HIA readiness for your clinic, without a consultant retainer
The Health Information Act isn't in force yet, and MOH is phasing in its cyber and data security measures from 2027 to 2030. StrongKeep gives Singapore clinics the security tools and the readiness evidence in one self-serve platform.
"The setup was straightforward. There was no disruption to our daily clinic operations. I didn't need to understand the technical details. It just worked."
Book an HIA readiness call
Leave your details and we will email you to find a time. We will go through where your clinic stands on MOH's 13 measures.
Used by Singapore clinics including
What the HIA will ask of your clinic
MOH's Cybersecurity and Data Security (CS/DS) Essentials set out 13 measures for organisations handling health information, across cybersecurity, data security and common practices such as staff training and incident response. They apply to every Healthcare Services Act (HCSA) licensee, which puts a licensed clinic in scope. Readiness is self-attested to MOH, with no external certifier auditing it.
The Act takes effect
The Health Information Act takes effect from early 2027. That date is not your clinic's deadline.
Deadlines come in batches
MOH assigns each provider to one of three batches, with deadlines of September 2027, September 2028 and March 2030 for starting NEHR contribution and putting the cyber and data security measures in place.
The PDPA already applies
The PDPA, Singapore's existing data protection law, applies to your clinic today, HIA or not.
MOH's 13 measures, and who does the work
Our HIA readiness checklist marks which measures StrongKeep covers. The obligation stays yours either way: the mark is only about who does the work.
Cybersecurity
StrongKeep covers: 2 Secure/Protect, 4 Asset.
Covers in part: 1 Updates, 3 Backup.
Data security
Covers in part: 5 Secure, 7 Access.
The clinic's own: 6 Identify.
Common practices
StrongKeep covers: 8 Training and education, 10 Security reviews and internal audit, 12 Emergency planning for contingency, 13 Incident response.
Covers in part: 9 Outsourcing and vendor management.
The clinic's own: 11 Disposal.
What StrongKeep covers
- Device protection. Enterprise-grade anti-malware on your clinic's computers, from the reception PC to staff laptops.
- A DNS firewall, one of the two forms MOH names for a network perimeter, filtering every clicked link across email, browser and messaging apps. Nothing for you to configure.
- Passwords. A team password manager. Guided setup, and the credential vault generates your two-factor codes.
- Staff training. Short quiz-based modules, with each person's completion tracked as evidence.
- Policies. Policies are generated for you, complete and ready to use. You review and sign them off.
- Evidence and progress. The platform collects evidence from each tool and shows what is done, what is pending and what still needs attention.
- If something goes wrong. Guidance through the process, so you are not working it out under pressure. Making the report stays with the clinic.
Every clinic computer on one list
See each device, who uses it and whether its protection is switched on, from the reception PC to the doctors' laptops. No spreadsheet to keep up to date.
- Protection status shown per device
- An asset list you can produce when asked
Training records you can show
Run a training campaign for your staff and see who has opened it, who has completed it and who needs a reminder. Each person's completion is kept as evidence.
- Short quiz-based modules, not classroom sessions
- Reminders sent from the same screen
Trusted by clinics and the people who brief them
"I now have a robust solution in place. This goes well beyond basic antivirus protection."
0 disruptions to clinic operations
Dr Harish moved his clinic onto StrongKeep's protection without disrupting a single day of operations.
Briefing clinics, hospitals and medical associations
Gaurav Keerthi, CEO of StrongKeep and former Deputy Commissioner of Cybersecurity for Singapore, has been invited to brief SingHealth, Farrer Park Hospital, Mount Elizabeth Hospital, HealthTechX, AsiaMD and the GP+ Cooperative on the Health Information Act and clinic cyber risk.
Three routes to readiness
MOH's July 2026 FAQ for healthcare providers states that engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services. None of the routes is wrong. What differs is who does the work.
| On this route | Who does the work | Who owns the decisions |
|---|---|---|
| Unaided | You do, from scratch, working out the sequence as you go. | You. |
| Self-serve platform | You do, guided, with the tools and the evidence trail supplied. | You. A platform cannot sign a policy or judge a vendor for you. |
| CISOaaS consultant | They run the assessment and write the plan; you act on it. Training delivery and board-level advice are typically included. Fees vary by provider. | Still you. The clinic remains the responsible party whoever writes the document. |
What it costs
The security tools (device protection, the DNS firewall, the password manager and staff training) are in the Protection plan, from US$39/month for 5 devices, billed annually.
Generated policies and evidence tracking come with the Compliance plan, at US$159/month for 5 devices, billed annually. It also prepares you for CSA's Cyber Essentials certification, with your first audit fee included.
Each additional device is US$5.50/month. No setup fee.
Questions clinics ask us
Is the HIA in force yet?
No, not yet. The Act takes effect from early 2027, and MOH phases the cyber and data security deadlines from September 2027 to March 2030, by batch. The PDPA applies to your clinic today.
Does StrongKeep certify my clinic for the HIA?
No. There is no HIA certificate to get: clinics self-attest to MOH. StrongKeep gives you the tools and the evidence behind that attestation. If you also want a certificate to show, the Compliance plan prepares you for CSA's Cyber Essentials, which an external certifier issues.
Can a clinic owner with no IT background use StrongKeep?
Yes, with an honest qualifier: the steps ask for patience and administrator access, not technical skill. StrongKeep is designed for healthcare professionals rather than IT staff. The onboarding uses plain-English steps, and your policies are generated complete and ready to use. No scripts, no firewall configuration, and no technical jargon are required; the steps are repetitive rather than difficult, so give them unhurried time rather than the gaps between patients.
Is setting up StrongKeep disruptive to clinic operations?
No. Device enrolment runs in the background, with no downtime, no server setup, and no clinic closure required. It can be done after hours or during quiet periods, and device performance during normal clinic hours is not affected.
Doesn't our clinic management system vendor handle this?
Not on its own. Under section 4(3) of the PDPA, when a data intermediary processes personal data on your behalf, you have the same obligations as if you processed it yourself. A cloud or software vendor, including a Clinic Management System, is a data intermediary. You remain accountable, and the clinic is still responsible for staff devices, passwords, email use and training.
What parts of CS/DS Essentials does StrongKeep not cover?
StrongKeep helps with the technical controls, generates your policies, and handles evidence collection and readiness tracking. It does not appoint your Data Protection Officer, report data breaches to the PDPC or MOH for you, negotiate data processing agreements with vendors, guarantee staff finish their awareness training, or make clinical governance decisions. These responsibilities remain the clinic's regardless of which platform or provider you use.
What happens after I send the form?
We email you to find a time. On the call we go through where your clinic stands on MOH's 13 measures, which plan fits, and what it costs.
Find out where your clinic stands on the 13 measures
Book an HIA readiness callReady to start on your own? Create your account.