The Health Information Act 2026 brings healthcare providers, NEHR users and HIMS vendors into Singapore's cybersecurity and data-security regime. Phased deadlines run 2027–2030. SOC 2 or ISO 27001 does most of the heavy lifting — plus MOH-specific notification runbooks.
LowerPlane serves startups in the United States, Singapore, India and worldwide.
Including HCSA licensees providing care in Singapore.
Organisations connected to or submitting to the National Electronic Health Record.
SaaS or on-premise vendors providing health information management systems.
The HIA sets out cybersecurity and data-security duties aligned with widely-accepted controls: access controls, encryption, logging, incident response, vendor oversight, and notification obligations to the Ministry of Health. MOH publishes essentials documents applicable to HIA entities and HIMS vendors — your readiness pack should map to those essentials.
Reconfirm your category’s applicable date at healthinfo.gov.sg before planning timelines.
Cyber Essentials base controls / ISO 27001 Annex A / SOC 2 Security TSC.
ISO 27001 A.5.19–A.5.23 / SOC 2 CC9.
ISO 27001 A.5.24–A.5.26 / SOC 2 CC7.
A health-tech vendor already certified against one of those typically only needs HIA-specific documentation and the MOH-facing notification runbook to close the gap.
CSA Cyber Essentials funding tables reference “HIA Entities” and “HIMS Vendors” as eligible categories. See Singapore cybersecurity grants (2026).
The Health Information Act 2026 is the enacted law. Earlier proposals were sometimes referred to as the Health Information Bill or HBRA in draft; the enacted law is called the Health Information Act (HIA) 2026. Use the HIA name when citing it.
Healthcare providers (including HCSA licensees), National Electronic Health Record (NEHR) users, and health information management system (HIMS) vendors. HIMS vendors — SaaS or on-premise — are specifically brought into the regulatory perimeter.
The HIA implements in phases, starting with core providers in September 2027. Other HCSA licensees and NEHR users follow (September 2028), with remaining categories by March 2030. Reconfirm the applicable date for your category on healthinfo.gov.sg before planning timelines.
If you provide HIMS or process health information for Singapore healthcare providers or NEHR users, the HIA touches your contract. Your SG customers remain accountable to MOH, and they contract HIA-aligned obligations down to you. In practice, you need the HIA-aligned cybersecurity and data-security evidence pack even if you have no SG entity.
Yes. The PDPA remains the baseline for personal data; HIA adds sector-specific duties for health information. For most health-tech vendors, PDPA + HIA + SOC 2 (or ISO 27001) is the practical compliance stack. Evidence overlap is high — the HIA-only additions are MOH notification runbooks and HIMS vendor-oversight documentation.
Both regulate health information and require administrative, physical and technical safeguards. HIPAA's Covered Entity vs Business Associate split roughly maps to HIA's healthcare provider vs HIMS vendor split. BAAs (HIPAA) and HIA vendor-oversight contracts play similar roles. A US health-tech already running HIPAA covers 70%+ of HIA controls — the delta is MOH-facing documentation and SG data-residency clauses.
The HIA sets out notification obligations to the Ministry of Health for cybersecurity and data-security incidents affecting health information. MOH publishes the current form and timing requirements; align your incident runbook to that path, and keep the DPO or security lead as the single accountable notifier.
LowerPlane maps your existing SOC 2 / ISO 27001 evidence to the HIA cybersecurity duties so the gap is just documentation.