What Is the Health Information Act?
Singapore's new law on how patient health information is shared and protected across the healthcare system. It is not in force yet. It takes effect from early 2027, and MOH brings healthcare providers under it in batches. The first batch, which includes GP clinics and acute and community hospitals, has a deadline of September 2027.
Why Does It Land on Operators, Not Only on IT?
Because the Act asks about how patient data is handled day to day, and most of that happens outside the IT department. It happens at the front desk, on shared laptops, and in the messages staff send each other. The session was pitched at the people who run those operations, and at how to prepare before the deadlines arrive.
How Should a Clinic Prepare?
Start with the cybersecurity basics, and keep evidence of what you have done. There is no HIA certificate to get. Clinics self-attest their readiness to MOH, so being HIA-ready means having the controls in place and being able to show them.
- StrongKeep for healthcare clinics, how we help small clinics get HIA-ready without an IT team or consultants.
- HIA readiness checklist for Singapore GP clinics, our free plain-English guide to the measures.
Related Reading
- Why is cyber security hard for a small clinic?, from a HealthTechX Asia 2026 panel Gaurav moderated.
- What would your team do if a clerk typed her password into a fake login?, Gaurav's SMEICC 2026 masterclass.
Frequently Asked Questions
Is the Health Information Act in force yet?
Not yet. It takes effect from early 2027, and MOH brings healthcare providers under it in batches. The first batch, which includes GP clinics and acute and community hospitals, has a deadline of September 2027.
Who was the SHM 2026 session on the Health Information Act for?
Healthcare managers, operations leads and risk owners attending the Singapore Healthcare Management Congress 2026. Gaurav Keerthi, CEO of StrongKeep, gave the session, HM 8, on 13 August 2026 at the Sands Expo and Convention Centre.
How can a small clinic get HIA-ready?
Start with the cybersecurity basics: protect every device, filter malicious links, use strong and unique passwords, and train staff to spot phishing. Clinics self-attest their readiness to MOH, so keep evidence of what you have put in place. StrongKeep is built for clinics with no IT team, and our free HIA readiness checklist sets out the measures in plain English.
What Does StrongKeep Do?
StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page.
