Patient Consent for Insurers: What MOH Circular 02/2026 Means for Singapore Clinics

Every Singapore clinic gets requests from insurers: a diagnosis to confirm, a claim to verify, a medical history for underwriting. In January 2026, the Ministry of Health (MOH) set out what clinics must do before answering them. At the centre of that guidance is patient consent for insurers: the patient must be told why their information is being shared, must agree, and that consent must be recorded.

This article summarises MOH Circular No. 02/2026 in plain language and turns it into five steps your clinic can put into practice.

What Does MOH Circular 02/2026 Say?

The circular, titled “Guidance on Disclosure of Patient Medical Records to Insurers”, went to all licensees under the Healthcare Services Act and to registered medical and dental practitioners. It reminds clinics that they must keep every patient health record confidential and protect it from unauthorised access, disclosure, copying, or use. It then sets out key practices for dealing with insurers, which cover consent, relevance, separate reports, and the limits on accessing the National Electronic Health Record (NEHR).

5 Steps for Handling Patient Consent for Insurers

1. Notify the patient and get consent for the specific purpose

The circular says the patient must be notified of the purpose of the disclosure and must have given consent for it. Consent can come through a Medical Claims Authorisation Form (MCAF) with the relevant clauses signed by the patient, or through the relevant policy forms. Check that the consent actually covers the request in front of you.

2. Document the consent in the medical record

MOH is explicit that consent should be properly documented in the patient’s medical records. A signed form sitting in a drawer is not enough. Store the consent, or a clear note of it, in the patient file where any authorised staff member can find it later.

3. Share only what is relevant and necessary

Doctors are expected to use professional judgement. Information that is irrelevant to the claim or underwriting assessment must not be disclosed, even if the patient’s consent was broad. This protects patients and the clinic.

4. Prepare a separate report instead of sending raw records

MOH asks clinics to prepare separate medical reports, memos, or clinical summaries for insurers rather than handing over raw records. Raw records in an electronic medical record system contain relevant and irrelevant details side by side. The circular says insurers should not be given access to raw records, even where a contract grants an “inspect and audit” right. In exceptional cases, a redacted copy containing only information relevant to the claim may be provided.

5. Never use NEHR for insurance purposes

The circular states that access to NEHR is allowed only for clinical care and is not allowed for insurance purposes under any circumstances. Insurers have no access to NEHR and cannot ask clinics to access it for them. Accessing NEHR to prepare a report for insurance purposes is an offence under the Health Information Bill, which was still a bill when the circular was issued. For existing patients, use your own medical records. For new patients, rely on what the patient tells you and what you find during the current consultation.

Where Clinics Get Into Trouble

The risks are mostly practical, not malicious. Front-desk staff forward a full record to be helpful. A consent form is signed but never filed. A doctor checks NEHR out of habit while preparing an insurance report. Each of these can put the clinic on the wrong side of the guidance, and each is easier to prevent with a clear process and the right system settings.

How Your Clinic Management System Can Help

A clinic management system will not decide what to disclose, but it can make the right behaviour easier:

• Role-based access. Limit who can open, export, or print patient records. Vanda’s role-based access control lets management create roles and assign particular permissions to each.
• Login protection. Vanda’s whitelist feature sends an alert for access approval when an account logs in from a new, unrecognised computer, which helps reduce the risk of unauthorised access.
• One place for records and billing. When consultations, billing, and claims sit in one system, it is easier to keep consent notes and insurer correspondence attached to the right patient. See our overview of what a clinic management system does.
• Clean separation from NEHR. Clarify with your vendor and staff how NEHR integration is used, so clinical access stays clinical.

A Quick Clinic Checklist

• A standard consent form or MCAF process for insurer requests
• A habit of recording consent in the patient file every time
• A template for short clinical summaries and medical reports
• A staff rule: never send raw records and never use NEHR for insurance reports
• Role-based access set up for who can export or print records

If an insurer applies inappropriate or unreasonable pressure to access or disclose irrelevant records, the circular encourages clinics to report it to MOH at HCSA_Enquiries@moh.gov.sg.

Conclusion

Patient consent for insurers is now a clear, documented step in every disclosure, not an informal courtesy. Get consent for the specific purpose, record it, share only what is relevant, send a separate report, and keep NEHR out of insurance work. Review the circular directly with your clinic’s medical director and compliance lead, since this article is a summary, not legal advice.