Healthcare Compliance in Singapore

Singapore is open to telehealth, but only inside a licence. Since 26 June 2023, teleconsultation by doctors and dentists has been a licensed mode of service under the Healthcare Services Act 2020, and online supply of prescription medicines is limited to pharmacies licensed for e-pharmacy by the Health Sciences Authority.

The Ministry of Health (MOH) licenses and polices healthcare services, the Health Sciences Authority (HSA) regulates medicines and pharmacies, the Singapore Medical Council (SMC) sets professional standards for doctors, and the Personal Data Protection Commission (PDPC) enforces the data protection law.

The biggest obstacle for a new entrant is building a clinically sound remote service: MOH has suspended and revoked licences of telehealth providers whose consultations were too short or lacked video.

1. Who regulates this sector

The Singapore Dental Council plays the SMC's role for dentists, and the Cyber Security Agency of Singapore helped MOH develop the Health Information Act security controls.

2. Licensing and authorisation

The Healthcare Services Act 2020 (HCSA) licenses services rather than premises. Each licence covers one or more modes of service delivery: permanent premises, temporary premises, conveyance and remote. Since Phase 2 began on 26 June 2023, providers of teleconsultation have needed an HCSA licence, including platform companies that engage doctors and individual doctors (MOH, Phase 2 notice).

For telemedicine, MOH requires an Outpatient Medical Service or Outpatient Dental Service licence with approval for the remote mode. Providing a licensable service without any licence is an offence under section 8 (a fine of up to S$100,000 or two years' imprisonment, or both, rising to S$200,000 for a repeat offender). A licensee that teleconsults without approval for the remote mode commits an offence under section 9 (up to S$50,000 or 12 months for a first offence, S$100,000 for a repeat). Platforms that only supply software, directory listings or payment services and give no direct medical care are not licensed (MOH, Telemedicine licensing page). Remote dental care is narrower: regulation 30 of the Healthcare Services (Outpatient Dental Service) Regulations 2023 allows it only for reviews and prescribing linked to treatment the patient has received, or will receive, in person at the licensee.

Fees

The Outpatient Medical Service licence fee is S$360 for each stand-alone mode of delivery. Teleconsultation can be bundled with a clinic and house calls for one fee (HCSA licensing portal, Outpatient Medical Service page, updated 26 March 2026).

Clinical Governance Officer

Every licence needs a Clinical Governance Officer who is resident in Singapore and a fully registered doctor with a valid practising certificate. For the remote mode, that officer must also complete MOH's telemedicine e-training.

E-pharmacy

Only Singapore businesses holding an HSA retail pharmacy or therapeutic products wholesaler's licence, assessed and approved for e-pharmacy and hosted on a Singapore domain, may supply prescription-only and pharmacy-only medicines online (HSA, e-pharmacy page, updated 23 October 2026).

3. Identity framework (AML rules do not apply)

Healthcare providers are not financial institutions or designated businesses under Singapore's anti-money laundering regime, so clinics, hospitals and telehealth platforms have no customer due diligence, risk rating or threshold reporting duties. Two general duties still apply: anyone who, in the course of business, knows or suspects that property is connected to crime must file a suspicious transaction report under section 45 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992, and information on terrorist property must be given to the Police under the Terrorism (Suppression of Financing) Act 2002 (Singapore Police Force, STR page).

Identity in healthcare is governed instead by the HCSA and its regulations (who and where a remote patient is, and whether each doctor is registered), MOH's NRIC guidelines (when and how to authenticate a patient) and HSA's e-pharmacy guidance (authenticating the prescriber).

4. Identity verification and onboarding

Identification versus authentication

MOH's guidelines draw the line that shapes every onboarding flow. An NRIC number uniquely identifies a person but is not secret and must be assumed to be known to others, so it cannot authenticate. Authentication means proving a person is who they claim to be, using something only they know, have or are. The physical card, or the digital card in the Singpass app, can authenticate when staff compare the person's face with the photograph on it; a passport photograph is an acceptable alternative.

When authentication is required

Authentication is required at a patient's first registration with an institution and at inpatient admission or day surgery; when contact details change; when a child or a patient lacking capacity is discharged to a caregiver; before access to digital services or documents containing medical information; for inbound calls seeking personal data; and for teleconsultations. After that, two or three identifiers (name, NRIC number, date of birth) generally suffice. An unconscious patient is never refused care: a temporary number is used until identity can be confirmed.

Accepted methods

For digital services, the guidelines name Singpass or SgID login. Contact details may be updated online after Singpass, SgID or an SMS one-time password to the registered mobile number. Emailed documents should be protected with a strong, randomly generated password sent out of band, and inbound callers should answer at least two challenge questions drawn from the provider's records. Providers may keep copies of identity documents in patient records, in line with the HCSA and the Personal Data Protection Act (MOH NRIC FAQs, 2 February 2026).

Verifying the clinician

Identity runs in both directions. Regulation 9 of the Healthcare Services (Outpatient Medical Service) Regulations 2023 bars a licensee from engaging anyone to practise medicine who is not a registered doctor with a valid practising certificate. MOH circular MOH-MHC-0012-2026 (6 February 2026) reminds licensees to check registration and practising certificate status before engaging any doctor, including locums and doctors working remotely, and to keep records of those checks.

5. Digital channels: what's different

Bottom line: online care needs its own licence approval and adds three checks a clinic counter does not need: confirming the patient's location, live video for first-time patients, and authentication without the patient physically present.

Identity, contact and location before every remote consultation

Regulation 29(2) of the Healthcare Services (Outpatient Medical Service) Regulations 2023 requires a licensee to ascertain a remote patient's identity, contact information and location before providing any service, to tell the patient who the treating clinician is and their role, and to keep guidelines on when remote care is suitable and when it must stop. Each remote consultation must be recorded in the patient health record with its date, time and communication method, and a website or app must display the licensee's business name, contact details, its approval for remote provision and a warning not to seek emergency care remotely. Under regulation 30, a first-time patient (anyone who has not received outpatient medical service from that licensee before) may be seen remotely only through real-time two-way audiovisual communication, or in an emergency or disaster. Regulation 31 requires video consultations to be held in a closed, private place with the clinician's face in full view, and recording needs the patient's consent. Under regulation 29(4) and (5), drugs in the First Schedule to the Misuse of Drugs Act 1973 may be prescribed remotely only if the doctor has previously examined the patient in person.

Text-only questionnaires are not enough

MOH's Licence Conditions for Remote Provision of Outpatient Medical Service (version 2.0, 10 October 2025) require written protocols ensuring that patients can communicate two-way with a clinician until care is complete; self-service text-only questions are expressly insufficient. Doctors must assess patients before prescribing or issuing medical certificates, and repeated certificates to one patient over a short period must be escalated to the Clinical Governance Officer for review. Triage by non-doctors must be supervised.

Authenticating patients on screen

For teleconsultations, MOH's NRIC guidelines recommend sending a customised link or meeting ID with a password to the patient's registered mobile number or email, or asking the patient to show their physical or digital NRIC on camera so the doctor can compare face and photograph. Where a remote service kiosk is used, version 2.0 of the licence conditions adds a private, enclosed area so that screens and conversations stay confidential.

6. Data protection and biometrics

The Personal Data Protection Act 2012 (PDPA) governs identity data captured by private providers, and MOH treats NRIC numbers as personal data subject to it. PDPC has said that organisations still using NRIC numbers to authenticate access to personal data after 31 December 2026 may be found to have failed to make reasonable security arrangements under the PDPA; MOH's guidelines also apply to vendors processing data on a provider's behalf.

The authentication methods MOH describes rely on a person comparing a face against an identity card photograph, not on automated biometric matching; the guidelines do not prescribe a liveness or face-matching standard.

Guideline A6 of the SMC Ethical Code (2016 edition) requires doctors practising telemedicine to give the same standard of care as in person or state the limits of their opinion, to protect the confidentiality of information shared through technology, and to tell patients enough about telemedicine's limits for them to consent.

7. Sector-specific obligations

Health Information Act 2026 [Adopted, phased from Sep 2027]

The Health Information Act (HIA), enacted on 3 February 2026, will require HCSA licensees and retail pharmacies to contribute key health information of citizens, permanent residents and long-term pass holders to the National Electronic Health Record (NEHR) and to meet cybersecurity and data security standards. MOH circular MOH-MHC-0018-2026 (6 March 2026) phases this in by September 2027 (general practice clinics and hospitals), September 2028 (specialist clinics, nursing homes) or March 2030 (dental, pharmacy and others). The requirements have yet to take effect; once they do, notifiable incidents must be reported to MOH within 2 hours of assessment, with a full report within 14 days. MOH states that accessing NEHR for employment or insurance purposes is an offence under the HIA.

E-prescriptions

HSA's Guidance Notes on Supply of Registered Therapeutic Products through E-pharmacy (GUIDE-MQA-032-002, 28 October 2024) require e-prescriptions to travel through a closed-loop system from clinic to pharmacy and to carry a secure, encrypted electronic signature that the pharmacy can verify to authenticate the prescriber. A fully filled e-prescription may not be reused, and only the issuing doctor may amend it, with an audit trail. E-pharmacies may not fill controlled-drug prescriptions electronically or deliver controlled drugs to homes.

8. Risk indicators and red flags

Identity and misuse indicators in healthcare

• Very short teleconsultations: the pattern behind MOH's revocation of a telehealth licence in 2024.
• Repeated medical certificates: several certificates to one patient over a short period, which MOH requires to be escalated.
• Camera-off first consultations: a new patient who cannot or will not appear on live video.
• Knowledge of an NRIC number used as proof: the number must be assumed to be known to others.
• Callers seeking another person's results: inbound calls requesting sensitive information without passing challenge questions.
• Unverified locum or remote doctors: lapsed practising certificates or no SMC registration.
• Reused or altered e-prescriptions: prescriptions not traceable to the prescribing doctor.
• Unlicensed online medicine sellers: prescription medicines offered outside HSA-licensed pharmacies.

9. Enforcement and penalties

Under section 20 of the HCSA, MOH can take regulatory action against a licensee without prosecution: suspending or revoking a licence or a mode of delivery, shortening the licence term, directing rectification, or requiring payment of a financial penalty of up to S$10,000 for each contravention (HCSA section 20(2) and (3A)). MOH must first give the licensee at least 14 days to make representations (section 21). Breaches of the remote-care rules in regulations 29 to 31 are handled this way, because regulation 38 of the Outpatient Medical Service Regulations does not make them offences. Regulation 38 does make other breaches criminal, including engaging an unregistered doctor (regulation 9), with a fine of up to S$20,000 or 12 months' imprisonment or both, plus up to S$1,000 a day for a continuing offence. Unlicensed or unapproved telemedicine is prosecuted under sections 8 and 9 of the Act.

In February 2024 MOH notified Medstar Medical Clinic & Surgery of its intention to suspend its remote mode for three months after consultations were given through an app without audio or video, which MOH assessed as a possible breach of regulation 30 (MOH, 23 February 2024). MOH revoked MaNaDr Clinic's licence from 20 December 2024 after finding a very large number of very short teleconsultations, ending its services in every mode, and referred doctors to the SMC (MOH, revocation notice).

Under the PDPA, the PDPC may impose a financial penalty of up to S$1 million or, for organisations with annual Singapore turnover above S$10 million, up to 10% of that turnover, whichever is higher (PDPC, 1 October 2022). In June 2023 it fined Fullerton Healthcare S$58,000 for failing to make reasonable security arrangements to protect patient and corporate client data, and directed it to strengthen access controls and security audits (PDPC decision, 22 June 2023).

10. Recent changes and what to watch

• 31 December 2026 [Deadline 31 Dec 2026] Private organisations must stop using NRIC numbers for authentication; PDPC steps up enforcement from 1 January 2027.
• 14 August 2026 [Adopted, phased from Sep 2027] MOH published version 2.0 of the HIA Implementation Guide; providers should plan against their batch deadline.
• 6 March 2026 [In force] MOH circular MOH-MHC-0018-2026 set the HIA timelines. MOH's NEHR page (updated 2 October 2026) says that from 2027 patients will be able to limit NEHR access to providers they select.
• 6 February 2026 [In force] MOH circular MOH-MHC-0012-2026 reminded licensees to verify registration and practising certificates of all doctors, including locums and remote doctors.
• 3 February 2026 [Enacted, not yet in force] The Health Information Act 2026 was enacted after Parliament passed the Bill on 12 January 2026.
• 2 February 2026 [In force] MOH issued its NRIC guidelines and FAQs for healthcare, effective on issue with no exceptions, including the teleconsultation authentication methods.
• 10 October 2025 [In force] Version 2.0 of the remote-provision licence conditions added privacy requirements for remote service kiosks.

11. What this means for identity verification

A telehealth onboarding flow in Singapore has to do four things that a generic sign-up does not. It must capture and confirm the patient's identity, contact details and location before any consultation. It must route first-time patients to live video. It must authenticate without relying on the NRIC number, using either a credential bound to the patient's registered contact details or a face comparison against the physical or digital NRIC (or a passport) on camera. And it must protect portal access to medical information with Singpass, SgID or a one-time password.

Document capture should accept the physical NRIC, the digital NRIC in the Singpass app and passports, since foreign patients and tourists also use teleconsultation. Re-verification is triggered by changes of contact details, standalone record requests and inbound calls seeking sensitive data, not by every follow-up. Platforms should also verify their clinicians, checking SMC or Singapore Dental Council registration and practising certificate validity before each engagement, and keep those records.