IT support for clinics in Singapore

A clinic's IT has to do two jobs at once: keep the practice running, and look after patient information. Reception, the consultation room and the billing desk all depend on the clinic system, the network and the backup. The same environment holds health information, which is already protected by the Personal Data Protection Act, and which the Health Information Act addresses more specifically.

Calling someone only after something in the practice has already failed is not enough. Evernet provides IT support for Singapore clinics as a managed IT service: a service desk and on-site work set around clinic hours, with a clear view of who is responsible for accounts, backups, updates and the first call when something goes wrong. It builds on the service described on our IT support page.

Evernet is Singapore-headquartered, and ISO 27001 and ISO 9001 certified. We do not certify clinics under the Health Information Act. The clinic remains responsible for its own legal duties. Our job is to help you put the practical IT controls in place and to be a named technical contact during our service hours.

The PDPA applies to organisations in Singapore that collect, use or disclose personal data, including small businesses. That is the Personal Data Protection Commission's position, not a size exemption you can assume away. (Source: PDPC, "Kickstart Your Data Protection Journey", page opened 11 Nov 2026.)

Under the PDPA's Protection Obligation, you have to make reasonable security arrangements to protect personal data in your possession, so as to prevent unauthorised access, collection, use, disclosure or similar risks. (Source: PDPC, Data Protection Obligations, page opened 11 Nov 2026.) Using a clinic management system or a cloud vendor does not hand that duty over. The PDPC's guidance is that your organisation remains accountable for the data protection obligations even when you use a cloud provider or other third-party service, and that the provider is treated as a data intermediary. A data intermediary must still make reasonable security arrangements and comply with the retention rules, and must notify your organisation without undue delay if it has reason to believe a data breach has occurred. (Source: PDPC, "Kickstart Your Data Protection Journey".)

Every organisation that handles personal data must appoint at least one Data Protection Officer. The DPO can be an employee or an external service provider. (Source: same PDPC page.)

If a data breach is notifiable, the PDPA requires you to notify the PDPC as soon as practicable, and in any case no later than three calendar days after the day you assess that the breach is notifiable. A breach is notifiable to the PDPC if it is likely to result in significant harm to individuals, or if it affects 500 or more individuals. Where the breach is likely to result in significant harm, you must also notify the affected individuals, at the same time as you notify the PDPC or after, not before. (Source: PDPC, "Report Your Organisation's Data Breach", page opened 11 Nov 2026, last updated 22 Apr 2026.)

The Ministry of Health describes the Health Information Act as a framework for managing, protecting and sharing health information. One part of the Act requires licensed healthcare providers, retail pharmacies, approved users of the National Electronic Health Record, and Health Information Management System providers to implement reasonable cybersecurity and data security measures, and to comply with cybersecurity-incident and data-breach notification obligations. (Source: MOH, "Health Information Act" page, last updated 31 October 2026, opened 11 Nov 2026.)

MOH's Healthinfo site, in a page last updated 14 August 2026, says healthcare providers are already required to protect health information under the PDPA and under sectoral requirements such as the Healthcare Services Act 2020. Under the Healthcare Services (General) Regulations 2021, licensees already have to secure equipment used to provide a licensable healthcare service that holds data, including by protecting that data from unauthorised access, reviewing those measures regularly, and transmitting the data securely (regulation 25). They also have to keep patient health records confidential and maintain their confidentiality, integrity and security, including by monitoring the safeguards and taking reasonable care when records are disposed of (regulation 38). These duties apply today, before the HIA starts. The HIA builds on those frameworks. Healthcare providers must meet mandatory cybersecurity and data security standards to contribute to, access or share data under the HIA framework. MOH has published Cybersecurity and Data Security Essentials for HIA-regulated entities, developed with the Cyber Security Agency of Singapore, the Infocomm Media Development Authority and the PDPC. Once the HIA requirements take effect, those entities will have to comply with the controls in that document. (Source: Healthinfo, "About Cybersecurity and Data Security (CS/DS)", opened 11 Nov 2026.)

Those HIA reporting duties have not yet taken effect. The Healthinfo CS/DS page, last updated 14 August 2026, still says the HIA requirements have yet to take effect, and that further communications will be given on when mandatory reporting will begin. MOH has published the structure clinics should be ready for once those duties apply: if an incident or breach is assessed as notifiable, an initial notification to MOH within two hours of that assessment, and a detailed report to MOH within 14 days of the initial notification. For notifiable data breaches involving health information that are likely to result in significant harm, the healthcare provider must also notify the affected individuals. Details of which health-information breaches are deemed likely to result in significant harm have been described by MOH as a matter for subsidiary legislation, which has not yet been issued. PDPA breach-notification duties already apply.

MOH has also published a phased timetable for licensed healthcare providers to start contributing key health information to the National Electronic Health Record and to implement the cybersecurity and data security measures. On MOH's Implementation Support page, last updated 16 October 2026, that timetable is by September 2027 for outpatient GP clinics, by September 2028 for specialist outpatient clinics, and by March 2030 for outpatient dental clinics. Those dates may change. They are not a commencement date for the Health Information Act. Check that page, and Singapore Statutes Online, before you treat a date as a current legal duty.

The Essentials apply to HIA entities, including all licensees under the Healthcare Services Act, contributors and users of the NEHR, and prescribed entities enabled to share health information under the HIA. "Health information" in that document covers administrative and clinical information, such as medical records and laboratory test results. (Source: CS/DS Essentials, sections 1.3 and 1.4.)

The summary table in the Essentials is a practical checklist you can walk through with an IT provider:

• Install software updates on devices and systems promptly.
• Use anti-malware protection, access control, and secure settings for hardware and software. The detailed text also expects firewalls to be configured, unique user accounts, a process to grant and revoke access, and default passwords to be replaced.
• Back up essential data and store the backups separately.
• Know the hardware and software you use, and the data you hold, and restrict access to health information to valid purposes.
• Train staff, be clear about what you and your vendors each own, review your own processes, dispose of health information properly, plan for disruptions, and have an incident-response plan that people actually know how to use.

(Source: CS/DS Essentials, Table 1 and the supporting sections on updates, malware protection, firewalls and access control.)

MOH says it has worked with Health Information Management Systems vendors, such as clinic management system vendors, to build key controls into their systems: timely updates, two-factor authentication for configuration changes, secure settings, and protected backups. Vendors that do this would be certified under the Cyber Security Agency of Singapore's Cyber Essentials mark. Ask your clinic-system vendor, in writing, whether the vendor holds that Cyber Essentials certification. Other systems that hold health information, such as hardware and billing applications, still need the same measures. (Source: CS/DS Essentials, sections 1.6 and 1.7.)

We can work through that list with you. We will not pretend the list makes the clinic "HIA certified".

Those questions are also why a clinic should not rely on break-fix support. Patching, tested backups, account control and a named contact are the work between tickets, and they belong in a managed IT service. If you want us to look at your setup, book a free call.