Bringing the site into compliance with 152-FZ and Ministry of Health requirements

Home/Services/152-FZ and the clinic website
Legislative compliance 2026

Protect your clinic and website from Roskomnadzor fines of up to 700,000 – 1,500,000 ₽ and claims from Roszdravnadzor

C September 1, 2026 new Rules for the Provision of Paid Medical Services came into effect (Decree of the Government of the Russian Federation No. 659), which replaced the previous norms No. 736. At the same time, updated requirements are in effect Order of the Ministry of Health of the Russian Federation No. 118n (replaced Order No. 956n), regulating the mandatory composition of information on a medical organization's website: from license QR codes to information about each doctor's accreditation.

In parallel, control has tightened on 152-FZ 'On Personal Data' (amendments to Federal Law No. 156-FZ and multiple increase in fines for Federal Law No. 420-FZ): consent to the processing of personal data must now be formalised strictly separate from any other documents and offers. For bundled checkboxes or improper consent, fines for legal entities are increased to 300 000 – 700 000 ₽ (Part 2 of Art. 13.11 of the Code of Administrative Offenses of the Russian Federation), and in case of a repeated violation — up to 1 500 000 ₽.

We conduct a technical and legal website audit, develop personalized legal documents, and implement turnkey software solutions: from smart cookie banners to structured doctor registries and license extracts.

  • Clinic website audit according to 25+ control points of 152-FZ, Order No. 118n, and RF Government Decree No. 659
  • Separate checkboxes and logging of user consents (IP, timestamp, version)
  • Adaptive Cookie banner with real Yandex Metrica and Google Ads blocking until consent
  • Formatting the license block with a clickable QR code for the registry extract
  • Layout of doctor pages with qualification, accreditation, and current reception schedule

up to 1.5 million

Fine for repeated violations of the consent collection procedure (Part 2.1 of Art. 13.11 of the Code of Administrative Offenses of the Russian Federation, as amended by 420-FZ)

№ 659

New Rules for paid medical services of the Russian Federation, mandatory from September 1, 2026

No. 118n

Ministry of Health Order on the mandatory composition of information on the site (replaced 956n)

2026

Comprehensive compliance: bringing the website into compliance with the requirements of 156-FZ, 420-FZ, and Order No. 118n

Why will a standard policy template from the internet not save you?

Inspecting authorities (Roskomnadzor, prosecutor's office, Roszdravnadzor) evaluate not just the presence of policy text in the footer, but actual software data collection process: whether pre-filled checkboxes are present, whether proof of consent is saved, whether web analytics counters start before cookie consent, and whether a license with a verifiable QR code is indicated.

Interactive express test

Check your site for key risks of 152-FZ and Ministry of Health fines

Check the items that are already implemented on your website and instantly assess the risk level of supervisory authority requirements.

Checklist of key requirements (mark what has already been implemented):

High risk of fine
Potential sanctions: from 300,000 to 1,500,000 ₽

Vulnerabilities found according to 152-FZ standards and Ministry of Health medical regulations.

2026 regulatory framework

What must be on the website by law

Based on Federal Law No. 152-FZ (as amended by No. 156-FZ), Ministry of Health Order No. 118n, and Decree of the Government of the Russian Federation No. 659.

Federal Law No. 152-FZ, Art. 18.1

Personal Data Processing Policy

Mandatory if there is any application or feedback form. Must contain an exact list of operators, purpose of collection, storage periods, legal grounds, and data destruction regulations.

Requirement: direct, unobstructed access to the policy text from all data collection pages of the site.

Federal Law No. 156-FZ (from 01.09.2025)

Separate consent for personal data

Consent is processed strictly separate from the user agreement, offer, and marketing mailings. The checkbox must not be pre-checked.

Requirement: active user action and programmatic recording of consent evidence in the database.

Federal Law No. 152-FZ, Art. 6, 9

Cookies & Web Analytics

Cookies, ClientID of Yandex Metrica and Google Analytics are legally equated to personal data. The notification on the site must clearly disclose the composition and purposes of transferring data to third-party services.

Requirement: analytics scripts and advertising pixels must be initialized only after user confirmation.

Order No. 118n, RF Government Decree No. 659

License and extract QR code

The visitor must be able to instantly verify the clinic's right to provide services. Registration number, date of issue, and name of the licensing authority are required.

Requirement: displaying a verifiable QR code or an electronic extract from the Unified Roszdravnadzor License Registry.

Decree of the Government of the Russian Federation No. 659 (from 01.09.2026)

Rules for paid medical services

The new rules replaced the former resolution No. 736. The patient must have access to comprehensive service terms, the procedure for entering into a contract, payment, refunds, and refusal of services.

Requirement: publication of a template contract and rules for service provision in the current edition of No. 659.

Order No. 118n, appendix 1

Price list and prices in rubles

Actual prices for all medical procedures in rubles are mandatory. The patient must accurately understand the composition and name of each medical service before the visit.

Requirement: synchronization of prices on the site with the approved clinic price list and indication of the price entry date.

Order No. 118n, clause 6

Information about clinic doctors

Full name, position held, level of professional education, qualifications, data on current periodic accreditation or specialist certificate.

Requirement: publication of the work schedule and outpatient reception hours for each medical professional.

Order No. 118n, clause 2

Contacts of regulatory authorities

Mandatory posting of contact details for patient inquiries: addresses, phone numbers, and links to electronic receptions of the regional health authority, Roszdravnadzor, and Rospotrebnadzor.

Requirement: constant checking and updating of hotlines for regional supervisory authorities.

Decree of the Government of the Russian Federation No. 659, Section III

CHI (OMS) and clinical standards

The patient must be informed about the possibility of receiving medical care without charge under the state guarantee program (OMS), as well as about medical care standards and clinical recommendations (KR).

Requirement: displaying links to official legal acts and Ministry of Health clinical protocols.

Stages of work

How we bring a website into compliance with regulations

From initial audit to final software coding and legal integrity testing.

01

Comprehensive express audit

We scan all pages of the site, application collection forms, pop-ups, online booking, links to documents, and the operation of external analytics trackers.

02

Preparation of legal documents

We compose a personal Personal Data Processing Policy, texts of separate consents for forms, a Cookie policy, and rules for paid services according to the norms of RF Government Decree No. 659.

03

Smart Cookie banner implementation

We program an adaptive consent script that blocks the firing of Yandex Metrica counters and advertising pixels until the visitor takes an explicit action.

04

Separating checkboxes in forms

We re-code feedback and doctor appointment forms: we extract the consent into a separate unchecked checkbox and configure consent logging into the database.

05

Formatting Ministry of Health sections

We structure doctors' pages (accreditation, diplomas, schedule), the license with a dynamic QR code, price list, and details of supervisory agencies according to Order No. 118n.

06

Final testing and report

We check the site according to the checklist of Roskomnadzor and Roszdravnadzor control checks. We provide the client with a closing compliance protocol.

Compliance technologies

Software solutions for website protection

Reliable technical modules that eliminate risks from human factors and regulatory claims.

Smart Cookie Consent

Lightweight cookie management script. Guaranteed to block Yandex Metrica, VK Pixel, and Google Analytics until consent is given, without reducing PageSpeed metrics.

Consent logging module

Recording user consent upon form submission: capturing the IP address, date, time, policy text version, and User-Agent data as irrefutable evidence for Roskomnadzor.

QR-extract & Medical Schema

Generation of a license QR code for the Roszdravnadzor registry and implementation of Schema.org/MedicalBusiness micro-markup to improve search ranking and patient trust.

Prices

Tariffs for making a site compliant

From a free basic express check to a deep audit and complete turnkey technical implementation.

Capabilities and work Express Audit Initial check of key vulnerabilities 0 ₽ Duration: 24 hours Check for free Popular choice Detailed audit + Technical requirements Full legal review, document texts, and TS for the programmer 15 000 ₽ Duration: 2-3 working days Order for 15 000 ₽ Turnkey implementation Full audit + we implement all changes on the site ourselves 55 000 ₽ Duration: 5-7 working days Order for 55 000 ₽
Checking against 10 basic markers (forms, policy, cookies) ✓ Basic slice ✓ In-depth audit ✓ In-depth audit
Checking Ministry of Health requirements (Order No. 118n, RF Government Decree No. 659) Brief reference ✓ Detailed checklist of 25+ points ✓ Full audit and performance control
Ready-made legal documents (Privacy Policy, Consent, Cookie Policy) — ✓ Individual document package ✓ Individual document package
Step-by-step TS for a web developer with scripts — ✓ Detailed technical specification ✓ Performed by our engineers
Programming a Cookie banner with Yandex Metrica blocking — Implementation guide ✓ Turnkey installation and debugging
Separating checkboxes and logging consent in database/CRM — Implementation guide ✓ Full layout and programming
Formatting doctor sections, price lists, and QR license — Recommendations on structure ✓ Layout and integration onto the site
Final testing and compliance guarantee — Repeat express audit ✓ Compliance protocol and warranty support during inspections
FAQ

FAQ about website requirements and 152-FZ

Not sure if your website meets current legal requirements? Leave a request — we will conduct a free express check.

Ask an expert a question

  • What changed on September 1, 2026, in the rules for paid medical services (Government Decree of the Russian Federation No. 659)?

    Since September 1, 2026, Government Decree of the Russian Federation No. 659 dated 30.05.2026 has been in effect. It replaced the previous rules No. 736 dated 11.05.2023. Now, a reference exclusively to the old rules is regarded by supervisory authorities as a violation. The site must contain up-to-date terms of service, a contract form, a procedure for refusing paid services, a breakdown of prices in rubles, and detailed information about patient rights.

  • Why must consent for personal data be obtained strictly separately starting September 1, 2025 (Federal Law No. 156-FZ)?

    Amendments to 152-FZ explicitly prohibit combining consent for personal data processing with other agreements: offers, website terms of use, or advertising consent. For each form, a separate unchecked checkbox is mandatory. Data collection without proper consent is qualified under Part 1 of Art. 13.11 of the Administrative Code of the Russian Federation (fine for legal entities from 150,000 to 300,000 ₽), and if special categories of health data are processed through the site and written consent is required — under Part 2 of Art. 13.11 (from 300,000 to 700,000 ₽, for repeat offenses — up to 1,500,000 ₽ under Federal Law No. 420-FZ).

  • Is a license QR code and electronic extract required under Order No. 118n?

    Yes. Order of the Ministry of Health of the Russian Federation No. 118n dated 13.03.2025 (which replaced Order No. 956n) requires providing patients with the ability to quickly verify the organization's right to provide medical services. The website must indicate the registration number, date of license issuance, licensing authority, and display a verifiable QR code or an electronic excerpt from the Unified Register of Licenses of Roszdravnadzor. A simple scan of a paper form from previous years is insufficient.

  • Are cookies and Yandex Metrica counters considered personal data?

    Yes. According to the position of Roskomnadzor and judicial practice, cookies, IP addresses, and ClientIDs of analytics systems identify a user on the network and are personal data. If a site collects cookies without informing and obtaining the prior consent of the visitor, or if trackers are triggered before clicking on a banner, this constitutes an offense under Part 1 of Art. 13.11 of the Administrative Code of the Russian Federation.

  • What information about clinic doctors is required by law?

    According to Order No. 118n and rules No. 659, for each specialist, the following must be published: full name, position held, education level (university, major, diploma), information about valid accreditation or specialist certificate, as well as work schedule and reception hours. The absence of this information is a common reason for Roszdravnadzor orders during scheduled and unscheduled inspections.

  • How long does it take to make a site compliant?

    The express audit is completed in 24 hours. A detailed legal-technical audit with preparation of texts and technical requirements takes 2–3 business days. Turnkey implementation of all changes by our developers takes 5 to 7 business days depending on the website CMS and the number of forms.
Clinic and business protection

Get your site in order before the inspecting authorities visit

Leave a request — we will conduct a free express audit of the site based on 10 control points, show vulnerabilities, and calculate the cost of bringing the site into full compliance with 152-FZ standards, Order No. 118n, and Decree of the Government of the Russian Federation No. 659.

Order compliance audit (55 000 ₽)