Singapore legislation
Clause 40
Clause 40
Offences relating to unauthorised disclosure of accessible health information
(1)
A user or an authorised individual of a user must not disclose accessible health information about any individual, or any document that reproduces (fully or substantially) accessible health information about any individual, to any other person, unless the disclosure —
is necessary for the administration or execution of anything under this Act;
is required or permitted under this Act or any other written law, or by an order of court; or
is to any person or class of persons to whom, in the Minister’s opinion, it is in the public interest to disclose the accessible health information.
(2)
A person who is not a user or an authorised individual of a user must not disclose accessible health information about any individual, or any document reproducing (fully or substantially) accessible health information about any individual, unless the disclosure is required or permitted under this Act or any other written law, or by an order of court.
(3)
A person who contravenes subsection (1) shall be guilty of an offence and shall be liable —
on the first conviction — to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both; and
on a second or subsequent conviction — to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 4 years or to both.
(4)
A person who contravenes subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 4 years or to both.
(5)
A person does not contravene subsection (1) or (2) only because any information about an individual that is disclosed by the person, or is stated or contained in any document disclosed by the person, is identical or substantially similar to accessible health information about that individual.
(6)
It is a defence in any proceedings for an offence under subsection (3) or (4) for the accused to prove, on a balance of probabilities, that the accused did not know, and had no reason to believe, that the accused had disclosed accessible health information about an individual or a document reproducing (fully or substantially) accessible health information about an individual, as the case may be.
(7)
It is not a defence in any proceedings for an offence under subsection (3) or (4) that the accused disclosed accessible health information about an individual on the basis that the individual has consented or has given his or her consent in accordance with Part 4 of the Personal Data Protection Act 2012 or such consent is not required under that Part.