From 11 December 2023 to 11 January 2024, the Ministry of Health (“MOH“) conducted a public consultation seeking views on the proposed Health Information Bill (“HIB“). To facilitate better continuity and seamless transition of care to patients, the HIB, once implemented, will establish a framework to govern the safe collection, access, use, and sharing of health information across Singapore’s healthcare ecosystem.
By way of background, in 2011, MOH introduced the National Electronic Health Record (“NEHR“) as a centralised health information repository to provide healthcare providers with a holistic and longitudinal view of a patient’s health information. NEHR is used by all public healthcare institutions. However, participation by private providers is voluntary and as of October 2023 there was around only 15% participation.
Endeavouring to ensure that the NEHR provides a single holistic picture of an individual’s health, MOH is proposing to introduce the HIB in Parliament in the first half of 2024.
Overview of the Proposed HIB
The HIB aims to achieve the following three main objectives.
(a) Ensure that health information is kept updated, accurate, and accessible
- The HIB will mandate that all healthcare providers licensed under the Healthcare Services Act, and approved contributors, contribute certain patient health information to the NEHR. Health information includes both an individual’s administrative data and clinical data.
- Access to NEHR data will also be granted to licensed healthcare providers and approved users for patient care purposes.
- Only key health information will need to be contributed to the NEHR, as it is expected to be generally beneficial to all providers.
- Sensitive health information (“SHI“) will not be readily accessible. Additional requirements will be imposed upon SHI, such as administrative access controls and mandatory reporting requirements where a breach occurs.
(b) Establish a robust framework for the sharing of health information
- The HIB will simplify the health data sharing framework and provide greater clarity on data sharing and access boundaries. Data sharing will be scoped to what is necessary for the allowable use purposes. The HIB will prescribe: (i) the purposes for which data can be accessed/shared; (ii) the care providers which can perform such access of data; and (iii) the types of data that can be accessed/shared.
- The HIB will set out three purposes for which health information residing outside the NEHR can be shared, which are: (i) for outreach under national health initiatives; (ii) to support continuity of care including telecollaboration; and (iii) for assessment of eligibility for financing schemes.
- Care providers who wish to share health information for purposes not included in the HIB will need to find a legal basis for doing so, such as obtaining the patient’s explicit consent.
(c) Set out the relevant data security and cybersecurity requirements that healthcare providers must comply with
- The HIB will set in place cybersecurity and data security safeguards to govern the collection, access, use and sharing of health information with which healthcare providers must comply.
- Healthcare providers who use the health information must also comply with requirements to report any cybersecurity incidents and/or data breaches.
- The implementation of HIB’s cybersecurity and data security requirements will be aligned to the implementation of the mandatory NEHR contribution, which is expected to start from end-2025.
- MOH has developed the Cyber & Data Security Guidelines for Healthcare Providers (“Guidelines“), released on 4 December 2023, in consultation with the Cybersecurity Agency of Singapore (CSA), Infocomm Media Development Authority (IMDA), and the Personal Data Protection Commission (PDPC). The Guidelines, which build on the Healthcare Cybersecurity Essentials (HCSE), provide guidance on the cyber and data security measures that must be put in place for the proper storage, access, use and sharing of health information prior to the implementation of the HIB.
NEHR Guidelines for Medical Professionals
To assist medical professionals, MOH has prepared the Draft Guidelines on Appropriate Use and Access to NEHR, which outline the core ethical principles and reasonable professional standards that should be adopted when contributing to, accessing, or using the NEHR.
Rebecca Chew, Co-Head of the Medical, Healthcare & Life Sciences Practice, is a member of the NEHR Guidelines Workgroup.
Click on the following links for more information (available on the MOH website at www.moh.gov.sg):
