Singapore Healthcare Cybersecurity Compliances You Must Know

In an era of digital advancements, the healthcare sector is increasingly adopting technology to enhance patient care and streamline operations. However, with the growing dependence on digital systems, the risk of cyber threats and data breaches has also intensified.

Recognizing the importance of safeguarding sensitive patient information, the Singapore government has implemented robust cybersecurity regulations and guidelines that are also imperative for the healthcare industry to know. This not only ensures regulatory compliance but also ensures patient safety, data privacy, and the integrity of critical healthcare systems.

In this article, we will explore the key cybersecurity regulations and guidelines in Singapore's healthcare sector that organizations and healthcare professionals must be aware of to ensure the protection of patient data and maintain regulatory compliance.
​

Personal Data Protection Act (PDPA)

The Personal Data Protection Act (PDPA) is Singapore's primary legislation governing the collection, use, and disclosure of personal data. Healthcare organizations must comply with the PDPA when handling patient information. 

Key aspects of the PDPA include:

• Consent: Organizations must obtain clear and informed consent from individuals before collecting, using, or disclosing their personal data.
• Data Protection Officer (DPO): Healthcare organizations must appoint a Data Protection Officer responsible for ensuring compliance with the PDPA.
• Data Breach Notification: In the event of a data breach that poses a risk of harm to affected individuals, organizations are required to notify both the affected individuals and the Personal Data Protection Commission (PDPC) promptly at https://eservice.pdpc.gov.sg/case/db.​

​Healthcare Cybersecurity Essentials (HCSE)

The Ministry of Health (MOH) has developed the HCSE to safeguard hospitals and clinics endpoints and IT systems. This is a guidance document for healthcare providers on basic cybersecurity measures that they can adopt to ensure the security and integrity of their IT systems, assets and patient data. 

To summarize, the HCSE sets out 12 recommendations that can be implemented in 3 steps:

Step 1: Create IT asset inventory 

• List all assets connected to the corporate IT network. 
• Ensure the list is well-detailed - includes device name and version information, and up-to-date. 
• Install only relevant software, and ensure the usage of corporate devices only. 

​Step 2: Secure data, detect, respond to, and recover from breaches

• Review privileges of administrator and user accounts, and remove unused accounts
• Ensure usage of multi-factor authentication, and ensure staff do not share passwords or tokens.
• Regularly update systems and software, and deploy anti-malware protection. 
• Secure network perimeter via endpoint protection solutions
• Implement, monitor and review users’ audit trails and security logging. 
• Always perform frequent and regular backups, and test them to ensure they are usable. 
• When using 3rd party software and devices, healthcare providers must clearly understand how data is processed, transferred and stored, the safeguards vendors put in place, ensure responsibilities in an event or breach is written in the contract. When using an IT service provider, clearly understand their services and security practices. Also, ask them to provide regular vulnerability reports and updates. 
• If healthcare providers suspect they may have been a victim of cybercrime, please also lodge a police report. 
• Healthcare providers have obligations under the PDPA to report data breach incidents at https://eservice.pdpc.gov.sg/case/db.
• Strongly encourage healthcare providers to report cyber incidents to SingCERT. 

• Healthcare providers should raise cybersecurity awareness among employees through training and awareness programmes.

​Step 3: Implement by putting measures into practice
​

• Review the HCSE and translate them into policies and processes 
• Ensure that policies and processes are endorsed by the head or equivalent and communicate to all employees and vendors. 
• Review policies and processes regularly.

To get the full information of the HCSE, here is the pdf from MOH: Healthcare Cybersecurity Essentials pdf.
​

Cybersecurity Labeling Scheme for Medical Devices [CLS (MD)] 

The Cyber Security Agency of Singapore (CSA) collaborated with MOH, HSA and Integrated Health Information Systems (IHiS) on CLS (MD). This applies to medical devices that handle health-related data or can connect to other devices, systems and services. 

This scheme is to enable consumers and healthcare providers to make informed decisions when using and purchasing medical devices. 

​Key aspects of the CLS (MD) include:

• Medical devices are rated according to their levels of cybersecurity provisions. There are 4 levels of ratings, with level 4 being the highest. Each additional cross represents an additional level of testing and assessment the product has undergone. 
•  The baseline regulatory requirements in Level 1 are equivalent to the current HSA registration requirements for medical devices. Hence, all HSA-registered medical devices are deemed compliant to CLS (MD) Level 1. ​

The launch of CLS(MD) for higher levels is expected to be launched in the 3rd quarter of 2023. 

Healthcare Services Act (HCSA) - Software For Medical Devices:

The Healthcare Services Act (HCSA) introduced in January 2020 establishes regulations to protect healthcare consumers and enable the development of new and innovative healthcare services. In April 2022, HSA issued new guidance for registering software as a medical device (SAMD) and Clinical Decision Support Software (CDSS).  

Strengthening cybersecurity is especially outlined in HSA Regulatory Guidelines for Software Medical Devices. 

All software medical device manufacturers are recommended to adopt a Total Product Life Cycle (TPLC) approach to manage and adapt to rapid changes in the environment. 

​Key aspect pertaining to cybersecurity:

• Cybersecurity Plan: When developing a software medical device, a cybersecurity plan needs to be made to include these non-exhaustive considerations: (1) a secure device design, (2) having proper customer security documentation, (3) conduct cyber risk management (4) conduct verification and validation testing, and (5) having an on-going plan for surveillance and timely detection of emerging threats. 

To get the full information of the SAMD, here is the pdf from HSA: Regulatory Guidelines for Software Medical Devices.pdf.

Takeaway 

As the healthcare sector in Singapore continues to embrace digitalization, it is crucial for organizations and healthcare professionals to be well-versed in the cybersecurity regulations governing the industry. Adhering to these regulations not only ensures the protection of patient data but also helps in maintaining trust and confidence in the healthcare system. By prioritizing cybersecurity and staying abreast of the evolving regulatory landscape, Singapore's healthcare sector can navigate the digital landscape securely while providing high-quality care to patients.

​Related Topics ​

The Vital Importance of Cybersecurity in Healthcare: Safeguarding Lives and Data 

The Urgent Need for Cybersecurity in the Healthcare Industry: Lessons from the ASL 1 Abruzzo Cyber Attack 

​Why do businesses need to be cyber secure? Is it as important as emphasized everywhere? 

7 Types of Cybersecurity Measures SMEs Need to Protect Their Business ​