Blog To Collect or Not to Collect: That is the NRIC Question

You may have heard by now that, according to the Personal Data Protection Commission (PDPC), organisations in Singapore are to cease with the collection of people’s NRIC details, starting from September 2019. This is part of a greater overall effort from the government to better protect citizens’ personal data and privacy.

Does this mean that, as part of your clinic operations, you can’t take down patients’ NRIC particulars any more? Don’t worry, it doesn’t.

This is because the announcement also states that the collection of NRIC details is still allowed when it is:

1. Required under the law
2. Necessary to accurately establish or verify the identity of the individual to a high level of fidelity

That second point is the relevant one here. It goes without saying that in medical matters, the necessity to identify someone to the highest degree of accuracy is of paramount importance. It can sometimes be an afterthought, or seem like just another cog in the larger scheme of things, but accurate identification is the foundation for effective prescription of treatment and medicine.

Besides it being legal and required for healthcare matters, another reason why clinics should still collect patients’ NRIC details is the National Electronic Health Record (NEHR) system. The NEHR is growing in importance and it appears likely that contributing to it will become compulsory in the future. NRIC particulars are part of the required data to be contributed, so collecting those details is a must.

So yes, by all means do continue to collect your patients’ NRIC details!

That said, there are measures you could put in place to further secure your patients’ personal data:

Firstly, strong access controls. By clearly demarcating what information can be accessed and handled by whom, you put more measures in place to ensure that sensitive data is protected. This also makes it easier for you to track any data changes, whether in content or location, and by whom they were made, enhancing accountability standards and data security. Plato has features that can help you put these controls in place, and they are customisable to your preferences.

Secondly, there’s always a balance to be struck between privacy and identification. Information is inherently neutral; it’s what is done with it that determines if there is an issue of privacy violation or not. By emphasising the importance of carefully handling patient data to your staff, using it only for identification purposes, it will foster a culture where the sensitivity of data isn’t taken for granted.

Additionally, as a professional business and respected healthcare provider, being transparent and open with your patients about how you handle and use the personal information that they provide you will go a long way towards deepening their trust of you.

All in all, the collection of NRIC details is an important part of the treatment provision process, and you should continue to collect them! The key here is to always be mindful of the sensitivity of the data, and to have measures in place that foster responsible data management.