NEHR contribution for private clinics: what the Health Information Act asks of you, and by when

The short answer

Yes, it applies to you. The Health Information Act (HIA) was passed by Parliament on 12 January 2026 and published as Act No. 1 of 2026. It requires every healthcare provider licensed under the Healthcare Services Act 2020 (HCSA) — which includes every private GP and specialist clinic — to contribute key health information about its patients to the National Electronic Health Record (NEHR). The same Act requires those providers to meet MOH’s Cybersecurity and Data Security (CS/DS) Essentials and to report serious incidents to MOH.

The obligations are phased. MOH set out the timeline in a circular to all HCSA licensees dated 6 March 2026 and repeated it in the HIA Implementation Guide (version 2.0, August 2026). For each batch, the deadline for starting NEHR contribution is also the deadline for putting the CS/DS measures in place.

If your clinic holds more than one service type, each service follows its own timeline. The data you owe is also narrower than many doctors assume: MOH has said plainly that you do not need to upload historical records or detailed consultation notes.

What a clinic has to contribute

The data types depend on your licence. For an Outpatient Medical Service licence — primary care and private specialist clinics — MOH lists the following:

• Visit event: date and time, service or specialty, your HCSA licence number, visit type, and the attending doctor’s name and registration number.
• Visit diagnoses, reasons for visit or problem list, coded in SNOMED CT.
• Adverse drug event history: allergies and other drug reactions, with the drug, the reaction, how certain it is and who reported it.
• Medications: what was ordered, what was dispensed, and the medication list, each coded to the Singapore Drug Dictionary (SDD).
• Vaccines administered, with the vaccine code and who gave it.
• Referral memorandum: who referred, to which institution and specialty, and why.
• Cardiac reports (for example ECGs) and surgical procedure notes, subject to the two exemptions below.

Every record carries the patient’s name, identification type and number, date of birth and gender as they appear on the government-issued ID. Those fields are what allow NEHR to match your record with the hospital’s and with the next GP’s.

What you do not have to send

• Historical records. Contribution is prospective, starting once your system is connected.
• Detailed consultation and progress notes.
• Laboratory reports you ordered. The laboratory that generates a report contributes it.
• Records of short-term foreign visitors. Only Singaporeans, permanent residents and long-term pass holders (FIN holders) are in scope.
• Surgical procedure notes for procedures done outside operating theatres and ambulatory surgical centres (exempted until March 2030), and cardiac reports where the device cannot interface with your clinic system.

One point that surprises doctors: a patient who places an Access Restriction on their NEHR record limits who can view it, but MOH states that providers are still required to contribute.

What contributing means day to day

Nobody types anything into NEHR. MOH expects contribution to happen through an HIA-compliant Health Information Management System (HIMS) — for most clinics, the clinic management system. To be listed as HIA-compliant, a system must meet three requirements: NEHR connectivity certification, the CSA Cyber Essentials for HIMS Vendors certification (or equivalent), and a declaration of compliance with MOH’s Code of Practice for Data Portability. Synapxe keeps the directory of certified systems.

Once your system is certified, onboarding is a project with your vendor: drug inventory mapping, deployment scheduling and the first live submissions. The Implementation Guide says it takes up to five weeks. After that, contribution is a by-product of documenting properly. The doctor records the visit, diagnosis, prescription and any allergy; the system builds the NEHR messages from those fields and sends them.

MOH sets quality standards for what arrives. Submissions should be timely, complete (a reason for every visit), attributable to the contributing provider, accurate (patient details checked), compliant with coding standards (SNOMED CT, LOINC, SDD), and corrected when errors are found: you fix the record in your system and re-submit. The original contributor is responsible for correcting its own entries.

What your system should show you

Because contribution runs in the background, the real risk is silent failure. Ask to see, on screen, which submissions were accepted, which were rejected and why, and which are still waiting. A rejected message is usually a data problem at your end — an uncoded diagnosis, an unmapped drug, a mistyped identifier — and someone in the clinic needs to own that list.

The grant, and other support

The NEHR Connect Grant (NCG) is MOH’s one-off funding for providers that must contribute. For GP and specialist clinics under the Outpatient Medical Service licence it is a fixed S$8,400 per licensee, which MOH describes as covering roughly two years of a subscription-based system. Providers enhancing an in-house system can instead receive up to 40% of the enhancement cost.

• You must choose an HIA-compliant system before you apply. Applications go through the OurSG Grants Portal.
• Applications submitted after your deadline are rejected.
• Full payout requires meeting the data quality standards for one month after you start contributing.
• Clinics that received earlier MOH IT grants, such as the GP IT Enablement Grant, are generally not eligible. The eligibility terms have been refined since March 2026, so check the current version.

For clinics still on paper, MOH has said it will provide an Alternate Contribution Channel for clinics licensed before 2027 that need more time to digitalise; details had not been published at the time of writing. Synapxe also offers clinical content support and a drug-mapping service, and your vendor is expected to do most of the integration work.

Where clinics get caught out

• Leaving it to mid-2027. Five weeks of onboarding assumes your vendor has a slot. If hundreds of GP clinics start in the same quarter, not all of them will get one.
• Assuming your vendor is on the list. In March 2026 MOH said 17 systems were integrated with NEHR for GPs, 15 of them CE certified. If yours is not listed yet, ask for a date in writing. If you decide to switch, MOH advises that the old and new vendors agree a migration plan and timeline with you; our guide to switching clinic management systems covers how.
• Free-text diagnoses and an unmapped drug list. Missing SNOMED CT and SDD codes are the obvious cause of rejected submissions. Clean up your inventory before go-live, not after.
• Wrong identifier types. A FIN keyed as an NRIC, or a passport number in the wrong field, produces a record that does not match. Registration from verified sources helps.
• Nobody owns rejections. Decide who reviews the rejected list each week, and how corrections are approved.
• Treating security as a separate project. The CS/DS deadline is the same date. Our Cyber Essentials explainer covers what that involves.
• Misusing access. NEHR may be viewed only for patient care or approved statutory medical examinations — not for insurance or employment reports — and patients can see who accessed their record through HealthHub.

A preparation plan

For a GP clinic reading this in late 2026, a sensible order is:

1. Confirm your batch. Check the service types on your HCSA licence and note the deadline for each.
2. Ask your vendor three questions. Is the system on Synapxe’s HIA-compliant list, and if not, when? What does onboarding need from us? When is our slot?
3. Apply for the NCG once your system is chosen. Keep invoices that state which licensed service the costs relate to.
4. Clean your data. Review the drug list for mapping, stop free-text diagnoses, and check how staff record identifier types.
5. Set up NEHR access for the doctors and nurses who will view records. Each user needs their own account, and staff in purely administrative roles are not given access.
6. Start the CS/DS work in parallel. Staff training, account clean-up, backups and an incident response plan take longer than the paperwork suggests, and your PDPA obligations continue alongside the HIA.
7. Name an owner for rejections and put a weekly review on the calendar before go-live.

On enforcement, MOH describes its approach as calibrated. Non-contribution is not an offence in the first instance, and where it comes from technical difficulty MOH will help fix the cause. Deliberate or reckless non-compliance can lead to directions, and failing to follow a direction can lead to enforcement action. That leaves room for genuine problems, not for starting late.

Frequently asked questions