HIA compliance has two cost buckets: your clinic system and your cybersecurity work - and government grants cover most of both if you apply in time. The real number to plan for is the recurring cost from year 3. This page breaks the costs down so you can budget with your eyes open.
The 30-second version:
HIA compliance costs fall into two buckets: the clinic system (HIMS) and the cybersecurity & data security (CS/DS) work. The NEHR Connect Grant gives GPs a fixed S$8,400 (about two years of system subscription), and separate schemes fund 50-80% of the security work. Apply in time and most of your setup is grant-covered; the cost to actually plan for is the recurring subscription from year 3.
Want the full HIA picture first? Read the pillar: Health Information Act (HIA): What It Means for Your Clinic
The two cost buckets
Every HIA cost a clinic faces falls into one of two buckets, and each has its own funding:
- Bucket 1 - the clinic system (HIMS). A system that’s certified to contribute to NEHR. Funded by the NEHR Connect Grant (NCG).
- Bucket 2 - cybersecurity & data security (CS/DS). The security measures the HIA requires, including the Cyber Essentials Mark. For a GP clinic, funded mainly by CISOaaS and PSG (a third scheme, TSS Part C, is only for NCSS community-care members - see below).
The mistake that costs clinics money is treating this as one bill. The NCG will not pay for your security work, and the security grants will not pay for your system. You claim from the right scheme for the right bucket.
Bucket 1: your clinic system
For a GP clinic, the NEHR Connect Grant is a fixed S$8,400 - structured to cover roughly two years of subscription on a compliant cloud system. Other service types get different amounts (nursing home S$14,400; hospitals up to 40% capped at S$200,000). For the amount by service type, see the NEHR Connect Grant guide.
Two things to note about this bucket:
- It’s a subscription, not a one-time purchase. The grant offsets roughly the first two years. After that, the subscription is a recurring operating cost - see the year-3 note below.
- The grant follows the certified system. You qualify by being on a Synapxe-certified HIMS, so choosing a certified provider is what unlocks the funding in the first place.
Bucket 2: cybersecurity & data security (and the CE Mark)
The HIA also requires you to meet the CS/DS Essentials: access controls, backups, incident handling, staff awareness, and more. For a typical GP clinic, two schemes fund this work:
| Grant | Covers | Amount |
|---|---|---|
| CISO-as-a-Service (CISOaaS) · CSA | Qualified CS/DS consultants (apply via IMDA’s CTOaaS portal) | Up to 70% |
| Productivity Solutions Grant (PSG) · EnterpriseSG | Security tools (firewalls, antivirus) | 50%, cap S$30k |
PSG is for SMEs, which MOH defines as a business registered in Singapore with ≤S$100m turnover or ≤200 employees. Most independent GP clinics qualify comfortably; a clinic that’s part of a much larger group should confirm it still meets one of those.
There’s a third scheme, TSS Part C (80%, cap S$40k), but it’s only for Members of the National Council of Social Service (NCSS) - community-care organisations such as nursing homes and eldercare VWOs, not commercial GP clinics. If that’s not you, plan around CISOaaS and PSG.
What the Cyber Essentials Mark costs
The Cyber Essentials (CE) Mark is one of the three things a HIMS needs to be certified, and clinics often ask what it costs to obtain. The honest answer: there’s no single fixed price as the certification fee is set by the appointed certification body and varies with your setup.
The more useful point is that the preparation work is grant-funded: closing your security gaps to reach the CE Mark standard is exactly what CISOaaS (consultants) and PSG (tools) pay for. So while the certification fee itself varies, most GP clinics carry only a fraction of the total once those grants are applied.
One caveat for your budget: the government funding applies to the initial certification only. The CE Mark is renewed typically every ~2 years, and renewals are borne fully by the clinic - so factor renewal into your recurring costs, not just the first year.
The year-3 question: one-time vs. recurring
This is the part budgets miss. HIA compliance is not a single bill you pay once - it’s a mix of one-time and recurring costs:
- Largely one-time (and heavily grant-covered): moving to a compliant system, the initial security setup, and getting certified.
- Recurring (yours to carry): the clinic system subscription beyond the grant quantum, plus ongoing security upkeep - backups, monitoring, staff training, periodic review, and Cyber Essentials Mark renewal (~2 years, fully clinic-borne).
Because the NCG covers roughly your first two years of subscription, the number to actually plan for is the annual cost from year 3, once the grant has been used. A clinic that budgets only for setup gets a surprise in year 3; a clinic that budgets for the recurring subscription from the start doesn’t.
A rough picture for a GP clinic
Putting the two buckets together, here’s the shape of the cost (not a quote - amounts depend on your provider and setup):
| Cost item | One-time or recurring | Funding |
|---|---|---|
| Compliant clinic system (HIMS) | Recurring subscription | NEHR Connect Grant (~2 years covered) |
| NEHR onboarding | One-time (up to ~5 weeks) | No grant - mainly staff time (*) |
| Security setup + tools | Mostly one-time | CISOaaS (up to 70%), PSG (50%) |
| Cyber Essentials Mark certification | Periodic (renew ~2 years) | Initial: CISOaaS + PSG (prep); renewals: clinic-borne |
| Ongoing security upkeep | Recurring | No grant - operating cost |
* NEHR onboarding isn’t a government fee - it’s a ~5-week process with your provider, so the real cost is mainly staff time. Whether your provider charges a separate setup fee or bundles it into the subscription varies, so ask them directly.
The headline: apply for every grant your buckets qualify for, and most of your setup is covered. What’s left is the recurring subscription and upkeep - a normal operating cost, not a compliance shock.
How to keep the cost down
- Apply for the grant in each bucket - not just the NCG. Many clinics claim the system grant and forget the security schemes, then pay for CS/DS work themselves.
- Apply before your deadline. The grant application window closes on your service-type deadline and late applications are rejected. For GPs that’s 31 August 2027. See the deadline by clinic type.
- Choose a certified system that bundles the security work. If your provider gets you certified and helps close the CS/DS gaps, you claim from fewer places and avoid paying a separate consultant.
- Budget for year 3 now. Treat the recurring subscription as a normal operating line, so the end of the grant window isn’t a surprise.
Next steps
Want to know exactly which costs and grants apply to your clinic? Start with the HIA compliance checklist to see where you stand, or the NEHR Connect Grant guide for the system funding in detail.
Prefer a single path that covers both buckets and gets you certified so you qualify for the grants? See how that works →
Official sources: healthinfo.gov.sg ↗ (MOH) · Synapxe NEHR.
This article summarises MOH’s HIA Implementation Guide for general information only; it is not legal or financial advice. Grant amounts, caps, and eligibility are set by the respective agencies and may change - verify at healthinfo.gov.sg before acting.