Regulatory compliance for a clinic website: how to protect the business from blocks and fines by supervisory authorities
The website of a modern medical clinic, dental practice, or diagnostic center has long ceased to be just a business card. Today, for supervisory authorities, it is an official digital representative of a medical organization, subject to strict state control by three agencies at once: Roszdravnadzor, Rospotrebnadzor and Roskomnadzor, as well as the prosecutor's office.
C September 1, 2026 new Rules for the provision of paid medical services, approved by Government Resolution of the Russian Federation No. 659 (which replaced the former rules). Simultaneously in effect are Order of the Ministry of Health of Russia No. 118n (which finally repealed the obsolete Order No. 956n), as well as toughened amendments to the law "On Personal Data" No. 152-FZ (including Law No. 156-FZ on separate consents).
In this material, STARCODE experts have compiled a comprehensive technical and legal checklist: what every clinic page must contain, how to properly format doctor profiles, price lists, online booking forms, and protect the business from the risks of injunctions and fines. Also, based on these requirements, we have launched a service of auditing and bringing a clinic website into compliance with 152-FZ and the Ministry of Health with an interactive risk calculation calculator.
What changed from September 1, 2026
From September 1, 2026, Decree of the Government of the Russian Federation of 30.05.2026 No. 659 are in effect. For the website, information about the contractor and services from clauses 12–18 is important, and in case of remote contract conclusion, section VI as well:
- Remote contracts (Section VI, clauses 40–48): if the website allows online payment for consultations, telemedicine appointments, or booking with a deposit deduction, the clinic is required to post an approved form of the contract and remote service rules before funds are collected, and after the conclusion, provide the patient with a confirmation with the contract number or identifier.
- Accessibility of the price list (clauses 12–18): it is forbidden to hide the composition of services and the conditions for their execution. Prices must be indicated strictly in rubles with a breakdown of the name according to the Nomenclature of Medical Services. When using a promotional "starting from" price, a link to a detailed price list with the exact scope of procedures must be placed nearby.
- Informing about free alternatives (clause 7): the patient must be clearly informed before signing the contract about the possibility of receiving similar medical help for free under the Compulsory Medical Insurance (OMS) program within the framework of territorial state guarantees.
What must be on the clinic's website
The composition of information is checked according to Order of the Ministry of Health of Russia of 13.03.2025 No. 118n, Appendix No. 1. For the patient's convenience, information can be collected in a separate section with accessible navigation; the list also depends on the organization's activities:
- Full and abbreviated name of the legal entity or full name of the individual entrepreneur, OGRN, TIN, and legal address.
- Directions, operating hours, contact telephone numbers, and email addresses of each branch.
- Information on the medical activity license: ERUL registration number, date of issue, QR code of the Roszdravnadzor extract, or electronic extract with a qualified electronic signature.
- Information about the clinic's structure and governing bodies.
- Schedule of reception of citizens by the head and authorized persons.
Ministry of Health Order No. 118n: new standards replacing 956n
Ministry of Health Order No. 118n is in effect since September 1, 2025. Appendix No. 1 describes the information content, Appendix No. 2 covers requirements for its placement and accessibility:
- Version for the visually impaired: a button to switch to a special mode for people with visual impairments is mandatory according to GOST R 52872-2019 (font size adjustment, contrast, color scheme, and disabling background graphics).
- Site map and site-wide search: Appendix No. 2 (clause 2) explicitly mandates the existence of a site map and a functional site-wide search across all sections of the resource.
- Evaluation of service quality: clause 7 of Appendix No. 2 provides for the technical possibility of conducting online patient surveys regarding the quality of medical service conditions.
- Information about patient rights: excerpts from Law No. 323-FZ "On the Fundamentals of Protecting the Health of Citizens in the Russian Federation", preparation procedures for examinations, and up-to-date contact information for supervisory bodies.
Doctors, education, and accreditation: how to format a profile
For every healthcare professional conducting appointments, structured information must be published (Clause 6 of Annex No. 1 to Order No. 118n):
- Full name, position held, and specialty according to the diploma.
- Level of professional education, name of the issuing organization, year of graduation.
- Information about the specialist certificate or periodic accreditation (number, specialty, expiration date).
- Working schedule and outpatient consultation hours.
Important advice: to comply, a neat text block with credentials is sufficient. Publishing scans of diplomas and passports is not required — this creates direct risks of excessive disclosure of employee personal data.
Requirements of 152-FZ for medical websites and booking forms
Health data belongs to special categories of data under Article 10 of Law No. 152-FZ. The composition of the request, the purpose, and the basis for processing must be evaluated separately: not every callback form contains health information, but diagnoses, test results, and treatment descriptions require special verification.
Practical conclusion from STARCODE: do not collect health information in a regular callback form unnecessarily. If required, determine the basis for processing, the required form of consent, the circle of recipients, and protection measures in advance. The type of liability depends on the actual violation.
Patient booking forms: checkbox rules according to Law No. 156-FZ
From September 1, 2025, Article 9 of Law No. 152-FZ requires consent to be obtained separately from other documents that are confirmed or signed. First, the legal basis for processing is determined; if it is consent, its content and method of acquisition must comply with the purpose and the form required by law.
Key rules for forms on a clinic website:
- Minimizing fields: for a callback request, the fields "Name" and "Phone" are sufficient. Do not include fields in open forms for describing a diagnosis, symptoms, or attaching test results without specialized encryption.
- Unchecked checkbox: the consent checkbox must be empty by default — the user must mark it consciously and voluntarily.
- Separate consents: consent for the processing of contact information and consent for advertising SMS/newsletters must be two independent items with separate checkboxes.
- Accessibility of documents: part 2 of Article 18.1 of Law No. 152-FZ requires providing access to the policy, including data collection pages. Accessible links near the form help meet this requirement; the lack of a page reload is an interface convenience, not a separate legal requirement.
Cookie, Yandex Metrica and advertising pixels
Web analytics counters (Yandex Metrica, social media pixels) record IP addresses, device identifiers (Client ID), and the history of visited pages. If a user studies a treatment page for a specific disease, this data is linked to their digital profile.
STARCODE decision: we check what data trackers receive and on what basis. If consent is used, we delay the launch of relevant trackers until the visitor makes a choice. Part 5 of Article 18 of Law No. 152-FZ establishes requirements for databases of citizens of the Russian Federation during collection, with exceptions provided by law; this is not a universal requirement for hosting all static website content. Notification duty and exceptions are checked according to Article 22.
Typical violations on clinic websites and Code of Administrative Offenses fines
Below are the possible compositions of violations and sanction guidelines for legal entities. According to Article 13.11 of the Code of Administrative Offenses of the Russian Federation, the lack of mandatory written consent and other processing violations are different compositions. Specific qualification is established based on circumstances; the absence of a separate element on the site does not in itself determine the fine.
| № | Detected violation | Article of the Administrative Code of the Russian Federation | Fine for legal entities |
|---|---|---|---|
| 1 | Processing without a legal basis or incompatible with the purposes of collection | part 1 of Art. 13.11 | 150 000 – 300 000 ₽ |
| 2 | Lack of mandatory written consent (when the law requires written form) | part 2 of Art. 13.11 | 300 000 – 700 000 ₽ |
| 3 | Repeated violation of requirements for mandatory written consent | part 2.1 of Art. 13.11 | 1 000 000 – 1 500 000 ₽ |
| 4 | Lack of an extract from the ERUL with a license QR code | Part 3 of Art. 14.1 / Part 1 of Art. 14.8 | 30,000 – 40,000 ₽ (or from 5,000 ₽) |
| 5 | Incomplete information about accreditation and doctor schedules | part 3 of Art. 14.1 | 30 000 – 40 000 ₽ |
| 6 | Lack of a version for the visually impaired according to GOST R 52872-2019 | Art. 9.13 | 20 000 – 30 000 ₽ |
| 7 | Lack of a sample contract and rules per RF Government Decree No. 659 | part 1 of Art. 14.8 | warning or 5,000 – 10,000 ₽ |
| 8 | No mention of the state guarantee program for free medical care | part 1 of Art. 14.5 | 30 000 – 40 000 ₽ |
💡 Assess your website's fine risks in 60 seconds:
An interactive tool is available on the service page: select the key parameters of your website and instantly calculate your level of vulnerability to Roskomnadzor and the Ministry of Health.
Calculate clinic risks using the online calculator →Checklist: check your website in 5 minutes
Quick express check:
Don't want to check manually?
Analysis of medical websites shows: most clinics have at least 2–3 critical vulnerabilities that entail direct risks of injunctions during Roskomnadzor monitoring or prosecutor's supervision.
On the service page Bringing clinic websites into compliance with 152-FZ and Ministry of Health requirements you can get a free express vulnerability calculation or order a comprehensive turnkey implementation (from re-laying out forms and blocking cookies to ERUL registration and a set of legal documents).
Regulatory primary sources
Sources verified .
- Decree of the Government of the Russian Federation of 30.05.2026 No. 659 — Rules for paid medical services: points 7, 12–18 and section VI; in effect since September 1, 2026.
- Order of the Ministry of Health of Russia of 13.03.2025 No. 118n — Appendixes No. 1 and No. 2: content and form of information on medical sites. Copy of the document text on the NMIC site.
- Law No. 152-FZ, Article 9: consent to data processing — Separate arrangement of consent, confirmation of its receipt, and cases of mandatory written form.
- Law No. 152-FZ, Article 10: special categories of data — Health data: processing restrictions and exceptions provided by law.
- Law No. 152-FZ, Article 18.1: duties of the operator — Organizational measures and access to the personal data processing policy, including their collection pages.
- Law No. 152-FZ, Article 18: collection and localization of data — Part 5: requirements for databases of citizens of the Russian Federation during collection, taking into account the exceptions established by law.
- Law No. 152-FZ, Article 22: notification of Roskomnadzor — Notification before the start of processing; exceptions are listed in part 2 of the article.
- Code of Administrative Offenses of the Russian Federation, Article 13.11: violations of data processing — Different violation compositions and sanctions; part 2 concerns consent that is mandatory in written form.
Applicability of norms and liability depend on the activity, data composition, and circumstances of the violation. Before making changes, check the current version of the document.
