Health Data Infrastructure in Singapore: Why Foundation Models Need System-Level Governance

Health Data Infrastructure in Singapore: Why Foundation Models Need System-Level Governance

A new foundation model trained on 4.5 million patient records can predict clinical diagnoses years before they occur [3]. For Singapore hospital CIOs and clinical informatics teams, this represents both opportunity and operational risk: our health data infrastructure wasn't designed for models that learn across institutions, and our governance frameworks haven't caught up to the scale of data these systems require.

This post is for hospital executives, clinical informatics leaders, and AI governance teams in Singapore who need to understand what system-level AI governance means when foundation models move from research to deployment.

Key takeaways

• Foundation models trained on multi-institution EHR data (like TRACER, trained on 4.5M patients across four health systems) can predict incident disease years in advance, but require data infrastructure and governance that spans organizational boundaries [3]
• Singapore's Model AI Governance Framework provides principles but lacks operational guidance for multi-institutional data sharing, longitudinal EHR access, and federated model training [1]
• Recent international case studies show that successful AI adoption in healthcare requires system-level coordination—not just institutional policies—particularly for data provenance, ethics training, and deployment oversight [2, 5]
• Data provenance gaps in health AI education mean many practitioners don't examine how training data were generated, a root cause of clinical AI failures [5]
• Singapore hospitals need governance infrastructure that addresses cross-cluster data access, temporal data rights, and model update protocols before deploying foundation models trained on population-scale EHRs

What foundation models mean for Singapore health data infrastructure

TRACER (Temporal Risk Assessment with Clinical EHR Representations) is a decoder-based foundation model pretrained on longitudinal EHR data from over 4.5 million patients across four health systems [3]. It's designed to predict incident diagnoses years before they occur—a capability that could transform disease screening in Singapore.

But here's the infrastructure problem: TRACER was trained on data from four health systems. In Singapore, that would mean coordinating data access across multiple public healthcare clusters (SingHealth, NUHS, NHG) and potentially private institutions. Our current health data infrastructure is cluster-specific. Electronic medical record systems, data warehouses, and governance policies operate within institutional boundaries.

Foundation models don't respect those boundaries. They need:

• Longitudinal patient data spanning years, often across multiple care episodes and institutions
• Standardized data schemas so that "hypertension" coded in one cluster's EMR means the same thing in another's
• Temporal access rights that account for when data were generated, when consent was obtained, and when models were trained
• Cross-institutional governance for model updates, performance monitoring, and incident response

Singapore's Personal Data Protection Act (PDPA) and the Model AI Governance Framework [1] provide principles—transparency, explainability, human oversight—but they don't specify how to operationalize multi-cluster data sharing for foundation model training. That's a system-level infrastructure gap.

Why Singapore's governance framework needs operational translation

Singapore's Model AI Governance Framework, published by PDPC, is principle-based and sector-agnostic [1]. It emphasizes internal governance structures, risk management, and human oversight. For a single hospital deploying a radiology AI model, these principles translate reasonably well into operational policies.

For a foundation model trained on 4.5 million patients across multiple institutions, they don't.

Consider data provenance. A recent cross-sectional analysis of U.S. health AI education programs found that many curricula don't teach practitioners to examine how training data were generated—yet "failures of deployed clinical AI systems have often originated in how their training data were generated" [5]. In Singapore, we face the same gap: our governance frameworks emphasize using data responsibly, but they don't specify infrastructure for tracking data lineage across institutions, versioning training datasets, or auditing which patient cohorts contributed to which model versions.

International case studies published this month in the Journal of the American Medical Informatics Association [2] examined system-level approaches to AI adoption in healthcare across multiple countries. The findings: successful AI implementation requires coordination mechanisms that span organizational boundaries—shared data standards, cross-institutional ethics review, and federated governance structures. Singapore has strong institutional governance within each cluster, but limited infrastructure for system-level coordination.

This matters because foundation models trained on multi-institutional data can't be governed by a single institution's IRB or data governance committee. Who owns the model? Who monitors performance drift when patient populations shift? Who decides when to retrain? These are system-level questions that require system-level infrastructure.

The data provenance problem in Singapore healthcare AI

When we work with clinical AI services teams in Singapore hospitals, one of the first questions we ask is: "Can you trace every data point in your training set back to its source encounter, consent event, and data transformation pipeline?"

Most teams can't. Not because they're careless, but because the infrastructure doesn't exist.

Data provenance—the ability to track where data came from, how they were transformed, and who has access—is foundational to trustworthy AI. The recent study on health AI education [5] found that U.S. programs often don't teach this. In Singapore, we face a similar gap, compounded by the fact that our health data infrastructure was designed for clinical care and billing, not for AI model training.

For foundation models like TRACER [3], data provenance becomes even more critical:

• Temporal validity: A model trained on 2020–2024 data may not generalize to 2026 patient populations, especially post-pandemic
• Cohort representation: If training data over-represent certain demographics or disease severities, the model inherits those biases
• Consent scope: Patients who consented to "research" in 2020 may not have anticipated their data being used to train a foundation model deployed in 2026

Singapore hospitals need infrastructure that captures data provenance at the point of generation—not retroactively. That means:

• Metadata pipelines that tag every data point with source system, extraction date, transformation history, and consent version
• Versioned datasets so that when a model is retrained, we know exactly which patient cohorts contributed to which version
• Audit trails that link model predictions back to training data, enabling root-cause analysis when predictions fail

This isn't a policy problem. It's an infrastructure problem. And it needs to be solved at the system level, not cluster by cluster.

What domain generalization means for Singapore's rural-urban divide

A preprint published this week [11] addresses "domain generalization with adversarially chosen domains"—the problem of training models at data-rich institutions that still work when deployed in data-scarce rural populations. The motivation: predictive models trained at well-resourced hospitals often fail in new populations.

Singapore doesn't have a rural-urban divide in the traditional sense, but we do have a data-rich/data-scarce divide:

• Tertiary hospitals (SGH, NUH, TTSH) have mature EMR systems, research data warehouses, and AI deployment experience
• Community hospitals and polyclinics have less data infrastructure, smaller patient volumes, and limited AI expertise

If we train foundation models on tertiary hospital data and deploy them in community settings, we face the same domain generalization problem. Patient populations differ. Care pathways differ. Data quality differs.

The solution isn't just better models—it's better infrastructure for federated learning and cross-site validation. Singapore's National Electronic Health Record (NEHR) provides a technical foundation, but we need governance infrastructure that enables:

• Federated model training where each site contributes to model development without sharing raw patient data
• Cross-site validation protocols that test models on held-out data from institutions not represented in training
• Performance monitoring dashboards that track model accuracy across different care settings and patient subgroups

This requires system-level coordination. A single hospital can't solve domain generalization on its own.

Why this matters in Singapore

Singapore's healthcare system is uniquely positioned to deploy foundation models at scale. We have:

• Integrated public healthcare clusters with shared EMR systems within each cluster
• National Electronic Health Record (NEHR) that aggregates data across clusters
• Strong data protection regulation (PDPA) and a government-backed AI governance framework [1]
• Research infrastructure (PRECISE, SingHealth Duke-NUS, NUHS) with experience in large-scale clinical data science

But we also have gaps:

• No operational framework for multi-cluster data sharing for AI model training
• Limited infrastructure for data provenance, versioned datasets, and federated learning
• Unclear governance for models trained on data from multiple institutions—who owns the model? Who monitors it? Who decides when to retrain?

The international case studies [2] show that countries with successful system-level AI adoption invested in coordination mechanisms before deploying models at scale. Singapore has the technical foundation. We need the governance infrastructure to match.

What to do next

For hospital CIOs, clinical informatics leaders, and AI governance teams in Singapore:

• Audit your data provenance infrastructure: Can you trace every data point in your training sets back to source encounters, consent events, and transformation pipelines? If not, build metadata pipelines that capture provenance at the point of data generation.
• Establish cross-cluster governance working groups: Foundation models trained on multi-institutional data can't be governed by a single institution's IRB or data committee. Coordinate with other clusters to define shared governance protocols for model ownership, performance monitoring, and incident response.
• Invest in federated learning infrastructure: Before deploying models trained on centralized multi-cluster data, pilot federated learning approaches that enable model training without raw data sharing. This reduces privacy risk and builds trust across institutions.
• Require data provenance training: Ensure that your AI teams—data scientists, clinical informatics staff, and governance committees—understand how to examine training data lineage. The recent study [5] shows this is often missing from health AI education.
• Pilot cross-site validation protocols: Before deploying a model trained at a tertiary hospital in a community setting, validate performance on held-out data from the target site. Build infrastructure for ongoing performance monitoring across care settings.

If you're planning to deploy foundation models or multi-institutional AI systems in Singapore healthcare, start a project with our team. We help hospitals build the governance infrastructure—data provenance pipelines, federated learning protocols, cross-site validation frameworks—that foundation models require.

FAQ

What is a foundation model in healthcare?

A foundation model is a large-scale AI model pretrained on broad data (in this case, longitudinal EHR data from millions of patients) that can be adapted to multiple downstream tasks—disease prediction, risk stratification, clinical decision support. TRACER [3] is an example: trained on 4.5 million patients across four health systems to predict incident diagnoses years in advance.

Does Singapore's Model AI Governance Framework cover multi-institutional AI?

Singapore's Model AI Governance Framework [1] provides principles—transparency, explainability, human oversight—but it's sector-agnostic and doesn't specify operational protocols for multi-cluster data sharing, federated model training, or cross-institutional governance. Hospitals need to translate these principles into infrastructure and operating procedures.

What is data provenance and why does it matter for clinical AI?

Data provenance is the ability to trace where data came from, how they were transformed, and who has access. It matters because "failures of deployed clinical AI systems have often originated in how their training data were generated" [5]. For foundation models trained on millions of patient records, provenance infrastructure enables auditing, bias detection, and root-cause analysis when predictions fail.

How can Singapore hospitals prepare for foundation models?

Start by building infrastructure for data provenance (metadata pipelines, versioned datasets, audit trails), establishing cross-cluster governance working groups, and piloting federated learning approaches. Foundation models require system-level coordination—not just institutional policies—so invest in coordination mechanisms before deploying models at scale.

Sources

[1] Singapore Model AI Governance Framework — PDPC Singapore. https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework

[2] Cresswell K, Mozaffar H, Anderson S. International qualitative case studies of system-level approaches to promote the development, adoption, and implementation of artificial intelligence in healthcare. Journal of the American Medical Informatics Association : JAMIA. 2026 Nov 1. https://pubmed.ncbi.nlm.nih.gov/42709998/

[3] TRACER, a time-to-event EHR foundation model for disease detection across health systems. arXiv cs.LG+clinical. 2026-10-29. https://arxiv.org/abs/2610.40536v1

[5] Data Provenance and Ethics in the Curricula of U.S. Health AI Education Programs. arXiv cs.AI+health. 2026-10-29. https://arxiv.org/abs/2610.39606v1

[11] Rural Readiness: Domain Generalization with Adversarially Chosen Domains. arXiv cs.LG+clinical. 2026-10-29. https://arxiv.org/abs/2610.40468v1