Safeguarding Confidentiality of Patient Information with National Electronic Health Record

The following question stood in the name of

Dr Lim Wee Kiak –: 20 To ask the Minister for Health with the introduction of the National Electronic Health Record (NEHR) (a) how will the Ministry safeguard the confidentiality of the records as data leaks can affect a patient's employability and career prospects; (b) what security measures will be put in place to ensure that not every employee in a clinic has access to the records; and (c) what measures are put in place to prevent data breaches.

Mr Lim Biow Chuan (Mountbatten): Question No 20.

The Senior Minister of State for Health (Mr Chee Hong Tat) (for the Minister for Health): Mr Speaker, data security and protection are key considerations in the design and operation of the National Electronic Health Record (NEHR) system. This is achieved through a combination of legislative measures, data management policies, system features and public education.

All access to the NEHR system will be governed and authorised by MOH. For example, when a General Practitioner applies for an account to the NEHR, the application will be subjected to MOH’s review and approval before access is granted. Access to individual health records through the NEHR is meant for purposes of direct patient care. Beyond that, any access to individual health records, such as for purposes of coroner’s investigation, will only be granted if it is enabled by the relevant legislation. NEHR information will not be revealed to third parties like insurers and employers.

To deter unauthorised access, a two-factor authentication system has been incorporated together with features to detect suspicious access and usage. In addition, all access to the NEHR is captured in audit logs and patients will be able to view a record of accesses made to their NEHR records so that they can report unauthorised access.

When suspicious access is detected or reported, we will carry out investigations and those found to have misused the system will be dealt with under the law, in accordance to the penalties under the Cybersecurity and Computer Misuse Act and the proposed Healthcare Services Act.

Mr Speaker, to protect against cyber-attacks, the NEHR system has a multi-layered cybersecurity defence. Security penetration tests and independent cyber security audits are conducted regularly. While measures have been put in place, we need to continue to remain vigilant.