Guidance on Disclosure of Patient Medical Records to Insurers
9 January 2026 | Patient Records & Privacy | MOH Cir 02/2026
Summary
1. Background
Insurance companies regularly request patient medical information from healthcare providers for claims assessment and underwriting purposes. MOH has clarified guidelines following concerns about whether disclosure complies with patient confidentiality obligations. Key concerns: whether contractual "right to inspect and audit" clauses permit unrestricted access, and whether NEHR can be accessed for insurance purposes. This circular provides binding guidance under HCSA.
2. Key Requirements
- Patient Consent: Obtain explicit written patient consent (e.g., via MCAF or policy forms) before disclosing medical information to insurers; document consent in patient records
- Relevance Principle: Disclose only information relevant and necessary to the specific claim or underwriting assessment; withhold irrelevant details even with broad consent
- Document Format: Prepare separate medical reports, summaries, or clinical memos for insurers rather than providing raw EMR or clinical notes; raw records contain extensive irrelevant information
- Redaction in Exceptions: Only in exceptional circumstances (e.g., panel contract audits) may redacted copies of raw records be provided containing only relevant information
- Confidentiality Duty: Take reasonable steps to ensure insurers handle records confidentially; verify insurers have similar confidentiality obligations
- NEHR Absolute Prohibition: Access to NEHR for insurance purposes is strictly prohibited under all circumstances (Health Information Bill offense); NEHR is for clinical care only, never for insurance documentation
3. Action for Your Practice
- Train all staff that NEHR access for insurance is an offence; use your own EMR records only
- Develop templates for summary documents to insurers that exclude irrelevant clinical details
- For existing patients: use EMR data (which may contain validated NEHR information); for new patients: rely only on current consultation findings and history taking
- Implement process to document patient consent using MCAF or policy forms signed by patient
- Verify insurers' confidentiality obligations in writing before disclosing records
- Report inappropriate or unreasonable insurer requests to HCSA_Enquiries@moh.gov.sg
- Ensure staff understand distinction between permitted claims disclosure and prohibited NEHR access
4. Regulations and Guidelines
HCSA, SMC/SDC ECEG 2016, Healthcare Services (General) Regulations 2021 (Regulations 38(1)-(2)), Health Information Bill
Copy for WhatsApp / Telegram
𝟭. 𝗕𝗮𝗰𝗸𝗴𝗿𝗼𝘂𝗻𝗱
Insurance companies regularly request patient medical information from healthcare providers for claims assessment and underwriting purposes. MOH has clarified guidelines following concerns about whether disclosure complies with patient confidentiality obligations. Key concerns: whether contractual "right to inspect and audit" clauses permit unrestricted access, and whether NEHR can be accessed for insurance purposes. This circular provides...
𝟮. 𝗞𝗲𝘆 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀
• Patient Consent: Obtain explicit written patient consent (e.g., via MCAF or policy forms) before disclosing medical information to insurers; document consent in patient records • Relevance Principle: Disclose only information relevant and necessary to the specific claim or underwriting assessment; withhold irrelevant details even with broad consent • Document Format: Prepare separate medical reports,...
𝟯. 𝗔𝗰𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝗬𝗼𝘂𝗿 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲
• Train all staff that NEHR access for insurance is an offence; use your own EMR records only • Develop templates for summary documents to insurers that exclude irrelevant clinical details • For existing patients: use EMR data (which may contain validated NEHR information); for new patients: rely only on current consultation findings and history...
𝟰. 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻𝘀 𝗮𝗻𝗱 𝗚𝘂𝗶𝗱𝗲𝗹𝗶𝗻𝗲𝘀
HCSA, SMC/SDC ECEG 2016, Healthcare Services (General) Regulations 2021 (Regulations 38(1)-(2)), Health Information Bill
Documents
Circular