What Still Has to Arrive: Physical Mail in Singapore Healthcare

Singapore healthcare is digitising on a statutory timetable rather than a marketing one. The public clusters have already withdrawn paper bills and paper discharge documents by default, and Healthier SG enrolment runs on SMS. So the useful question is not whether patient mail is shrinking, but what is left when it stops.

Digital by law, not by preference

Parliament passed the Health Information Bill on 12 January 2026, the sitting at which it was tabled for second reading. MOH intends the Act to commence from early 2027. Licensed providers will have to contribute key health information to the National Electronic Health Record: allergies, vaccinations, diagnoses, medications, laboratory test results, radiological images and discharge summaries.

What patients control is access, not contribution. An Access Restriction placed through HealthHub limits which providers may view the record. From the second half of 2026 it can be narrowed further, to a single institution such as a patient's own Healthier SG clinic.

The direction is set by MOH, not by institutional preference. Anyone arguing that healthcare should keep paper because digital adoption has stalled is not describing this market.

Most patient communications belong on a screen, and already are

The communications that moved were the ones that should have moved, and naming them is the only way to be credible about the rest. NUHS institutions send an SMS when an outpatient bill is ready in the app, by the next working day after the visit. Changi General Hospital publishes the discharge summary to its app within a working day. PDPC's healthcare guidelines treat an SMS appointment reminder as the ordinary case. A letter loses each of those contests on speed and on cost.

Where the state has designed a fallback for patients who cannot use a digital channel, it has generally been a person rather than an envelope. MOH will "set up physical touchpoints" for those who need help placing Access Restrictions. Healthier SG directs residents without a mobile phone to enrolment stations and a hotline.

The gap is real but narrow. IMDA's Singapore Digital Society Report 2023, still the current edition, put Singpass app use among residents aged 60 and above at 67 per cent in 2022. Singpass is the login for HealthHub. That is a cohort, not a mailing list.

The paper that is left arrives one request at a time, with a deadline attached

Paper did not stop at the clusters. It became an exception with a published service level attached. The NUHS FAQ on going paperless states it plainly: if a paper bill is required, "You will receive your bill via post within seven (7) working days." Alexandra Hospital carries the same undertaking for a physical bill requested for claims purposes, and Changi General Hospital charges for each hardcopy discharge document it produces on request.

That work is triggered by an individual patient rather than by a calendar, and each piece sits against a deadline the institution published in writing.

In our experience it is a harder production problem than a scheduled run. On ten thousand identical statements the setup cost spreads across the run and a proof catches errors before any of them print. On a queue of single requests every setup lands on one piece, and there is no batch to absorb a mistake. Low volume is not low difficulty.

When the obligation is evidentiary

Some healthcare documents still travel physically because their legal effect depends on a registered original. MOH's Form 1 for an Advance Medical Directive must reach the Registrar "in a sealed envelope by mail or by hand", and the form itself adds that "Faxed copies will not be accepted". The directive "is only valid when it is registered", and the Registrar sends a written acknowledgement once it is. What keeps it physical is not inertia: it carries two witness signatures, one of them a registered medical practitioner's.

Other obligations are written as outcomes rather than channels. MOH's Healthcare Services Act FAQs, updated 17 January 2025, state two of them. A licensee intending to cease a licensable healthcare service "must ensure reasonable measures are taken to ensure continuity of care of the affected patient". On a licensee's demise, the estate must "take all measures as are reasonable" to notify patients of their options regarding their records.

No channel is prescribed. What is prescribed is that reasonable measures were taken, against a population the practice no longer sees.

Our read is that the operative verb across these is not send but show. A returned letter is evidence that an attempt was made and failed; a signed acknowledgement is evidence that a named person received a named document. An unopened email is evidence of neither. Whether a particular notice discharges a particular duty is a question for your legal advisers, not for a lettershop.

Your print vendor is a data intermediary, and you stay accountable

This is what healthcare procurement asks about first. PDPC's Guide for Printing Processes for Organisations states that "As they handle personal data in the process of printing, print vendors are considered Data Intermediaries", carrying the Protection and Retention Limitation obligations themselves. Its companion guide on accidental disclosure adds, at paragraph 4.3, that organisations "may be held liable for the actions or omissions of its data intermediary".

Engaging a fulfilment partner does not move your obligation. It gives you a counterparty whose controls you can inspect and contract for.

PDPC's worked examples cover both sides of the channel divide. One is a mail vendor mis-sorting a batch into envelopes addressed to the wrong recipients. Another is a medical clinic whose email of patient health records reached an unrelated party because the address auto-completed. Paper is not inherently safer. The controls are different, and PDPC has set out the print-side ones:

• Correct sorting technique, so names and addresses cannot be mismatched after a merge.
• Acceptance tests covering incomplete and incorrect inputs.
• Second-layer supervisory checks that recipients match the letter and its attachments, plus random sampling across batches.
• Verification that the right return envelope went into the right pack.
• Restricted mailroom access with a documentary record, and secure disposal afterwards.

That list is what a lettershopping operation should be able to evidence. Our answer on recipient matching is barcode-matched insertion verified by an inline scanner, covered in our piece on data security in physical mail. Transfer, access and purge controls sit with secure data printing.

Be precise about assurance scope. Our mailroom, messaging and local courier services are audited under the ABS OSPAR programme, a banking-sector framework that does not extend to printing or lettershopping. Healthcare questions are PDPA-shaped and deserve a PDPA-shaped answer.

What to do with the tail

The residue of physical mail in healthcare is small and getting smaller, and every piece of it carries a named patient and a published deadline. Four things are worth doing regardless of who produces the work.

• List every communication you still send on paper, with the reason. Where the reason is habit rather than a requirement, an evidentiary need or an unreachable recipient, move it.
• Measure the service levels you have already published. A promise nobody times is a promise nobody keeps.
• Name an owner for the postal address field. Mobile numbers get corrected at every visit because everything runs on them; the postal address is only exercised when someone asks for paper.
• Ask whoever produces the work to walk you through PDPC's control list item by item, and to show you the reconciliation record for a completed run. If neither exists, that is your answer.

This article describes published regulatory material for general information and is not legal or clinical advice. Positions cited are current as at 28 July 2026; the Health Information Act had not commenced at the time of writing.