Healthcare AI Patient-Data Security Requirements

Singapore's Ministry of Health (MOH) states that mandatory data-security requirements apply to AI tools that process patient data, whether the tools are hosted on third-party cloud services or on-premise (MOH, 4 August 2026). MOH identifies the Healthcare Services Act and the Personal Data Protection Act as the legal bases for these requirements. The rule is about handling patient data in healthcare; it is not a blanket approval of every clinical AI tool or a claim that cloud hosting removes healthcare obligations.

Public-healthcare safeguards for AI providers

MOH says public healthcare institutions have adopted additional practices beyond the baseline legal requirements. AI model providers working with those institutions must give legally binding commitments that input and output data are not stored or retained, and the AI tools must be accessed from secure environments (MOH, 4 August 2026). These are safeguards described for public healthcare institutions and their providers; the parliamentary answer does not say that all AI vendors receive the same contract, nor that “no retention” replaces all other security, privacy or clinical-governance duties.

The additional public-sector practice should be read as a procurement and deployment safeguard layered on top of the legal baseline. It addresses what a provider commits to do with input and output data and where the tool may be accessed; it does not establish that the model is clinically effective, that a particular product is approved for every use, or that public institutions share one universal technical architecture. The responsible institution still has to assess the proposed use, the data involved and the controls needed for that deployment (MOH, 4 August 2026).

Cloud, on-premise and interpretation

The cloud/on-premise distinction does not determine whether the requirements apply: MOH's answer expressly covers both deployment models. A healthcare organisation considering an AI service therefore still has to address applicable data-security duties when patient data is processed through an external cloud, just as it does for an internally hosted tool (MOH, 4 August 2026). The answer is a dated parliamentary clarification of existing legal requirements and public-sector practice, not a new standalone AI licensing regime or a substitute for checking the applicable Acts and institutional controls.

In practical terms, “cloud” describes where the service is hosted, while “on-premise” describes a deployment within the organisation’s own environment; neither label answers whether patient data is being processed or what safeguards are required. A vendor’s promise not to retain data also does not by itself answer access control, secure-environment, accountability, clinical-safety or medical-device questions. Those questions must be assessed against the Healthcare Services Act, the Personal Data Protection Act, AIHGle 2.0, HSA guidance where relevant and the healthcare organisation’s own governance arrangements (MOH, 4 August 2026; MOH, AIHGle 2.0 overview).

AIHGle 2.0: lifecycle responsibilities and deployment governance

MOH and the Health Sciences Authority updated the Artificial Intelligence in Healthcare Guidelines (AIHGle 2.0) in 2026. The framework builds on the 2021 version and provides practical guidance for safe development, deployment and use of healthcare AI. It assigns clearer responsibilities across stakeholder groups: developers are responsible for responsible development, healthcare organisations as deployers must govern and deploy systems safely, and healthcare professionals as users must use them appropriately. The update also emphasises transparency to support informed decision-making and assessment and mitigation of deployment risks (MOH, Emerging regulatory policy issues, updated 13 April 2026).

AIHGle 2.0 is guidance, not a blanket exemption from the Healthcare Services Act, Personal Data Protection Act or HSA’s medical-device rules. MOH describes it as a living document that will be updated as technologies develop; healthcare institutions must therefore read it together with applicable legal obligations, clinical governance, cybersecurity controls and the risk profile of the particular system. The framework’s purpose is to support safe and trusted adoption while keeping patient safety and clinical effectiveness central (MOH, AIHGle 2.0 overview).