Regulatory compliance for a clinic website: how to protect the business from blocks and fines by supervisory authorities
The website of a modern medical clinic, dental practice, or diagnostic center has long ceased to be just a business card. Today, for supervisory authorities, it is an official digital representative of a medical organization, subject to strict state control by three agencies at once: Roszdravnadzor, Rospotrebnadzor and Roskomnadzor, as well as the prosecutor's office.
C September 1, 2026 new Rules for the provision of paid medical services, approved by Government Resolution of the Russian Federation No. 659 (which replaced the former rules). Simultaneously in effect are Order of the Ministry of Health of Russia No. 118n (which finally repealed the obsolete Order No. 956n), as well as toughened amendments to the law "On Personal Data" No. 152-FZ (including Law No. 156-FZ on separate consents).
In this material, STARCODE experts have compiled a comprehensive technical and legal checklist: what every clinic page must contain, how to properly format doctor profiles, price lists, online booking forms, and protect the business from the risks of injunctions and fines. Also, based on these requirements, we have launched a service of auditing and bringing a clinic website into compliance with 152-FZ and the Ministry of Health with an interactive risk calculation calculator.
What changed from September 1, 2026
A key innovation of autumn 2026 is the entry into force of Decrees of the Government of the Russian Federation dated 30.05.2026 No. 659. The document regulates the rules for providing paid services, remote contract conclusion, and sets strict requirements for price transparency:
- Remote contracts (Section VI, clauses 40–48): if the website allows online payment for consultations, telemedicine appointments, or booking with a deposit deduction, the clinic is required to post an approved form of the contract and remote service rules before funds are collected, and after the conclusion, provide the patient with a confirmation with the contract number or identifier.
- Accessibility of the price list (clauses 12–18): it is forbidden to hide the composition of services and the conditions for their execution. Prices must be indicated strictly in rubles with a breakdown of the name according to the Nomenclature of Medical Services. When using a promotional "starting from" price, a link to a detailed price list with the exact scope of procedures must be placed nearby.
- Informing about free alternatives (clause 7): the patient must be clearly informed before signing the contract about the possibility of receiving similar medical help for free under the Compulsory Medical Insurance (OMS) program within the framework of territorial state guarantees.
What must be on the clinic's website
The structure of a medical organization's website must contain an isolated section "Information about the Medical Organization" (often placed as a separate page with a link in the main menu and footer). In accordance with Appendix No. 1 to Order No. 118n, the mandatory elements include:
- Full and abbreviated name of the legal entity or full name of the individual entrepreneur, OGRN, TIN, and legal address.
- Directions, operating hours, contact telephone numbers, and email addresses of each branch.
- Information on the medical activity license: ERUL registration number, date of issue, QR code of the Roszdravnadzor extract, or electronic extract with a qualified electronic signature.
- Information about the clinic's structure and governing bodies.
- Schedule of reception of citizens by the head and authorized persons.
Ministry of Health Order No. 118n: new standards replacing 956n
Order of the Ministry of Health of Russia dated 13.03.2025 No. 118n regulates both the informational content and technical functions of the official resource:
- Version for the visually impaired: a button to switch to a special mode for people with visual impairments is mandatory according to GOST R 52872-2019 (font size adjustment, contrast, color scheme, and disabling background graphics).
- Site map and site-wide search: Appendix No. 2 (clause 2) explicitly mandates the existence of a site map and a functional site-wide search across all sections of the resource.
- Evaluation of service quality: clause 7 of Appendix No. 2 provides for the technical possibility of conducting online patient surveys regarding the quality of medical service conditions.
- Information about patient rights: excerpts from Law No. 323-FZ "On the Fundamentals of Protecting the Health of Citizens in the Russian Federation", preparation procedures for examinations, and up-to-date contact information for supervisory bodies.
Doctors, education, and accreditation: how to format a profile
For every medical professional providing consultations, structured information must be published (clause 3 of Appendix No. 1 to Order No. 118n):
- Full name, position held, and specialty according to the diploma.
- Level of professional education, name of the issuing organization, year of graduation.
- Information about the specialist certificate or periodic accreditation (number, specialty, expiration date).
- Working schedule and outpatient consultation hours.
Important advice: to comply, a neat text block with credentials is sufficient. Publishing scans of diplomas and passports is not required — this creates direct risks of excessive disclosure of employee personal data.
Requirements of 152-FZ for medical websites and booking forms
Medical websites are under the heightened attention of Roskomnadzor. Information about booking appointments with narrow specialists (oncologist, narcologist, psychiatrist, gynecologist) reveals the fact of seeking medical help and relates to special categories of personal data about health status (art. 10 of Federal Law No. 152-FZ).
"Even simply indicating a patient's surname and the name of a doctor's specialty in a web form reveals the fact of seeking medical help, which constitutes medical confidentiality. Any leak of such data entails increased sanctions from supervisory authorities, turnover fines, and administrative suspension of activities."
Patient booking forms: checkbox rules according to Law No. 156-FZ
As of September 1, 2025, the Federal Law entered into force No. 156-FZ, which explicitly prohibited combining consent for personal data processing with an offer, clinic rules, or marketing newsletters (Art. 9 of Law No. 152-FZ).
Key rules for forms on a clinic website:
- Minimizing fields: for a callback request, the fields "Name" and "Phone" are sufficient. Do not include fields in open forms for describing a diagnosis, symptoms, or attaching test results without specialized encryption.
- Unchecked checkbox: the consent checkbox must be empty by default — the user must mark it consciously and voluntarily.
- Separate consents: consent for the processing of contact information and consent for advertising SMS/newsletters must be two independent items with separate checkboxes.
- Accessibility of documents: the text of the Personal Data Processing Policy (Part 2 of Art. 18.1) and the text of the consent itself must be accessible in one click without reloading the page.
Cookie, Yandex Metrica and advertising pixels
Web analytics counters (Yandex Metrica, social media pixels) record IP addresses, device identifiers (Client ID), and the history of visited pages. If a user studies a treatment page for a specific disease, this data is linked to their digital profile.
Solution: implementing a Cookie banner that blocks trackers from starting until the "Accept" button is explicitly clicked and allows for consent withdrawal. Furthermore, the patient database and the website server must be physically localized within the territory of the Russian Federation in accordance with part 5 of Art. 18 of Law No. 152-FZ, and the clinic must be registered in the Roskomnadzor operators registry (Art. 22).
Typical violations on clinic websites and Code of Administrative Offenses fines
According to the results of control activities by Roszdravnadzor, Rospotrebnadzor, and prosecutor monitoring, the most frequent grounds for injunctions and judicial fines remain:
| № | Detected violation | Article of the Administrative Code of the Russian Federation | Fine for legal entities |
|---|---|---|---|
| 1 | Data processing without proper consent or incompatible with the purposes of collection | part 1 of Art. 13.11 | 150 000 – 300 000 ₽ |
| 2 | Lack of mandatory written consent (when the law requires written form) | part 2 of Art. 13.11 | 300 000 – 700 000 ₽ |
| 3 | Repeated violation of personal data collection | part 2.1 of Art. 13.11 | 1 000 000 – 1 500 000 ₽ |
| 4 | Lack of an extract from the ERUL with a license QR code | Part 3 of Art. 14.1 / Part 1 of Art. 14.8 | 30,000 – 40,000 ₽ (or from 5,000 ₽) |
| 5 | Incomplete information about accreditation and doctor schedules | part 3 of Art. 14.1 | 30 000 – 40 000 ₽ |
| 6 | Lack of a version for the visually impaired according to GOST R 52872-2019 | Art. 9.13 | 20 000 – 30 000 ₽ |
| 7 | Lack of a sample contract and rules per RF Government Decree No. 659 | part 1 of Art. 14.8 | warning or 5,000 – 10,000 ₽ |
| 8 | No mention of the state guarantee program for free medical care | part 1 of Art. 14.5 | 30 000 – 40 000 ₽ |
💡 Assess your website's fine risks in 60 seconds:
An interactive tool is available on the service page: select the key parameters of your website and instantly calculate your level of vulnerability to Roskomnadzor and the Ministry of Health.
Calculate clinic risks using the online calculator →Checklist: check your website in 5 minutes
Quick express check:
Don't want to check manually?
Analysis of medical websites shows: most clinics have at least 2–3 critical vulnerabilities that entail direct risks of injunctions during Roskomnadzor monitoring or prosecutor's supervision.
On the service page Bringing clinic websites into compliance with 152-FZ and Ministry of Health requirements you can get a free express vulnerability calculation or order a comprehensive turnkey implementation (from re-laying out forms and blocking cookies to ERUL registration and a set of legal documents).
Regulatory primary sources
- Decree of the Government of the Russian Federation of 30.05.2026 No. 659: clauses 7, 12–18 and section VI.
- Order of the Ministry of Health of Russia of 13.03.2025 No. 118n: annexes No. 1 and No. 2.
- Federal Law No. 152-FZ "On Personal Data", Article 9: separate consent and written form.
- Law No. 152-FZ, Article 10: special categories of personal data regarding health status.
- Law No. 152-FZ, Article 18.1: obligations of the operator and access to the data processing policy.
- Law No. 152-FZ, Article 18: data collection and physical localization of databases in the Russian Federation.
- Law No. 152-FZ, Article 22: notifying Roskomnadzor about personal data processing.
- Article 13.11 of the Code of Administrative Offenses of the Russian Federation: administrative offenses in the field of personal data.