MEDICAL WEBSITE COMPLIANCE
Your clinic's website
in accordance with the law
Comprehensive audit and technical compliance of a clinic, dentistry, or business website with 152-FZ, Ministry of Health Order No. 118n, and the new rules for paid services No. 659. Protection against Roskomnadzor fines of up to 700,000 – 1,500,000 ₽.
LICENSE
DOCTORS
PRICE LIST
152-FZ
MINISTRY OF HEALTH
ROSZDRAVNADZOR
of a clinic website
AUDIT
DOCUMENTS
IMPLEMENTATION
projects
of studio
models
Premier Partner status
marketing, analytics
Protect your clinic and website from Roskomnadzor fines of up to 700,000 – 1,500,000 ₽ and claims from Roszdravnadzor
C September 1, 2026 Decree of the Government of the Russian Federation of 30.05.2026 No. 659 are in effect. The composition and form of information on a medical website are also checked according to Order of the Ministry of Health of Russia of 13.03.2025 No. 118n: information about the organization, licenses, doctors, services, and resource accessibility, taking into account the clinic's activities.
According to Article 9 of Law No. 152-FZ, consent is arranged separately from other documents to be confirmed. Parts 2 and 2.1 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation provides for legal entities 300,000–700,000 ₽ and 1,000,000–1,500,000 ₽ for a repeated violation of requirements for mandatory written consent. This is not a universal fine for any checkbox defect: the processing basis and qualification are checked separately.
We conduct a technical and legal website audit, develop personalized legal documents, and implement turnkey software solutions: from smart cookie banners to structured doctor registries and license extracts.
- Clinic website audit according to 25+ control points of 152-FZ, Order No. 118n, and RF Government Decree No. 659
- Separate checkboxes and logging of user consents (IP, timestamp, version)
- Adaptive Cookie banner with real Yandex Metrica and Google Ads blocking until consent
- Formatting the license block with a clickable QR code for the registry extract
- Layout of doctor pages with qualification, accreditation, and current reception schedule
up to 1.5 million
Fine for repeated violations of the consent collection procedure (Part 2.1 of Art. 13.11 of the Code of Administrative Offenses of the Russian Federation, as amended by 420-FZ)
№ 659
New Rules for paid medical services of the Russian Federation, mandatory from September 1, 2026
No. 118n
Ministry of Health Order on the mandatory composition of information on the site (replaced 956n)
2026
Comprehensive compliance: bringing the website into compliance with the requirements of 156-FZ, 420-FZ, and Order No. 118n
Why will a standard policy template from the internet not save you?
Inspecting authorities (Roskomnadzor, prosecutor's office, Roszdravnadzor) evaluate not just the presence of policy text in the footer, but actual software data collection process: whether pre-filled checkboxes are present, whether proof of consent is saved, whether web analytics counters start before cookie consent, and whether a license with a verifiable QR code is indicated.
Check your website to key risks of 152-FZ fines and Ministry of Health regulations
Check the items that are already implemented on your website and instantly assess the risk level of supervisory authority requirements.
Checklist of key requirements (mark what has already been implemented):
Several mandatory requirements of Art. 13.11 of the Administrative Code of the Russian Federation are not met (consent, analytics trackers, logging).
What must be included on the website by law
Based on Federal Law No. 152-FZ (as amended by No. 156-FZ), Ministry of Health Order No. 118n, and Decree of the Government of the Russian Federation No. 659.
Personal Data Processing Policy
Mandatory if there is any application or feedback form. Must contain an exact list of operators, purpose of collection, storage periods, legal grounds, and data destruction regulations.
Requirement: direct, unobstructed access to the policy text from all data collection pages of the site.
Separate consent for personal data
Consent is processed strictly separate from the user agreement, offer, and marketing mailings. The checkbox must not be pre-checked.
Requirement: active user action and programmatic recording of consent evidence in the database.
Cookies & Web Analytics
Cookies, ClientID of Yandex Metrica and Google Analytics are legally equated to personal data. The notification on the site must clearly disclose the composition and purposes of transferring data to third-party services.
Requirement: analytics scripts and advertising pixels must be initialized only after user confirmation.
License and extract QR code
The visitor must be able to instantly verify the clinic's right to provide services. Registration number, date of issue, and name of the licensing authority are required.
Requirement: displaying a verifiable QR code or an electronic extract from the Unified Roszdravnadzor License Registry.
Rules for paid medical services
The new rules replaced the former resolution No. 736. The patient must have access to comprehensive service terms, the procedure for entering into a contract, payment, refunds, and refusal of services.
Requirement: publication of a template contract and rules for service provision in the current edition of No. 659.
Price list and prices in rubles
Actual prices for all medical procedures in rubles are mandatory. The patient must accurately understand the composition and name of each medical service before the visit.
Requirement: synchronization of prices on the site with the approved clinic price list and indication of the price entry date.
Information about clinic doctors
Full name, position held, level of professional education, qualifications, data on current periodic accreditation or specialist certificate.
Requirement: publication of the work schedule and outpatient reception hours for each medical professional.
Contacts of regulatory authorities
Mandatory posting of contact details for patient inquiries: addresses, phone numbers, and links to electronic receptions of the regional health authority, Roszdravnadzor, and Rospotrebnadzor.
Requirement: constant checking and updating of hotlines for regional supervisory authorities.
CHI (OMS) and clinical standards
The patient must be informed about the possibility of receiving medical care without charge under the state guarantee program (OMS), as well as about medical care standards and clinical recommendations (KR).
Requirement: displaying links to official legal acts and Ministry of Health clinical protocols.
How we bring the site in compliance with standards
From initial audit to final software coding and legal integrity testing.
Comprehensive express audit
We scan all pages of the site, application collection forms, pop-ups, online booking, links to documents, and the operation of external analytics trackers.
Preparation of legal documents
We compose a personal Personal Data Processing Policy, texts of separate consents for forms, a Cookie policy, and rules for paid services according to the norms of RF Government Decree No. 659.
Smart Cookie banner implementation
We program an adaptive consent script that blocks the firing of Yandex Metrica counters and advertising pixels until the visitor takes an explicit action.
Separating checkboxes in forms
We re-code feedback and doctor appointment forms: we extract the consent into a separate unchecked checkbox and configure consent logging into the database.
Formatting Ministry of Health sections
We structure doctors' pages (accreditation, diplomas, schedule), the license with a dynamic QR code, price list, and details of supervisory agencies according to Order No. 118n.
Final testing and report
We check the site according to the checklist of Roskomnadzor and Roszdravnadzor control checks. We provide the client with a closing compliance protocol.
Software solutions for website protection
Reliable technical modules that eliminate risks from human factors and regulatory claims.
Smart Cookie Consent
Lightweight cookie management script. Guaranteed to block Yandex Metrica, VK Pixel, and Google Analytics until consent is given, without reducing PageSpeed metrics.
Consent logging module
Recording user consent upon form submission: capturing the IP address, date, time, policy text version, and User-Agent data as irrefutable evidence for Roskomnadzor.
QR-extract & Medical Schema
Generation of a license QR code for the Roszdravnadzor registry and implementation of Schema.org/MedicalBusiness micro-markup to improve search ranking and patient trust.
— COST AND RATES
Pricing
Clinic compliance
From a free basic express check to a deep audit and complete turnkey technical implementation.
| Capabilities and work |
Express Audit
Initial check of key vulnerabilities
0 ₽
Duration: 24 hours
Check for free
|
POPULAR CHOICE
Detailed audit + Technical requirements
Full legal review, document texts, and TS for the programmer
35 000 ₽
Duration: 2-3 working days
Order for 35 000 ₽
|
Turnkey implementation
Full audit + we implement all changes on the site ourselves
85 000 ₽
Duration: 5-7 working days
Order for 85 000 ₽
|
|---|---|---|---|
Checking against 10 basic markers (forms, policy, cookies) |
✓ Basic slice | ✓ In-depth audit | ✓ In-depth audit |
Checking Ministry of Health requirements (Order No. 118n, RF Government Decree No. 659) |
Brief reference | ✓ Detailed checklist of 25+ points | ✓ Full audit and performance control |
Ready-made legal documents (Privacy Policy, Consent, Cookie Policy) |
— | ✓ Individual document package | ✓ Individual document package |
Step-by-step TS for a web developer with scripts |
— | ✓ Detailed technical specification | ✓ Performed by our engineers |
Programming a Cookie banner with Yandex Metrica blocking |
— | Implementation guide | ✓ Turnkey installation and debugging |
Separating checkboxes and logging consent in database/CRM |
— | Implementation guide | ✓ Full layout and programming |
Formatting doctor sections, price lists, and QR license |
— | Recommendations on structure | ✓ Layout and integration onto the site |
Final testing and compliance guarantee |
— | Repeat express audit | ✓ Compliance protocol and warranty support during inspections |
— QUESTIONS AND ANSWERS
FAQ
about clinic compliance
Not sure if your website meets current legal requirements? Leave a request — we will conduct a free express check.
-
What changed on September 1, 2026, in the rules for paid medical services (Government Decree of the Russian Federation No. 659)?
Since September 1, 2026, Government Decree of the Russian Federation No. 659 dated 30.05.2026 has been in effect. It replaced the previous rules No. 736 dated 11.05.2023. Now, a reference exclusively to the old rules is regarded by supervisory authorities as a violation. The site must contain up-to-date terms of service, a contract form, a procedure for refusing paid services, a breakdown of prices in rubles, and detailed information about patient rights. -
Why must consent for personal data be obtained strictly separately starting September 1, 2025 (Federal Law No. 156-FZ)?
Article 9 of 152-FZ requires consent to be documented separately from other confirmed documents. First, the legal basis for processing is checked; if consent is used, proof of receipt is retained, and the required form is observed. Part 1 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation concerns processing without a legal basis or incompatible with collection purposes; parts 2 and 2.1 concern violations of requirements for mandatory written consent and repeat offenses. The amount of the sanction depends on the nature of the violation and the operator's status. -
Is a license QR code and electronic extract required under Order No. 118n?
Yes. Order of the Ministry of Health of the Russian Federation No. 118n dated 13.03.2025 (which replaced Order No. 956n) requires providing patients with the ability to quickly verify the organization's right to provide medical services. The website must indicate the registration number, date of license issuance, licensing authority, and display a verifiable QR code or an electronic excerpt from the Unified Register of Licenses of Roszdravnadzor. A simple scan of a paper form from previous years is insufficient. -
Are cookies and Yandex Metrica counters considered personal data?
We assess the data composition and the possibility of directly or indirectly identifying a person. Cookies, IP, and analytics identifiers can be considered personal data; the legal basis depends on the specific processing. If consent is used, we launch relevant trackers only after its receipt. The presence of cookies does not in itself determine the composition of a violation and a fine. -
What information about clinic doctors is required by law?
According to Order No. 118n and rules No. 659, for each specialist, the following must be published: full name, position held, education level (university, major, diploma), information about valid accreditation or specialist certificate, as well as work schedule and reception hours. The absence of this information is a common reason for Roszdravnadzor orders during scheduled and unscheduled inspections. -
How long does it take to make a site compliant?
The express audit is completed in 24 hours. A detailed legal-technical audit with preparation of texts and technical requirements takes 2–3 business days. Turnkey implementation of all changes by our developers takes 5 to 7 business days depending on the website CMS and the number of forms.
Regulatory primary sources
Sources verified .
- Order of the Ministry of Health of Russia of 13.03.2025 No. 118n — Appendixes No. 1 and No. 2: content and form of information on medical sites. Copy of the document text on the NMIC site.
- Decree of the Government of the Russian Federation of 30.05.2026 No. 659 — Rules for paid medical services: points 7, 12–18 and section VI; in effect since September 1, 2026.
- Law No. 152-FZ, Article 9: consent to data processing — Separate arrangement of consent, confirmation of its receipt, and cases of mandatory written form.
- Law No. 152-FZ, Article 10: special categories of data — Health data: processing restrictions and exceptions provided by law.
- Code of Administrative Offenses of the Russian Federation, Article 13.11: violations of data processing — Different violation compositions and sanctions; part 2 concerns consent that is mandatory in written form.
Applicability of norms and liability depend on the activity, data composition, and circumstances of the violation. Before making changes, check the current version of the document.