What Singapore’s new health data law means for patients in the AI age

PICTURE this: A 78-year-old man collapses in his flat at 2 am. His daughter calls for an ambulance. Paramedics arrive fast, and what helps them move faster is what they can see on their devices: his medications, allergies and recent test results, pulled up in seconds. In the emergency room, decision-support tools flag a drug interaction before it becomes a mistake.

Now imagine the same moment, except the record is unavailable because a connected provider has been hacked. Doctors work off information fragments. His family scrambles to recall details. Care slows. Although hypothetical, this situation reveals how cybersecurity could directly affect patient safety.

Singapore’s new Health Information Bill (HIB), passed in January 2026, is about to wire up healthcare in a way that makes artificial intelligence-assisted care routine, and puts cyberresilience at the centre of how care is delivered.

By connecting key patient information across hospitals, clinics and labs through the National Electronic Health Record, it enables faster, more coordinated and increasingly AI-assisted care.

When the HIB takes effect in 2027, patients will be participants in a data ecosystem where their medical information flows across multiple entities. From that point, system reliability will affect how care is delivered day to day.

But for patients, the question is simpler: When your record is shared across the system, who else can access it? And what happens when it isn’t available?

A connected system raises the stakes for patients and healthcare providers

Healthcare is a favoured cybercrime target globally because it runs complex networks, relies on many partners and cannot afford downtime.

Singapore has seen the stakes at first hand. In 2018, attackers stole the personal data of 1.5 million SingHealth patients and medication records of 160,000 individuals. The breach did not derail the Republic’s digital ambitions, but it showed how quickly public confidence can be shaken when health information is involved.

In his Budget 2026 remarks, Prime Minister Lawrence Wong said Singapore remains an attractive target for malicious cyber actors, and that attacks are becoming more frequent and sophisticated as the city-state strengthens its defences.

In healthcare, disruption creates appointment backlogs, diversions and avoidable clinical risk.

AI systems learn and become more useful when they can access more data. As systems become more interlinked, however, a serious vulnerability in one part of the ecosystem can quickly have an impact on others.

When access to medical data is disrupted, clinical decisions, response times and patients themselves are affected. In cybersecurity terms, the “blast radius” expands.

Cybersecurity in healthcare today has evolved beyond an IT concern to a component of patient safety, because trust breaks the moment care cannot rely on records.

Singapore’s healthcare data governance framework is widely regarded as robust, with strong safeguards on access and usage. The HIB builds on this foundation by strengthening coordination across the system.

The challenge now is ensuring that these safeguards stay effective as AI is embedded into more workflows. This raises a fundamental question: What does it mean to trust a system that knows more about you than ever before?

From protecting data to earning trust in the AI age

Apart from system resilience, another concern is how healthcare data is being used.

In the past, health records were largely static, simply used by clinicians to treat existing conditions. Today, with advances in AI, health data is increasingly predictive. Medical histories, prescriptions and diagnostic results can also help anticipate future risks and care needs.

On its own, this is a powerful enabler of preventive care. But as datasets grow and systems connect, the risk is no longer only about stolen data. It is also about misuse, including convincing impersonation scams or scams that feel legitimate precisely because they are grounded in real details.

In the hands of clinicians, health data can elevate care. In the wrong hands, it can be used to deceive or disrupt.

The risk in an AI-driven environment, therefore, is that highly contextual information can be used to craft personalised interactions that feel legitimate precisely because they are grounded in reality. Whether in the form of targeted scams or more subtle forms of profiling, the line between beneficial use and misuse can become increasingly blurred.

From a patient’s standpoint, several expectations become critical.

First, transparency. Patients should have clarity on who is accessing their data, for what purpose and under what safeguards. As AI use grows, it becomes even more important to keep data use clear, consent-driven, and tied clearly to patient care.

Stronger transparency should be built across the healthcare data chain with clearer notification standards (especially around data sharing), plain-language explanations, and accessible access logs through platforms such as HealthHub.

Second, accountability. There must be clear responsibility when data is misused or when systems fail.

Third, security by design. Protection cannot be an afterthought; it must be embedded into the architecture of how data is stored, shared and accessed.

Finally, purpose limitation. Data collected for care should not gradually extend into uses that patients neither expect nor consent to.

Just as importantly, basic cyberhygiene will go a long way in reducing the risk of cybersecurity incidents.

Singapore is entering a new phase of digital healthcare with the HIB, but, in the end, the measure of success is not how seamlessly data moves across the system, but whether patients remain willing to share it and remain confident that it will be used to care for them.

The real test of connected care is trust.

The writer is country manager, Singapore and Asia, at Eset, a software company specialising in cybersecurity