New Health Information Bill strengthens coordinated care while raising privacy and cybersecurity concerns
Singapore has taken a decisive step toward integrated healthcare by passing a landmark law that mandates nationwide sharing of patient health records, signaling a major shift in how medical data supports long-term care and public health planning.
A Unified Health Data System Takes Shape
Parliament passed the Health Information Bill on Jan 12, requiring all licensed healthcare providers to contribute patient data to the National Electronic Health Record system from early next year. The system, introduced in 2011, will now include mandatory participation across public and private providers. Information shared will include allergies, vaccinations, diagnoses, medications, lab results, radiology images, and discharge summaries for Singaporeans, permanent residents, and long-term pass holders.
Closing Gaps in Patient Care
Senior Minister of State for Health Tan Kiat How described the current fragmented system as inadequate, noting that patient records often fail to follow individuals as they move between providers. According to the Ministry of Health, this gap increases risks such as medication errors, duplicated tests, and delayed treatment. Mandatory data sharing aims to support Singapore’s transition from hospital-centric care to a stronger community-based healthcare model.
Who Can Access the Data and Why
Access to NEHR data is limited primarily to patient care. Doctors, nurses, pharmacists, and allied health professionals involved in a patient’s treatment may view records. Identifiable data may also be used for public health purposes, such as responding to drug contamination incidents, while anonymised data can support research and cost-effectiveness reviews. Use of health data for employment or insurance purposes is strictly prohibited, except where explicitly required by law.
Patient Control and Emergency Overrides
Patients will be able to track which providers access their records through HealthHub and flag unauthorized access. An access restriction feature will be rolled out in the second half of this year, allowing patients to limit who can view their records. However, critical information such as allergies and vaccination history will remain accessible to reduce medical risks. In emergencies, restrictions may be overridden under strict controls.
Safeguards, Penalties, and Cybersecurity
Healthcare providers must implement strong data protection measures and report confirmed cybersecurity incidents to MOH. Penalties for non-compliance range from fines of S$20,000 and one year in jail to S$50,000 and two years in jail for unauthorized access. Severe or repeated breaches may result in fines of up to S$1 million. MOH stated that training programs and funding support will be provided, particularly for smaller clinics facing implementation challenges.
Privacy Concerns and Lessons from the Past
Members of Parliament raised concerns about sensitive data, particularly mental health and reproductive health records. Questions were also raised about potential insurance loopholes and trust issues following the 2018 SingHealth data breach, which affected 1.5 million patients. MOH emphasized that the NEHR now undergoes regular security audits, penetration testing, and monitoring, incorporating lessons learned from the breach to rebuild public trust.
The Health Information Bill marks a significant evolution in Singapore’s healthcare system, balancing improved care coordination with heightened responsibility for data protection. Its success will depend on sustained trust, robust cybersecurity, and meaningful support for providers. For Indonesians and Singaporeans alike, the move reflects a broader regional shift toward digital health systems that prioritize continuity of care while safeguarding patient rights.
Sources: Channel News Asia (2026)
Keywords: Health Information Bill, National Electronic Health Record, Patient Privacy, Cybersecurity, Ministry Of Health
