HIA Cybersecurity Requirements: The 13 Measures Singapore Clinics Need to Know

The Health Information Act (HIA) does more than require clinics to share records with NEHR. It also sets a security baseline for every licensed healthcare provider in Singapore. In March 2026, the Ministry of Health (MOH) published the Cybersecurity and Data Security (CS/DS) Essentials, a short guide that spells out the HIA cybersecurity requirements your clinic should meet.

This guide turns MOH’s 16-page document into plain language: who it applies to, the 13 measures, the incident reporting rule, and a practical checklist you can start on this week.

Who Do the HIA Cybersecurity Requirements Apply To?

According to MOH’s CS/DS Essentials, the requirements apply to all licensees under the Healthcare Services Act, all contributors and users of the National Electronic Health Record (NEHR), and other prescribed entities that share health information under the Act. In practice, that includes GP clinics, specialist clinics, dental clinics, and laboratories of any size. MOH has also said it is developing a guidebook, templates, and self-help resources through 2026 to help providers meet the measures.

The 13 HIA Cybersecurity Requirements at a Glance

MOH groups the measures into three areas.

A. Cybersecurity (IT and software measures)

• 1. Updates: install software updates on devices and systems promptly
• 2. Secure and protect: use anti-malware, control access to data and services, and use secure settings on hardware and software
• 3. Backup: back up essential data and store the backups separately
• 4. Asset: keep an inventory of the hardware and software you use, and secure it

B. Data security (data-related practices)

• 5. Secure: know what data you hold and where, copy health information only when necessary, and transfer it carefully
• 6. Identify: mark or clearly define which information is health information
• 7. Access: restrict access to health information to valid and relevant purposes

These data measures cover paper as well as digital records, so locked cabinets and secure storage count.

C. Common practices (people, vendors, and planning)

• 8. Training and education: staff should attend security awareness training periodically, ideally at least once a year
• 9. Outsourcing and vendor management: understand who is responsible for what
• 10. Security reviews and internal audit: check regularly that policies are followed
• 11. Disposal: securely destroy health information before disposing of hardware or data
• 12. Emergency planning: keep a business continuity plan
• 13. Incident response: have a plan to detect, respond to, and recover from incidents

Access Control: Where Many Clinics Fall Short

The access rules are specific, and they are where small clinics most often have gaps. MOH expects each staff member to have a unique account, with shared, duplicate, or dormant accounts removed. It gives an example of removing accounts inactive for more than 60 days. Default passwords should be replaced with strong passphrases of at least 12 characters, and two-factor authentication should protect administrative access to important systems. Accounts should lock after repeated failed logins, with 10 given as an example, and access should be granted and revoked only with proper approval.

The 2-Hour Incident Reporting Rule

The measure that surprises most clinics is the speed of reporting. Under the HIA, once you assess that a cybersecurity incident or data breach meets the reporting threshold, you must send an initial notification to MOH within 2 hours. A full incident report is due within 14 days of that notification. If the incident causes or is likely to cause significant harm to an individual, the affected people must also be notified.

For data breaches, MOH aligns the threshold with the PDPA: a breach is notifiable if it results in, or is likely to result in, significant harm to an individual, or if it is of significant scale, meaning 500 or more people. A clear internal plan on who decides, who calls, and who writes the report will save precious time.

What Your CMS Vendor Covers and What It Does Not

MOH worked with health information management system (HIMS) vendors, such as clinic management system providers, to build some controls into their products: timely software updates, two-factor authentication for changing system configurations, security configurations, and protection of backup data. Vendors that do so are Cyber Essentials certified. MOH is clear that other systems holding health information, such as hardware and billing applications, also need the same measures.

So a certified CMS helps, but it does not make the clinic compliant on its own. Staff training, workstation updates, backups outside the system, vendor contracts, and an incident response plan remain your responsibility. When choosing a system, MOH also asks you to understand where your health information is stored and what certifications your vendor holds.

A 10-Point Checklist to Start This Week

• List every device and software application that touches patient data
• Remove shared, dormant, and former-staff accounts
• Turn on automatic updates and anti-malware on every workstation
• Replace default and weak passwords with passphrases of 12 characters or more
• Back up essential data and keep a copy separate from the clinic network
• Lock up paper records and portable devices
• Schedule annual security training for all staff
• Review your contracts with IT and software vendors
• Write a one-page incident response plan with the 2-hour rule on top
• Agree a safe process for disposing of old computers and records

How Vanda Supports HIA Cybersecurity Requirements

Vanda holds ISO/IEC 27001 certification and the CSA Cyber Essentials Mark. Within the system, role-based access control lets management assign permissions by role, and a whitelist feature sends an alert for approval when an account logs in from a new, unrecognised computer. These tools support the access measures above, although your clinic still needs its own policies and training. For the data-sharing side of the Act, see our guide to the HIA’s impact on healthcare data systems, and for what to look for in a system, read our clinic management system guide.

Conclusion

The HIA cybersecurity requirements are designed to be achievable for small providers, and most of them are habits rather than hardware. Start with accounts, updates, and backups, then build out training and your incident plan. Check MOH’s implementation timelines for your category of provider, and use the resources MOH releases through 2026 to fill the gaps.