Dealmakers in Singapore's healthcare sector have started asking a question that seldom featured in their negotiations a few years ago. If a target's patient data is poorly kept, what is the business really worth? The Health Information Act, which tightens the rules on how patient records are secured, shared and used, has turned that from a technical aside into a line in the valuation. Cybersecurity, once left to the IT department, now sits beside earnings and debt in the room where prices are set.

Industry analysts describe the mechanism plainly. Weaknesses in connected medical devices, such as flawed authentication in remote monitoring tools, leave buyers with remediation costs after completion, regulatory attention and a heightened risk of litigation. The purchase price may not move by a dollar. The return does.

Advisers increasingly require evidence rather than relying on assurances, with buyers directly testing access controls and intrusion detection systems. They audit consent arrangements to establish whether data may lawfully serve research or commercial purposes, and they ask who in the target organisation answers for the accuracy of records.

The same framework marks out where value can legitimately be found. Singapore's National Electronic Health Record is closed to insurers and employers, which fixes a boundary no provider may cross. Inside it, well-run organisations can aggregate anonymised internal measures such as recovery outcomes and procedure costs, and cleaner records make a hospital group more attractive to sponsors of clinical trials. IHH Healthcare's work with Mitsui and Oncoshot illustrates the model. Cancer records are structured and anonymised for research while the raw data stays on hospital servers. Good governance, in this reading, earns money.

Britain has no market in NHS trusts, and none is proposed. The relevance lies elsewhere. The NHS holds a population dataset of exceptional depth, and the government's ambitions for life sciences and the digital shift in the 10 Year Health Plan rest on putting it to better use. Trusted research environments, the Federated Data Platform and the proposed National Data Library all assume that governance can be relied upon. That assumption has been carefully tended. OpenSAFELY and UK Biobank show that sensitive data can be opened to researchers under strict control, and the Data Security and Protection Toolkit gives the service a common baseline. The memory of care.data, abandoned a decade ago amid public unease, explains why such care is warranted.

Singapore's lesson concerns timing. In a transaction, governance is priced before commitment, and the price reflects tested evidence. Public procurement must work at far greater scale and with standard forms, and a self-assessment can confirm that controls exist without showing how they would hold under strain. The 2024 ransomware attack on a pathology supplier to London trusts is the instructive case. NHS staff kept services running with notable resolve, yet thousands of appointments and procedures were postponed, a reminder that one supplier's exposure becomes a patient's delay. The response since has been serious. The open question is how far independent testing can become routine for the suppliers holding the most sensitive records.

Resources shape what is possible. Trusts are working through waiting lists and tight budgets with a workforce that has little time to spare, and cyber resilience competes for capital with scanners and beds. Smaller organisations, among them GP practices and community services, hold sensitive records with a fraction of an acute trust's security capacity. Operators in Singapore make the same observation about their own smaller facilities, which need targeted capital and national benchmarks to keep pace. It transfers to Britain with little adjustment.

Those operators also stress that software upgrades alone do not secure compliance. Standard documentation and clear executive accountability across the whole organisation matter more. NHS boards already have senior information risk owners and Caldicott Guardians, and the useful question is whether those roles are resourced to halt a deployment when the evidence falls short.

Some practical steps follow. NHS leaders could make independently tested governance a condition of award in data-heavy procurement. Policymakers could publish national benchmarks and fund smaller providers to meet them. Life sciences and health-tech firms should expect governance quality to decide who gains access to NHS data, and invest on that footing. Patients are owed a plain account of what their records may be used for.

The NHS starts from a strong position, with data of exceptional value and a public that has, on the whole, been willing to share it. Singapore's dealmakers have shown what it looks like to demand proof of control before money or data changes hands. Adopting that habit would protect the trust on which every ambition for NHS data depends.