HEALTH PROMOTION BOARD
Data Protection Policy
Last Revision Date: 2 March 2007
The Health Promotion Board ("the Board") will routinely collect health related data, including personal, demographic, medical and financial data ("Data"), from individuals as it strives to fulfill its function as the health promotion agency in Singapore.
Adequate policies and procedures have been put in place by the Board to protect the confidentiality of the Data that it has collected and to safeguard the interests of the individuals.
Collection of Data
The Board will generally seek an individual's expressed or implied consent for the collection, use and disclosure of the individual's Data. The granting of consent will not be a condition for the supply of any service. An individual is also entitled, at any time after having granted his consent, to write in to inform the Board's Quality Service Manager of the withdrawal of his consent. The Board will, after being so informed, continue to maintain the relevant Data in its custody, but will not use or disclose the Data to any other party except in an aggregate1 form.
The Board may, in the following situations, collect, use or disclose Data without an individual's consent:
- The Data is generally available to the public.
- The Data is necessary to render a service that the individual has applied for.
- The Data is required by law.
- The Data is for research or statistical purposes, and that the results of the research or statistical processing would lead to an aggregate or de-identified2 Data and would not lead to identification of an individual by any reasonably foreseeable means.
- The collection, use or disclosure of Data is clearly in the individual's interest.
- It is impracticable to obtain the individual’s consent at the point of collection, use or disclosure, and if it were practicable for the individual to grant such consent, the individual would be likely to give it.
- Legal, medical, or security reasons make it impossible or impractical for the Board to seek the individual's consent.
- In an emergency that threatens the life, health or security of the individual or community.
Processing and maintenance of Data
The Board has procedures in place to protect the confidentiality of collected Data. Data stored in the Board's computer systems are protected from unauthorised access by appropriate security technologies. Only the authorised staff of the Board will have access to Data on a need-to-know basis.
Use and disclosure of Data
The Board will use collected Data in accordance with the purposes authorised by an individual or in those certain specific situations described in the second paragraph of the aforesaid section titled "Collection of Data".
The Board may be requested to disclose collected Data, in the form of aggregate, deidentified, key-coded3 or identifiable4, to other Government agencies, Statutory Boards, health care providers, and scientific researchers etc. The Board will only approve of the release of the requested Data to the said parties if the Data is required for a valid purpose.
The Board will apply a stringent approval criteria where the Data requested is identifiable or requested for research purposes.
The Board will not approve the release of Identifiable Data to health care providers5 unless one of the following conditions is satisfied:
- The healthcare provider who had supplied identifiable Data to the Board requests the release of the said Data.
- The health care provider had obtained the consent of the relevant individual from whom the identifiable Data had been collected.
The Board will not consider any request for Data submitted by external researchers unless the Ethics Committee of the researcher's institution has approved the relevant research project. All requests for Data for research purposes will undergo stringent consideration by the Board.
Further, the Board will not release any Data to any requesting party unless that party agrees to maintain the confidentiality of the Data supplied and to use the said Data only for the specific purposes approved by the Board.
The Board will not release collected Data to any commercial businesses or insurance companies.
Access to and correction of Data
An individual may, at any time, requests details of the Data that the Board has collected from him, or information relating to the Board's use and disclosure of his Data, from the relevant Division of the Board or the Quality Service Manager.
The Board has the discretion to decide whether to provide the requested information and the terms on which the said information is provided to the said individual. The Board has the discretion to refuse to provide the requested information in the following situations:
- Information requested relates to Data that is maintained by the National Disease Registries Office;
- Information requested would reveal Data that cannot be disclosed by the Board on the grounds of public policy, legal, security or commercial proprietary reasons;
- The request would be too costly for the Board to comply with; or
- The request is frivolous or vexatious.
An individual may also, at any time, contact the relevant Division of the Board that has collected the information from him, or the Board's Quality Service Manager, to amend his Data on the basis that the Data collected or maintained by the Board is inaccurate or incomplete. Satisfactory evidence must be provided to prove the inaccuracy or incompleteness of the Data. The Board will correct its records after the request has been verified and approved.
Amendments
The Board reserves the right to amend its data protection policy and the information it has published in relation to the said policy from time to time. While the Board takes reasonable care to ensure that information published about its said policy is up-to-date, the Board does not guarantee the accuracy or completeness of such information.
Feedback
The Board welcomes all feedback in relation to its data protection policy. All feedback should be addressed to the Board’s Quality Service Manager.
Quality Service Manager
Tel: 1800-4353192
Email: hpb_mailbox@hpb.gov.sg
