Consent, privacy and communication
Applying the PDPA, the Healthcare Services Act and your Board’s confidentiality standards in everyday Singapore practice
Registered health professionals in Singapore: doctors, nurses and midwives, dentists and oral health therapists, pharmacists, optometrists and opticians, and allied health professionals.
Structured learning and a written reflection to show insight after a complaint, an investigation or a board inquiry.
Focused learning on a core standard of practice, with a certificate and reflection for your portfolio.
This course explains how health professionals in Singapore should collect, protect, use and share patient information. It works through the Personal Data Protection Act 2012 obligation by obligation, from consent and notification to access, protection, retention and mandatory data breach notification, and connects them with the Healthcare Services Act 2020, the Infectious Diseases Act, the Criminal Procedure Code and the confidentiality provisions of each Professional Board.
It is written for doctors, nurses and midwives, dentists and oral health therapists, pharmacists, optometrists and opticians, and allied health professionals registered with the SMC, SNB, SDC, SPC, OOB or AHPC. It is relevant for routine professional development and for practitioners responding to a data breach, a confidentiality complaint or a concern raised by an employer, the PDPC or their Board.
Confidentiality in Singapore is shaped by close family involvement in care, a multilingual and densely connected community, the National Electronic Health Record and the coming Health Information Act, and specific statutes on infectious diseases, HIV and police investigations. Through Singapore case studies, the course covers disclosure decisions involving families, insurers, employers and the police, public interest disclosures, digital and AI risks, breach response, PDPC and Board processes, and how to show insight and remediation if things go wrong.
10 sections · 24 lessons · 3 hours (estimated) · 20-question final assessment
Final assessment
20scenario-based questions
Certificate of completion
A certificate of completion for your learning portfolio.
The course includes a structured reflective account template: guided prompts to record what you learned, how you will apply it and how the change will show in your practice. It gives you written evidence of insight after a concern, and a ready record for your CPD portfolio.
Write it in your own words and leave out anything that could identify a patient, a colleague or a case. If you have an open complaint or case, talk to your adviser before reflecting on it in writing.
Yes. The PDPA applies to private clinics, hospitals, pharmacies and dental and allied health practices, and the PDPC has taken enforcement action against public healthcare organisations, including after the 2018 SingHealth cyberattack. HCSA licensees also have a separate duty under the Healthcare Services (General) Regulations 2021 to keep patient health records confidential. Where another written law, such as the Infectious Diseases Act, sets a specific requirement, that law prevails over the PDPA.
A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. Breaches involving prescribed classes of health information, such as HIV, sexually transmitted diseases, schizophrenia, substance addiction, abortion or suicide attempts, are deemed to cause significant harm whatever the number affected. The PDPC must be notified within 3 calendar days of assessing a breach as notifiable, and affected individuals as soon as practicable. The course walks through the C.A.R.E. response.
Only what the patient has consented to and what is relevant to the purpose. MOH Circular 02/2026 tells licensees to provide reports or summaries rather than raw records, disclose nothing irrelevant to the claim whatever the scope of consent, and never use NEHR for insurance purposes. SMC guidance states that employers have no automatic right to confidential medical information and diagnoses should not appear on medical certificates without consent.
When the law requires it, for example Infectious Diseases Act notification or a court order; when the law authorises it, such as a written police production order under the Criminal Procedure Code or the narrow HIV contact provisions of IDA s 25A; or when there is a serious risk of harm that justifies disclosure in the public interest. The course gives a seven-question framework for making and recording these decisions.
An adult with capacity decides who may receive their information, so ask early and record their wishes. Donees under a registered Lasting Power of Attorney and court-appointed deputies may need information to make decisions when a patient lacks capacity. The course also covers requests to withhold a diagnosis from a patient, adolescents, and requests about patients who have died, to whom PDPA disclosure and protection rules apply for ten years.
It may count towards your CME or CPE requirements only if your Board, or the relevant accreditor, accepts it, so check before relying on it. You receive a certificate of completion and a structured reflection for your learning records.
Yes. It explains PDPC investigations and enforcement, Board and MOH processes and employer investigations, and shows how to demonstrate insight and verified remediation. If a Board committee has ordered specific training, check with the Board that this course meets the terms of the order before enrolling.
Every legal and regulatory point comes from primary sources: the Acts that set up each professional board, the boards' own codes and guidance, and the Ministry of Health. Anything we cannot confirm is left out.
Lessons, scenarios and assessment questions are written by us for each edition separately, then checked for accuracy, teaching quality and fair assessment before publication.
When a code, standard or law changes, the affected courses are reviewed and updated. Reported errors in legal or regulatory facts are corrected first.
Clear, honest and defensible notes for Singapore practice: what a good entry contains, late entries and corrections, AI scribes, PDPA access requests and MOH retention periods.
Honest communication when care goes wrong: SMC ECEG C13, board codes, MOH serious reportable events, apology, family-centred disclosure and accurate records.
What happens after a complaint to your clinic or your board in Singapore, from the SMC Inquiry Committee to the SNB and SPC, and how to write an honest, well-evidenced response.
