SingHealth breach review recommends remedies that should already be basic security policies