How to choose a clinic management system in Singapore: the 2026 checklist

What changed in 2026, and the first question to ask

Choosing a clinic management system in Singapore used to be about workflow and price. The Health Information Act (HIA) adds a deadline: under MOH’s timeline, GP clinics must contribute to NEHR and have cybersecurity and data security measures in place by September 2027, specialist outpatient clinics by September 2028 and dental clinics by March 2030.

Outpatient clinics contribute visit events, diagnoses, medications, adverse drug events, vaccines, referral memos and reports such as ECGs, from the date the system is connected. Detailed consultation notes and historical records are not required. See NEHR contribution for private clinics.

MOH’s March 2026 circular is explicit about software. Synapxe maintains a list of HIA-compliant HIMS: systems certified for NEHR connectivity, holding CSA Cyber Essentials certification, and committed to data portability. MOH says adopting one is necessary to meet the contribution requirement and the system-level security measures. So before features or price, ask every vendor: are you on the list, and if not, when?

The NEHR Connect Grant is a one-off S$8,400 for most outpatient services; GP clinics can apply from 1 July 2026 to 31 August 2027, specialist clinics from 1 August 2027 to 31 August 2028. MOH describes it as covering about two years of subscription to a HIA-compliant system. Clinics that received earlier NEHR funding, such as the GP IT Enablement Grant, are not eligible.

The Singapore must-have checklist

Every system has a calendar and an invoice. These are the Singapore-specific capabilities most worth testing.

National record and coding

• NEHR contribution built from the visit record, with a log of what was sent and rejected, and a way to correct and resend.
• Diagnoses coded to SNOMED CT and medicines to the Singapore Drug Dictionary (SDD), both maintained nationally by Synapxe, while the doctor works rather than in an end-of-day pass.
• NRIC, FIN and passport stored as distinct identifier types, so patients match across systems.

Registration and identity

• Singpass Myinfo registration with consent recorded, and a manual fallback.
• Duplicate detection, and a merge that keeps both histories.

Schemes, payers and billing

• CHAS, Pioneer Generation and Merdeka Generation subsidies applied on the bill.
• Healthier SG, including Chronic Tier subsidies on the Healthier SG Medication List for enrolled patients.
• MediSave claims under the Chronic Disease Management Programme (MediSave500/700), with the right co-payment rules.
• Corporate and TPA billing: panels, co-payments, statements, and payments matched to claims.
• PayNow and card, and a day-end report that reconciles itself.

Clinical operations

• Medical certificates issued from the encounter, numbered, signed and searchable.
• Inventory with batch and expiry tracking, and stock deducted at dispensing.
• Labels printed from structured dose, frequency and duration.

Patient messaging

• WhatsApp through the official Business API, into a shared clinic inbox.
• Consent and opt-outs recorded per patient, with service messages kept apart from marketing; PDPC confirms the Do Not Call provisions apply to WhatsApp messages to Singapore numbers.

Security, audit and data

MOH’s Cybersecurity and Data Security Essentials (CS/DS Essentials) set the baseline for every clinic, alongside the PDPA. Several controls live inside the clinic system:

• A unique login per staff member, and two-factor authentication at least for admin and remote access.
• An exportable account list with role, date created and last log-on; the Essentials expect accounts dormant for, say, more than 60 days to be removed.
• Lockout after repeated failed logins, and login logs.
• An audit trail of who viewed or changed each record.
• Backups stored separately, protected, and test-restored.
• A clear answer on whether data is hosted in Singapore or overseas.
• A full export in open formats without a paid project; data portability is a condition of HIA-compliant listing.
• The vendor’s Cyber Essentials certification, and a written incident split. Under the HIA, a notifiable incident must be reported to MOH within 2 hours of that assessment.

Your clinic still owns its policies, training and devices. CSA offers a Cyber Essentials mark for HIA entities to have those independently assessed; see Cyber Essentials for clinics.

Cloud or on-premise

Neither is automatically more secure. What changes is who does the work.

For cloud, the CS/DS Essentials ask you to understand your own responsibilities for security settings and backups. Put that split in the contract.

Pricing models and what to ask about cost

The lowest monthly figure is not always the lowest yearly cost. Common models:

• Per clinic: a fixed fee per location, sometimes tiered by size.
• Per user or per doctor: ask whether locums and front-desk staff count.
• Per module: dispensing, messaging or claims sold separately.
• Per transaction: fees per claim, per message or per submission.
• Licence plus maintenance: common for on-premise.

Then ask for what the headline number leaves out:

• Setup and training.
• Migration of your history, and whether you get a trial copy to check it.
• NEHR, laboratory, insurer and payment integration fees.
• WhatsApp and payment charges, and whether they pass through at cost.
• Hardware such as label printers and card terminals.
• Contract length, notice period and price-increase caps.
• The cost of a full export when you leave.

Besides the NEHR Connect Grant, healthinfo.gov.sg lists the Productivity Solutions Grant for cybersecurity solutions (up to 50%, capped at S$30,000, for eligible SMEs) and CSA-supported consultancy packages. Check eligibility before counting on them.

Questions to ask in a demo

Send these scenarios ahead and ask the vendor to run them live in a working account.

1. Register a patient through Myinfo, then one whose Myinfo request fails.
2. Bill a CHAS walk-in, a Healthier SG chronic patient and a corporate patient with a co-payment.
3. Show a rejected NEHR submission: where it appears, who fixes it, how it is resent.
4. Prescribe from the SDD, dispense, and show the stock movement and label.
5. A staff member resigns today: remove access, then show the account list and one record’s audit trail.
6. Export all our data now. What format, and how long?
7. Where is our data hosted, and who at your company can see it?
8. What happens when the internet or NEHR is down?
9. Which features shown today are live, and which are in development?

The move itself needs a plan; see switching your clinic management system.

Red flags

• The vendor cannot say whether it is on, or applying for, Synapxe’s list of HIA-compliant HIMS.
• Scheme claims, NEHR or MediSave shown in slides, not a live account.
• “Coming soon” with no date in the contract.
• Data export as a paid project or a proprietary format.
• Shared front-desk logins, or 2FA that cannot be enforced.
• No clear answer on hosting or vendor access.
• A quote silent on migration, integrations or message charges.
• No reference clinic of your size and specialty you can call.

A scoring table you can copy

Score each line 0 to 3 (0 absent, 1 partial or promised, 2 works with workarounds, 3 shown working in your scenario), multiply by the weight and add up. Adjust weights to your practice.

A vendor scoring zero on HIA-compliant status is not a shortlist candidate for a GP clinic facing September 2027.

Frequently asked questions