Singapore's Health Information Act: NEHR contribution, access rules and penalties

The short answer

Singapore’s Health Information Bill was tabled for second reading on 12 January 2026 and has since passed as the Health Information Act (HIA).³ It requires all licensed healthcare providers to contribute key health information, such as allergies, diagnoses, medications, lab results and discharge summaries, to the National Electronic Health Record (NEHR); requires cybersecurity and data security safeguards; and prohibits NEHR access for insurance or employment purposes.¹ MOH says that from September 2027 the Act will progressively require licensed providers to contribute.³ Fines run up to SGD 1 million for providers that fail to put required security measures in place.²

From Bill to Act

MOH published the Bill’s aims when it went to second reading on 12 January 2026.¹ At the time, MOH said it intended the Bill to take effect from early 2027.²

In a speech on 6 May 2026, the Senior Minister of State said the Bill had been passed as the Health Information Act a few months earlier, and that “from September 2027, the HIA will progressively require all licensed health providers” to contribute key patient information to the NEHR.³ Between those two dates, MOH sent a circular to licensees, dated 6 March 2026, explaining what providers and professionals need to know.⁴

So the dates people see in older articles, “early 2027,” were the target at second reading. The later MOH statements give September 2027 for the progressive start of contribution. Check MOH’s HIA pages for the schedule that applies to your licence type.

What providers must contribute

MOH’s release lists the key information: allergy records, immunisation history, diagnoses, prescriptions, lab results, radiology images and discharge summaries.¹ The 6 March circular adds practical detail:⁴

• Contribution is prospective, once your system is connected to the NEHR. You don’t upload historical records.
• What you contribute depends on your licence type; the Act’s First Schedule lists the data types.
• You don’t upload detailed consultation and progress notes.
• You contribute for Singaporeans, permanent residents and long-term pass holders, not transient visitors.

The circular also says that using a clinic or hospital system that meets the Act’s requirements, plus reasonable safeguards, will be considered when deciding liability for lapses arising from that system.⁴ That makes the choice of software vendor part of the provider’s risk.

Who can use the NEHR, and for what

The access rules are narrow.⁴

MOH’s release says access to NEHR for employment or insurance purposes is prohibited, except for a specified list of medical examinations required or permitted under written law.¹ Unauthorised access for those purposes carries doubled penalties, below.

Patient controls and access logs

Patients get three controls, according to MOH.¹

• Access logs. Patients can see who accessed their NEHR information through the HealthHub app and report unauthorised access to MOH. The circular says the logs show which service providers accessed the record.⁴
• Access restrictions. Patients can limit access to selected providers; allergy and vaccination information stays visible to all providers for safety.¹
• Break glass. In an emergency a doctor can override restrictions, and the circular says such access will be audited.⁴

Patient-visible access logs change the incentives. If a patient can see that a clinic they never visited opened their record, the clinic will be asked why.

Security duties and breaches

Providers that contribute to or access the NEHR must meet cybersecurity and data security requirements and put technical and organisational safeguards in place for storing, accessing, using and sharing health information.¹ They must notify MOH of confirmed cybersecurity incidents and data breaches in a timely manner.¹

MOH hasn’t published a specific notification deadline in the documents we read. The second reading speech said MOH must be notified once an incident is confirmed, and affected individuals must be told where a breach is likely to cause significant harm.² Treat this as an open item and watch for subsidiary legislation.

Penalties

From the second reading speech:²

MOH described these as maximums, with composition, directions and warnings as other enforcement options. Failing to contribute is not itself an offence at first; directions come first for deliberate or reckless non-contribution.²

What this means for health software and AI

The HIA doesn’t regulate AI directly, but its rules apply to any software that reads or writes NEHR data or the clinic systems that feed it.

• Purpose limits apply to tools. An AI tool running in a clinic may only use NEHR data for that clinic’s patient care. Using it for model training, audits or analytics falls outside the permitted uses the circular lists.⁴
• Administrative roles don’t get access. An automated assistant doing scheduling or billing has no reason to open NEHR records.⁴
• Your logs will meet the patient’s logs. HealthHub shows patients who accessed their record.⁴ Your own records should be able to explain each access, including any made by software on a clinician’s behalf.
• Vendor choice is part of liability. The circular ties liability partly to using a system that meets the Act’s requirements, with reasonable safeguards.⁴

For comparison with other national exchanges, see our posts on TEFCA and NABIDH in Dubai. For Singapore’s AI rules, read our AIHGle 2.0 post. Our healthcare page shows how agent actions get recorded.

A checklist for providers and vendors

1. Find your licence type in the Act’s First Schedule and list the data types you must contribute.⁴
2. Confirm your clinic system can connect to the NEHR, or ask your vendor for its plan.⁴
3. Limit NEHR access to authorised clinicians treating the patient; remove administrative users.⁴
4. Write down how your staff, and any software acting for them, may use NEHR data, and keep insurance and employment uses out.¹
5. Put cybersecurity and data security safeguards in place and test them before contribution starts.¹
6. Prepare an incident process that notifies MOH once an incident is confirmed.²
7. Make sure your own access records can explain every access a patient might see in HealthHub.⁴

Questions people ask

Has the Health Information Bill passed?

Yes. MOH said in May 2026 that it was passed as the Health Information Act.³

Can insurers see NEHR records?

No. NEHR access for insurance or employment purposes is prohibited, except for listed statutory medical examinations.¹

When must clinics start contributing?

MOH says the Act will progressively require contribution from September 2027.³ Check MOH’s HIA site for your licence type.

This post summarises MOH’s published documents and is not legal advice. To see agent actions recorded with approvals in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.