agency of Singapore (CSA), Infocomm Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC). The Guidelines were issued in December 2023, and can be accessed here.

Some examples of the obligations that HIB entities must fulfil under the Guidelines are to:

• Cybersecurity
  • Install software updates on their devices and systems promptly
  • Use anti-malware and anti-virus solutions to protect against malicious software
  • Implement access control measures to control access to their data and services
  • Back up essential data and store them offline
  • Equip staff with cyber-hygiene practices as the first line of defence
• Data Security
  • Store health information securely to prevent unauthorised access
  • Do not reproduce copies of sensitive health information unless necessary
  • Differentiate data of varying information sensitivity levels by marking their classification
  • Restrict access to health information for valid and relevant purposes
• Both Cybersecurity and Data Security
  • Understand the responsibilities set between the organisation and the vendor
  • Be prepared to detect, respond, and recover from incidents
  • Conduct regular checks on corporate policies and processes to ensure compliance and identify vulnerabilities

Obligations on data intermediaries

The Bill also imposes obligations on data intermediaries. These refer to organisations that process health information on behalf of HIB entities for the purposes of the patients’ care. They include Content Management System vendors, IT service vendors and data analytics platforms engaged to process health information. These obligations include:

• Protecting health information from unauthorised access or disclosure
• Disposing of information that is no longer needed
• Ensuring data portability standards
• Informing the HIB entity of any cybersecurity incident or data breach immediately and without undue delay

Reporting thresholds and requirements

Under the Bill, there are certain reporting thresholds and requirements that the HIB entities must abide by. Where there is a data breach (e.g. any unauthorised access to a device storing health information), which results in significant harm to the affected individuals (e.g. the device contained SHI), or is likely to be of a significant scale (i.e. impact at least 500 individuals), the affected HIB entity must notify MOH within 2 hours. The affected individuals must also be notified at the same time. Affected HIB entities must also comply with the same reporting requirements when their computer systems containing health information fall victim to cybersecurity incidents (e.g. any unauthorised hacking of a computer system to gain access to or control).

Enforcement and penalties

The Bill equips MOH with powers to issue directions for entities to rectify non-compliances, which include directing entities to:

• Stop unauthorised access to health information on the NEHR
• Destroy all health information accessed in an authorised manner
• Stop further unauthorised sharing of health information
• Comply with cyber and data security requirements.

The Bill will also impose penalties for non-compliance with the requirements under the Bill. For severe non-compliances by entities, such entities may be liable for a maximum fine of S$1 million, or 10% of their annual turnover, whichever is higher.

Apart from penalties for the HIB entities, healthcare professionals who handle or have access to health information may also be held personally accountable for mishandling of or unauthorised access to such information. Under the Bill, it would also be an offence for healthcare professionals to:

• Disclose health information without authorisation
• Use health information to obtain a gain or cause harm to another person, without authorisation
• Improperly handling of anonymised health information, such that the health information can be re-identified (i.e. others will be able to identify who the health information belongs to)

What are the Impacts (Both the Positive and Negative Implications) on Key Stakeholders as a Result of the Bill?

The Bill will undoubtedly have implications on various key stakeholders, including patients, healthcare providers, the government and regulators, and insurers and employers.

Patients

For patients, who are a key stakeholder group that the Bill was intended to benefit, the Bill will bring about benefits such as:

• More seamless care between different healthcare providers
• Removal of the need for repetitive investigations or having to repeat their medical history to various healthcare providers
• Having better-informed healthcare providers, which will ultimately result in better clinic decisions for their benefit

On the flipside, the Bill may increase the risk of potential loss of privacy for patients, as their health information will be stored in a central database, and their data can be accessed or even shared. To minimise this risk, the Bill also introduces safeguards in parallel to prevent the loss of privacy, such as requiring HIB entities to comply with cyber and data security requirements.

Patients also ultimately have the choice of whether to opt for access restrictions, in which case no one will be allowed to access their information within the NEHR without their consent.

Healthcare providers

For healthcare providers, the Bill provides legal clarity, as it sets out clearer rules on what data must be contributed and shared, and under what circumstances data can be accessed. The Bill also sets out clearer authorisation structures for the access and use of healthcare information. This protects healthcare providers from unwarranted claims that they have accessed or used healthcare information without authorisation.

On the other hand, healthcare providers may be concerned about the increased administrative and technical workload since it will be mandatory to contribute patients’ health information to the NEHR. However, the impact of this can be avoided by using a NEHR-compatible system. That said, having to comply with the cyber and data security requirements may also add to this increased workload. For example, healthcare providers would need to ensure that they have compliant IT systems, cybersecurity frameworks, and staff training.

Government and regulators

For the government and regulators, the centralisation of health information, and mandatory participation by all healthcare providers (whether public or private), provides opportunities for:

More reliable, comprehensive health data for planning, policy formulation (e.g. predicting disease trends, allocating resources)

Better enablement of other digital health initiatives (AI, population health, telehealth, etc.)

However, in order to balance this with patients’ rights and privacy protection, the government and regulators must rigorously monitor and enforce compliance with the Bill, which may take up additional time and costs.

Insurers and employers

Lastly, under the Bill, insurers and employers are not given access to the NEHR. Access to the NEHR is intended for direct patient care purposes. Hence, insurers and employers cannot access the NEHR to obtain information to assess an individual’s suitability for employment or insurance. This prohibition applies even if the patient him/herself consents.

The rationale behind this prohibition is to ensure that a patient’s medical history is not used to discriminate against the employability/insurability of the patient, and that patients are not pressured into giving consent for such purposes. Under the Bill, it will be an offence for healthcare providers engaged by insurers and employers to access the NEHR for the above purpose, and upon conviction, such healthcare providers may be liable to a fine, imprisonment, or both.

Specific to employers, the Workplace Fairness Act prohibits employers from discrimination against employees based on various stipulated protected characteristics. These protected characteristics include an employee’s sex, pregnancy, disability or mental health conditions. Information touching on these protected characteristics may be contributed to the NEHR, which reinforces the prohibition against employers accessing such data. Such information may include records of sex-reassignment surgery, presence of any disabilities/mental health conditions, and pregnancy-related conditions. For more information on the workplace discrimination laws in Singapore, you can refer to our other article on the FAQs on Singapore’s New Workplace Fairness Act.

—

The Bill represents a major step toward consolidating and modernising how medical records are handled in Singapore. By making contributions to the NEHR mandatory, clarifying who can access what, introducing strong cyber and data security requirements and reporting rules, and protecting patients’ autonomy, the Bill promises smoother, safer, more efficient healthcare for all.

However, these benefits do not come without trade‑offs. Patients will need to understand their rights (especially around restricting access and what that means). Providers will need to invest in systems and processes. Regulators will also need to stay vigilant to enforce the standards and penalties.