Requirements for a medical clinic website in 2026: 36 points of verification according to Ministry of Health Order No. 118n, PP No. 659, and 152-FZ for a medical business owner

You invest in medical marketing, bring patients to the site, and wait for doctor appointments. But what does the patient see a second before submitting the form: an up-to-date price list, license information, and clear appointment terms — or an old PDF, a non-working button for the visually impaired, and a 'Agree to everything' checkbox?

For a clinic owner, order on the site is part of business management. Prices, documents, doctor profiles, and form functionality must match what happens in the clinic. This helps the patient choose a service, the administrator to process the request, and the manager to control mandatory information and data processing.

Check the medical organization's website before increasing the advertising budget. Below is 36 control points for the owner, head physician, and marketer: what to check with HR, what task to set for the developer, and how to accept the result. Based on Ministry of Health Order No. 118n, Paid Services Rules No. 659, Laws No. 152-FZ, No. 323-FZ, and No. 38-FZ.

STARCODE handles the entire audit and technical improvement cycle: we conduct an audit, create a plan, fix online appointment forms and pages, set up the request route, and verify the result. See the scope of work and options for getting the clinic's website in order.

The legal framework is analyzed in a review article on requirements for a medical organization website in 2026. Here is an applied check: from the ERUL license to the request received in the CRM.

How medical organization websites are checked: remote viewing, registers, and patient complaints

To identify some problems on the site, a visit to the clinic is not required: published information is available remotely. However, it does not follow that all checks are automated or that any discrepancy immediately turns into a fine.

• Remote viewing. As part of legally provided measures without interaction, the agency can study published information. Check the site as if it were opened for the first time by a patient or an inspector.
• Reconciliation with documents and registries. Compare license information with ERUL, details with EGRUL/EGRIP, and doctors' data with HR documents and data available to the clinic in the FRMR. Do not substitute status verification with a fancy scan.
• Check data processing. The text of the PDn Policy must correspond to the operation of forms, widgets, and analytics. Include browser requests, application handler, and contractor transfers in the technical audit.
• Patient request. Inconsistent prices, payment terms, and research preparation instructions can be grounds for a complaint. The manager's task is to eliminate discrepancies in advance and ensure a clear procedure for requests.

Three main regulations: No. 118n, rules No. 659, and 152-FZ

For the matrix, we use Ministry of Health Order No. 118n, rules for paid services No. 659, and Law No. 152-FZ. Mandatory and conditional points below are separated by applicability.

Four common violations: where patients are lost and complaints arise

Express audit: six critical nodes for the manager and head physician

Start with these nodes. They link published documents, patient actions, and the clinic team's work.

Block A. Information about the clinic according to No. 118n: license, doctors, and accessibility — points 1–12

Ministry of Health of Russia Order No. 118n dated 13.03.2025 has been in effect since September 1, 2025, replacing No. 956n. Collect information in the accessible 'About the Medical Organization' section and check its applicability to your clinic's activities.

1. Full name of the medical organization, OGRN, and TIN. Mandatory Specify the full and abbreviated name of the legal entity or individual entrepreneur, registration details, and applicable information about founders. Check the header, footer, PDn Policy, and contract template: the patient must understand which organization is providing the service.
2. Addresses of clinic branches and directions. Mandatory Publish the legal address, addresses of medical care locations, registry phone numbers, email, and directions. Match the locations of licensed services with the current registry record; do not confuse the administrative office with the patient reception address.
3. Structure of the medical organization and governing bodies. Mandatory Show departments and subdivisions, management, and applicable information about governing bodies. Update the full name and positions of the head physician, director, and department heads in case of personnel changes.
4. Clinic operating mode and schedule. Mandatory Specify the operating hours of the medical organization and its branches on weekdays, weekends, and holidays. Coordinate information on the website, signage, maps, and with the administrator so the patient does not arrive at a closed door.
5. Schedule for personal citizen reception by management. Mandatory Post the days and hours of reception by the manager or authorized persons, contact phone number, and email for inquiries. Verify that one can actually reach a responsible employee through the specified method.
6. Contacts of regulatory authorities. Mandatory Check names, addresses, and phone numbers of the regional health authority, territorial bodies of Roszdravnadzor, and Rospotrebnadzor. Do not copy contacts from the website template of another region.
7. Medical worker profiles and accreditation. Mandatory For medical workers, check the full name, position, education, organization and year of issue of the document, specialty and qualification, accreditation or certificate details and expiration date, work schedule, and reception hours. Verify data against personnel documents and FRMR information available to the clinic. Post necessary information; exclude extra data from scans, including passports and SNILS.
8. Information about medical license and extract from ERUL. Mandatory Specify the registration number, date of issuance, licensing authority, and details of permitted work. Verify the status and addresses in the registry. A practical confirmation method is a current electronic extract from the Unified Register with a readable QR code; an old scan does not show the current status of the record.
9. Appointment for initial reception and preparation for examinations. By clinic profile Describe the procedure for booking a consultation and diagnostics. Add preparation notes for the studies you perform: ultrasound, MRI, CT, endoscopy, tests. If there is a hospital, check the rules and documents for hospitalization.
10. Patient rights, state guarantee program, and drug lists. Considering the activity Post information about citizens' rights, the procedure, and conditions for providing care under the state guarantee program and the territorial program. Check applicable lists of medicines and the relevance of documents. Information about free care is not limited solely to the clinic's participation in MHI.
11. Vacancies and independent quality assessment. Considering the activity Update information about job vacancies. Check the applicability of requirements for independent quality assessment, posting results, and surveying service recipients according to Order No. 118n and healthcare legislation; do not determine it solely by the presence of an CHI contract.
12. Website accessibility for the visually impaired. Mandatory Check text scaling without overlapping, contrast, text descriptions for significant images, and the ability to navigate and use the form via keyboard. Use GOST R 52872-2019 as a benchmark for technical verification. The button with glasses should help the patient use the site.

Block B. Paid services according to No. 659: price list, agreements, and online payment — points 13–21

Grounds — Government Decree of the Russian Federation dated 30.05.2026 No. 659. The owner's task is to coordinate service pages, the price list, payment terms, and the contract with the patient.

13. Compliance of services on the website with the ERUL license. Mandatory Compare the directions and work offered at each address with the valid license. If the clinic promotes pediatric dentistry, cosmetology, or anesthesiology, check the corresponding list of work at the location of their provision; the advertising name of a service does not replace such reconciliation.
14. Price list in rubles and Nomenclature of medical services. Mandatory Check current prices and names against the Ministry of Health's valid Nomenclature. For complex offers like 'Women's Health Check-up' or 'Turnkey Professional Hygiene', disclose the composition. If the price is 'from', explain the terms for calculating the total and provide access to the full price list.
15. Samples of contracts for paid medical services. Mandatory Publish readable samples of contracts according to rules No. 659. Take into account the options used by the clinic: adult patient, legal representative of a child, customer and consumer as different persons. Check the details and version date.
16. Payment terms and prepayment refund policy. Mandatory Describe the procedure for settlements and available payment methods: cash, cards, SBP, VHI — based on the actual terms of the clinic. Specify the procedure for issuing a receipt and processing a return. Coordinate formulations regarding refusal of service with the law and actually incurred expenses.
17. Links to legal information and clinical guidelines. Mandatory Check the links provided by rules No. 659 to the official portal of legal information and the rubricator of clinical guidelines of the Ministry of Health, as well as information on applicable standards. Open the links from a phone: they must lead to a functioning resource.
18. Informing about free medical care. Mandatory Check how the patient learns about the possibility of receiving relevant types and volumes of care without charge within the state guarantee program before signing a contract. The clinic's paid format does not cancel the mandatory informing required by the rules.
19. Waiting periods and benefits. By situation Specify applicable wait times for assistance and terms for paid services. If benefits or discounts are established for specific patient categories, explain the conditions and supporting documents. Deadlines in advertising, contracts, and administrator bookings must be consistent.
20. Complaints and issuance of medical documents. Mandatory Make the procedure for inquiries and claims, methods for obtaining copies of medical documentation, extracts, and payment certificates clear. Check the recipient's authority, timelines, and issuance procedure according to applicable regulations, including Art. 22 of 323-FZ law.
21. Remote agreement and online payment. During remote registration If an agreement is concluded through the site, check section VI of the rules No. 659: information before registration, method of conclusion, payment, and confirmation to the patient. Online appointment for a callback in itself is not equal to an agreement for a paid service; telemedicine requires a separate check.

Block C. 152-FZ and medical confidentiality: forms, consents, and request route — points 22–32

Health data belongs to a special category under Article 10 of Law No. 152-FZ. The fact of seeking medical help is protected by Article 13 of Law No. 323-FZ. Check the composition of data, the legal basis, and the recipients of the request, not just the presence of documents.

22. Data processing policy for clinic processes. Mandatory Provide access to the Personal Data Policy on data collection pages. Specify the real goals of the site, data composition, storage periods, and processing participants: hosting, CRM, MIS, call tracking, analytics. The document must correspond to the actual request route.
23. Grounds for processing and separate consents. Mandatory Determine the grounds for processing for booking and other purposes under Article 6 of Federal Law No. 152-FZ. When consent is used, issue it separately from the confirmed documents under Article 9. Promotional SMS and emails require separate verification of consent; do not make booking an appointment dependent on subscribing to promotions.
24. Empty checkboxes and action confirmation. Mandatory Leave consent checkboxes empty: the patient expresses their decision themselves. If the basis is consent, store confirmation of its receipt, the time, and the version of the text. A checkmark does not replace the content of the document or the legally required consent form.
25. Minimizing online booking fields. Mandatory For a callback request, a name and phone number are usually sufficient. Remove the unnecessary medical questionnaire: symptoms, diagnoses, analysis files. If the clinic needs to collect health information, define the basis, consent requirements, and secure process separately; a regular contact form does not replace it.
26. Reviews, treatment stories, and patient photos. Upon publication Check consent for the distribution of PDn under Art. 10.1 of 152-FZ law, the medical confidentiality regime under Art. 13 of 323-FZ law, and the grounds for using images. For advertising creatives, additionally consider the restrictions of the advertising law: patient consent does not override them.
27. Notification in the Roskomnadzor operators register. Mandatory Check compliance with the notification duty under Art. 22 of 152-FZ law and the accuracy of information. Compare actual purposes and data categories, used information systems, and stated processing terms with the website and the PDn Policy.
28. Localization of databases for Russian citizens. Mandatory Check compliance with Part 5 of Art. 18 of 152-FZ law during online collection. Determine where recording, systematization, accumulation, storage, clarification, and extraction are performed. Include form handlers, CRM, MIS, and backups in the check; a Russian hosting address by itself does not describe the entire chain.
29. Cross-border transfer and foreign services. When transferring abroad Check foreign chats, analytics, CDN, maps, cloud spreadsheets, and messengers: whether they receive personal data and to which country. Before transmission, fulfill the applicable requirements of Art. 12 of 152-FZ law. In case of detected illegal transmission, restrict it and agree on an acceptable architecture.
30. Protection of contacts and medical confidentiality in analytics. Technical check Exclude the inclusion of phone numbers, full names, and the content of the request in URLs, goal parameters, session recordings, and third-party widgets. Check field masking, selected processing grounds, and cookie banner operation. Evaluate events related to delicate services along with visitor identifiers.
31. Delegation of processing to contractors. Mandatory Determine the role of external services and access to applications. When a contractor processes data on behalf of the clinic, formalize the terms under Part 3 of Article 6 of Federal Law No. 152-FZ: goals, data composition, operations, confidentiality, security, and the parties' obligations.
32. HTTPS/TLS, CMS access, and backups. Technical check Check the secure connection of forms, certificate validity, employee rights, and admin panel protection against password brute-forcing. Appoint responsible persons for CMS updates, backup, and recovery. Control access to logs and application exports.

Block D. Medical advertising according to 38-FZ: warnings, labeling, and promises — points 33–36

Check Art. 18.1 and 24 of 38-FZ law, considering the object and format of the advertisement. An information page and an advertising creative may require different approaches.

33. Russian language and understandable service names. Mandatory Check mandatory information for the patient in Russian. For Check-up, Anti-Age, Lifting, and other foreign words, evaluate the necessity of explanation or translation, taking into account current rules and exceptions. A commercial name must not hide the composition of a medical service.
34. Reference information and labeling of internet advertising. By placement method Evaluate the content and method of highlighting the material according to Law No. 38-FZ. A catalog, promotions on your own site, a persistent pop-up, and advertising from a third-party manufacturer require verification in a specific context. For material with signs of internet advertising, determine the obligations under Art. 18.1, including labeling and accounting.
35. Warning about contraindications. For medical service advertising Check the warning required by Part 7 of Art. 24 of 38-FZ law. For standard graphical internet placement — at least 5% of the advertising space; video and other formats have their own terms and exceptions. The text must be readable on an actual mobile banner.
36. Result promises, safety, and advertising reviews. By advertising object Check the reliability of '100% result', 'in one visit', 'without complications', and 'pain-free' promises. Consider the restrictions applicable to a specific object of medical advertising, including references to recovery cases and testimonials. Rely on verifiable information about equipment, qualifications, and the procedure for providing care.

Control scheme: how the patient's application should reach the clinic

Below is an example of a route for a callback form without collecting a medical questionnaire. Processing locations and protection measures are checked for the entire chain.

1. 01Landing pageService, price, terms
2. 02FormRequired fields and grounds for processing
3. 03ProcessorHTTPS, data verification and storage in the Russian Federation
4. 04CRM / MISAccess for responsible employees
5. 05RegistryReceived application and connection with the patient

Check the branches separately: advertising pixels, Webvisor, chats, email, and notifications. Contacts and the content of the request must not be uncontrollably funneled into these channels.

The first three minutes of the check: what the owner and marketer can do

Start with the advertising landing page. These steps help to notice obvious errors; go through the technical part with a developer.

1. Open the site on a smartphone in a private window. Find the price, full price list, and documents. Check if the booking button is blocked, if the warning on the ad banner is readable, and if the consent checkboxes are empty.
2. Look at external connections. On your computer, open Network in developer tools. Do not limit yourself to Fetch/XHR: data can be transmitted via images, beacons, and WebSocket.
3. Check cookie selection. Compare loading before selection, after refusing non-essential resources, and after consent. Compare behavior with stated purposes and processing grounds.
4. Send a coordinated test application. Warn the administrator, use fictitious data without diagnoses and documents. Check the receipt of the request, the address bar, and analytics parameters. Do not use a random person's phone number.

Control table for the manager: errors and acceptance criteria

Turnkey clinic website audit and improvement at STARCODE

It is convenient to work in stages: first, restrict critical data transmission and form errors, then reconcile documents, prices, and accessibility. We fix the composition and timelines after reviewing the website, CMS, branches, and integrations.

1. Closing priority form and data risks. We check fields, grounds, consents, PDn Policy, and third-party scripts. We fix the handler and unnecessary transmissions to analytics.
2. Putting information about the clinic in order. Based on confirmed data, we update doctor profiles, license information, contracts, payment methods, and mandatory links. The clinic confirms the authenticity of the documents.
3. Reconciling the price list, advertising, and accessibility. We reconcile service pages with the price list, check advertising wording and warnings, test the interface and arrival of applications in CRM.

For a separate preliminary assessment of data processing, use risk calculator according to 152-FZ. Applicability of standards, responsibility, and the scope of corrections are determined by the clinic's activities and actual processes.