HIA Readiness Checklist for Singapore GP Clinics: All 13 CS/DS Essentials Measures

Section A: Cybersecurity (IT and software measures)

MOH applies these to computers and systems interconnected with the NEHR or containing health information.

1. Updates

StrongKeep covers part of this

• Operating system and application updates from legitimate sources are installed promptly, critical or important ones first.

Record to keep. Nothing to buy here: switch automatic updates on, and let them run when they ask to. Keep a note of the date you last confirmed every device was current, and who checked.

2. Secure/Protect

StrongKeep covers this

• Anti-malware runs on every endpoint (laptops, desktops, servers), auto-updates its signatures, scans files on access, including downloads and USB drives, and runs regular scans.
• Firewalls are configured and deployed: built-in operating system and router firewalls in a simple setup; a perimeter firewall accepting only authorised traffic in a network setup.
• Staff policies require authorised software from trusted sources only, trusted networks (not public Wi-Fi) for clinic data and email, and immediate reporting of suspicious emails. Staff are also told why public networks are risky, not just that they are barred.
• You keep an inventory of all user, administrator, third-party and service accounts: name, username, department, role, date created, last log-on.
• Each person has a unique account; shared, dormant or inactive accounts (for example, unused for over 60 days) are removed; the administrator account is used only for administrator tasks, with senior management approval.
• Access is granted and revoked through documented approvals, reviewed on staff changes, so people reach only what their role needs.
• For each person granted access, you record six things: name, the system they can reach, department, role or account type, the date access started, and the date it ends where there is one.
• Default passwords are replaced with strong passphrases (MOH's benchmark: at least 12 characters, mixing upper case, lower case and/or special characters), changed on any suspected compromise. Two-factor authentication (2FA) is used for administrative access, including remote access, to important systems, such as an internet-facing system holding sensitive or business-critical data. Accounts lock after multiple failed logins (for example, after 10).
• Third parties and contractors reach only what their work requires, lose access when done, and sign a non-disclosure agreement (NDA) if handling health information.
• Physical access to IT assets is restricted to authorised people; log-ins are tracked and security logs are viewable only by authorised individuals.
• Desktops, servers and routers use secure settings: weak protocols replaced before use, unused features disabled, auto-connection to open networks and auto-run of non-essential programmes switched off.

Record to keep. The largest measure, and mostly account work rather than software. The account inventory is itself the record: every user, administrator, third-party and service account, with who approved it and when it was last used. Expect to go device by device and through your Microsoft 365 or Google Workspace admin centre.

3. Backup

StrongKeep covers part of this

• Business-critical systems and essential data are backed up regularly, at a frequency matched to recovery needs; backups are restricted to authorised personnel and stored separately from the operating environment.
• For cloud services, know who is responsible for backup, you or the provider, and keep an alternative backup.

Record to keep. The record is your backup schedule, where the copies are kept, and who can reach them. MOH does not ask you to test a restore. It is still the only way to find out whether the backup works, so do it anyway, and date it when you do.

4. Asset

StrongKeep covers this

• New hardware and software are authorised before use, approval dates recorded in an up-to-date asset inventory; anything unapproved is removed.
• Assets past End-of-Support (EOS), when the maker stops updates and servicing, are replaced; any continued use is risk-assessed, approved by senior management and monitored until replaced.

Record to keep. The asset list is the record, and the End-of-Support line is the one with a budget attached: anything you keep running past it needs the assessment and the sign-off above, in writing.

MOH has worked with Health Information Management Systems (HIMS) vendors, including clinic management systems, to embed key controls: timely updates, two-factor authentication for configuration changes, protected backups. Not all have certified yet. MOH's implementation circular records that, as at March 2026, 15 of the 17 HIMS integrated with the NEHR were CE certified, with all providers encouraged to certify before the end of 2026. Check your own vendor rather than assume.

Section B: Data security (data-related practices)

These apply to electronic data and hardcopy documents alike.

5. Secure

StrongKeep covers part of this

• Policies identify and protect your health information, with clauses in employment and vendor contracts prohibiting unauthorised disclosure.
• Hardcopy records live in access-controlled spots such as locked cabinets, or offsite only with storage providers whose security you have checked (with deposit records and periodic stock-takes); laptops and portable media holding health information are cable-locked when not in use.
• Retention periods have a documented rationale, considering the PDPA, HCSA licence conditions, contracts and national guidelines.
• Copies of health information are made only by authorised people, for an official need-to-know purpose, and staff keep possession of copies made externally.
• Transfers are controlled: only necessary information leaves the clinic, materials stay in staff possession, screens are shielded from view, and files sent electronically are password-protected, the password sent by a different channel and recipients checked.

Record to keep. Most of this is written down rather than configured. The records are your signed policy and a retention schedule that says how long you keep each kind of record and why, with the reason traceable to the PDPA, your HCSA licence conditions or a national guideline.

6. Identify

• Health information is marked so staff recognise it, for example headers or footers added at creation; where impractical, policy specifies which data counts as health information and staff apply the matching safeguards.
• In deciding whether and how to mark it, you weigh four things MOH names: the format, hardcopy or electronic; how practical marking is, including the cost of changing an IT system; who handles the information, your own staff or a third-party vendor; and what the marking is meant to achieve.

Record to keep. The smallest measure on the list. The record is the policy line stating what counts as health information in your clinic, so a new staff member can tell without asking.

7. Access

StrongKeep covers part of this

• Access to health information goes only to people with a legitimate need to know for their work, third parties included.
• Someone with the authority to do so decides who has that need, and everyone given access acknowledges in writing that they have read your security measures, your policies, and the laws that apply such as the PDPA.

Record to keep. Someone has to decide who needs access, and that decision has to be someone's job. The record is each person's written acknowledgement that they have read your policies and the rules that apply.

Section B is mostly process work; if your clinic has no technical staff, our walkthrough of meeting the CS/DS Essentials without an IT team shows how a practice manager runs it.

Section C: Common practices (personnel training, vendor management, organisation protocols)

8. Training and education

StrongKeep covers this

• Staff attend cybersecurity and data security awareness training periodically, ideally at least once a year in MOH's words, in-house, external or via self-help resources.
• Day-to-day hygiene policies tell staff the security behaviour expected of them.

Record to keep. Only your staff can generate this one. The record is the completion register, with dates. MOH asks for training periodically, and ideally at least once a year in its own words, so what you want is a register that keeps going rather than one push before the deadline.

9. Outsourcing and vendor management

StrongKeep covers part of this

• Any IT provider managing your network, systems or medical devices has clearly understood services, and sends regular vulnerability reports and security updates.
• For third-party software and devices, you know where health information is stored (Singapore or overseas), what safeguards and certifications the vendor holds, and who bears what responsibility in an incident.
• For cloud services, you understand your own responsibility for security configurations.

Record to keep. This needs someone willing to ask a supplier an awkward question. The record is the vendor's written answers: where your data sits, what certifications they hold, and who is responsible for what when something goes wrong.

How much of this to outsource is its own decision, and it turns on who in the clinic is able to hold a vendor to the answers above.

10. Security reviews and internal audit

StrongKeep covers this

• You periodically review your safeguards, check that policies are being followed (self-assessments or external audits, at your discretion), and fix any lapse promptly, retraining where needed.

Record to keep. Keeping evidence is not the same as reviewing it. The record is a dated review note saying what you checked, what had slipped, and what you did about it.

11. Disposal

• Health information is securely destroyed before any hardware or data is disposed of: shred documents, encrypt a hard disk before reformatting, overwrite stored data completely.

Record to keep. The record is a disposal log: what was destroyed, when, by whom, and how. This applies to paper as much as to hard disks.

12. Emergency planning for contingency

StrongKeep covers this

• A business continuity plan identifies critical assets needing high availability and their redundancies, covers disruptions including cyber incidents and data breaches, and is ready to execute.

Record to keep. The record is the plan itself, dated, plus evidence someone has actually read it. The useful test is whether your practice manager could run it on a Tuesday morning without calling you, because that is the scenario it exists for.

13. Incident response

StrongKeep covers this

• An up-to-date incident response plan assigns roles, sets procedures to detect, respond to and recover from common threats such as phishing and ransomware, and includes a communication plan with escalation timelines for internal and external stakeholders.
• Everyone with access to your IT environment knows the plan and how to report suspicious activity.

Record to keep. The record is the plan plus evidence your staff have seen it. Under the HIA the first notification to MOH is due within two hours of assessing that a threshold is met, which is not enough time to work out who to call.

Incident reporting under the HIA: thresholds and timelines

Once the HIA applies to your clinic, these are the reporting rules in the Essentials; until then, PDPA breach notification to the PDPC remains the live duty.

For both categories:

• Initial notification to MOH within 2 hours after the clinic assesses that the incident meets a reporting threshold.
• An incident report within 14 days of the initial notification.
• The clinic must notify affected individuals at the same time as notifying MOH, or as soon as practicable after, if the incident causes or is likely to cause significant harm.

MOH's examples of notifiable cybersecurity incidents include unauthorised hacking, malicious software, denial-of-service and man-in-the-middle attacks. What counts as "significant harm" will be detailed in subsidiary legislation, and the specific reporting process will be shared in due course.