Healthcare Compliance in Austria

Austria is open to digital health. Telemedicine has been written into the Austrian Medical Act since January 2024, social insurance prescriptions are fully electronic, and patients reach their records online through ID Austria.

The Federal Ministry of Labour, Social Affairs, Health, Care and Consumer Protection sets the eHealth rules, the Federation of Social Insurances runs the e-card and e-prescription systems, and the Federal Office for Safety in Health Care (BASG) supervises medicines and online pharmacies. The main obstacle for a new digital entrant is integration: access to ELGA and e-prescribing runs through these national systems, and a provider that cannot identify a patient by one of the methods the law lists cannot open the patient's record.

1. Who regulates this sector

Provincial healthcare powers (such as hospital planning) are outside the scope of this overview.

2. Licensing and authorisation

Doctors. Independent medical practice requires the qualifications set by the Ärztegesetz 1998 (ÄrzteG, Austrian Medical Act 1998) and entry on the register of doctors (Ärzteliste), which the Austrian Medical Chamber keeps electronically (§ 4(1) and § 27(1)). Section 49(2) requires doctors to practise "personally and directly", and since 1 January 2024 expressly allows them to do so "also by using telemedicine" (BGBl. I 191/2023). There is no separate telemedicine licence. Payment for teleconsultations by the statutory health insurers is set in each insurer's contract with the medical chambers, and these can restrict remote delivery: the contract of the Social Security Institution for the Self-employed (SVS), as of 1 January 2026, does not allow its detailed therapeutic consultation to be held by video. Doctors may generally have at most two practice locations in Austria (§ 45(3)); on 2 June 2026 the Federal Administrative Court upheld this limit against a radiologist who relied on advances in telemedicine to challenge it.

Doctors from other EEA states and Switzerland. Doctors established in another EEA state or Switzerland may provide temporary and occasional services in Austria from their foreign practice; a regular activity requires registration (§ 37(1) and (10) ÄrzteG). Before the first service that requires a temporary stay in Austria, the doctor must notify the Austrian Medical Chamber in writing, renew the notification yearly, and may start only after notification and complete documents (§ 37(3), (4) and (8)). The Act does not address services delivered entirely by telemedicine from abroad. The Chamber's own guidance treats written notification as a precondition for any freelance service under § 37, so notifying before starting is the cautious reading.

Online pharmacies. Distance selling of medicines is prohibited except for non-prescription medicines authorised or registered in Austria, sold by Austrian public pharmacies or authorised pharmacies in other EEA states (§ 59(8) and (9) Arzneimittelgesetz, AMG, Medicinal Products Act). An Austrian public pharmacy must notify BASG before it starts, and every page offering medicines must show the EU common logo linked to the national list (§ 59a AMG).

Health apps. Software intended to inform diagnostic or therapeutic decisions, or to monitor physiological processes, is a medical device of at least class IIa under the EU Medical Device Regulation (Annex VIII, Rule 11, Regulation (EU) 2017/745). Austria has no statutory reimbursement scheme for digital health applications; the 2024 to 2028 health financing rules earmark EUR 17 million a year each from the federal government and the health insurers for eHealth, including telemedicine and video consultations (§ 9a Gesundheits-Zielsteuerungsgesetz).

3. Identity framework (AML rules do not apply)

The Financial Markets Anti-Money Laundering Act (FM-GwG) applies to credit and financial institutions (§ 1(1)). Doctors, hospitals, pharmacies and digital health providers are not obliged entities: there is no customer due diligence, suspicious transaction reporting or beneficial ownership check to perform as healthcare providers.

Patient identity is instead governed by four sets of rules:

Health telematics

Whoever transmits health or genetic data must establish the identity of the person concerned, and for untargeted communication must prove and check the person's unique identity (§ 4(1) and (2) Gesundheitstelematikgesetz 2012, GTelG 2012, Health Telematics Act 2012).

ELGA patient index

The Federation of Social Insurances runs a patient index that checks the unique identity of patients in ELGA and other eHealth applications; identity data collected at the point of care are compared with the index (§ 18(1) and (4) GTelG 2012).

Social insurance e-card

e-cards issued to people aged 14 or over carry a photo since 2020, and older cards had to be exchanged by the end of 2023 (§ 31a(8) Allgemeines Sozialversicherungsgesetz, ASVG, General Social Insurance Act). Since 1 January 2026, private (non-contracted) doctors must also use the e-card system and check the patient's identity and the lawful use of the card (§ 31a(7a), § 795(2) ASVG).

Prescriptions

A prescription must name the patient (for a child, also the year of birth) and carry the prescriber's signature or qualified electronic signature; an electronic prescription may carry an advanced electronic signature if sent only over the secured health network (§ 3(1) Rezeptpflichtgesetz, Prescription Act).

4. Identity verification and onboarding

Before a provider may read or store a patient's ELGA data, the patient's identity must be checked electronically, with the patient's participation, against the patient index (§ 18(4) GTelG 2012). The identity data may be collected by:

• an electronic validity check of the e-card and reading its data through the e-card system;
• the E-ID (ID Austria), which proves a person's unique identity (§ 4(1) E-Government Act); ID Austria was notified to the EU under eIDAS at assurance level "high", published in the Official Journal on 27 April 2022;
• identity data of a person already uniquely identified, stored by a hospital or care facility;
• data from an electronic or otherwise uniquely identifiable prescription or referral, where no other method is used.

The e-card method also works at a distance. With the "e-Berechtigung" service, a patient holds an NFC-enabled e-card to a smartphone in the MeineSV app (no ID Austria needed) and grants the doctor remote access to the e-card system. The doctor must confirm within 24 hours and is then enabled for 90 days, as if the card had been inserted in the practice (Federation of Social Insurances, November 2024).

For other eHealth applications and cross-border services, if none of these methods is possible, the provider may read or key in the name, date of birth and document number from a valid Austrian passport or identity card, matched against the central passport register through a Ministry application (some passport types are excluded). For other EEA nationals, the name and date of birth may be taken from an official photo ID (§ 18(4a) and (4b)).

A check opens a time-limited window: 90 days for doctors, dentists, hospitals and care facilities, and 28 days for pharmacies and some other providers (§ 18(6)); a patient may give a trusted doctor, dentist, pharmacy or care facility up to 365 days (§ 18(7)). Patients reach their own record only through applications that guarantee E-ID identification (§ 23(2)), and can opt out online with ID Austria or by post with a signed form and a copy of an official photo ID, used to compare signatures (ELGA participation guidance).

5. Digital channels: what's different

Bottom line: the duty to treat is channel-neutral, but the identity step is not. In a practice the e-card is read in a card reader; remotely, the practical routes for a doctor are the patient's ID Austria login or an e-card tap on the patient's smartphone, with prescription or referral data as fallback.

Remote identification for record access

For a doctor, the practical remote routes under § 18(4) GTelG 2012 are an ID Austria login and the e-Berechtigung e-card tap; stored identity data are reserved for hospitals and care facilities.

Electronic prescriptions

The e-prescription replaced the paper social insurance prescription in summer 2022 (Federation of Social Insurances, April 2024); prescriptions are stored in the e-card system, and contactless prescribing without a practice visit remains available. The pharmacy retrieves the prescription by e-card, by a code shown in the social insurance apps (login with ID Austria) or by a 12-character prescription ID; a printout remains an option, and each social insurance e-prescription can be redeemed only once (Federation of Social Insurances, August 2023). Separately, the Prescription Act lets a prescription be dispensed up to five more times unless the prescriber notes otherwise or the medicine is subject to a repeat ban (§ 4(2) Rezeptpflichtgesetz).

Online sale of medicines

Prescription-only medicines may not be sold at a distance (§ 59(8) and (9) AMG), and BASG keeps the register that the EU logo links to (§ 59a AMG).

What is changing

From 26 March 2027, a provider that requests a patient's health data through the EU's MyHealth@EU network after an online request must identify the patient with an eIDAS electronic ID at assurance level "substantial", and "high" from 26 March 2030 [Adopted, applies 26 Mar 2027] (Article 4(2), Implementing Regulation (EU) 2026/2099).

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) prohibits processing health data and biometric data used to uniquely identify a person unless an exception applies (Article 9(1)). Treatment can rely on Article 9(2)(h) (diagnosis and health care on the basis of law or a contract with a health professional), and Member States may add conditions for health and biometric data (Article 9(4)); the GTelG 2012 is Austria's main set of such conditions for electronic health data. The Data Protection Authority enforces Article 9 in medical practices: in August 2025 it fined a doctor for video surveillance of waiting and infusion areas, finding no basis in the treatment contract or in §§ 49 and 51 ÄrzteG.

The statutory identification methods match card, E-ID or document data against registers; none is biometric. A provider that adds a face match or liveness check processes biometric data under Article 9 and needs its own basis under Article 9(2), for example explicit consent (Article 9(2)(a)).

Doctors must keep treatment records for at least ten years (§ 51(3) ÄrzteG); identity evidence kept as part of the record follows that period.

7. Sector-specific obligations

Secure transmission of health data

Providers must protect the confidentiality and integrity of health data they transmit electronically, prove and check their role, and keep an IT security concept (§§ 5 to 8 GTelG 2012). Providers that mainly used fax until the end of 2024 may rely on simplified confidentiality conditions until 30 June 2027 [Transitional relief to 30 Jun 2027] (§ 27(20), as amended by BGBl. I 67/2026). Since 1 October 2026 the Ministry must operate a health-sector cyber security team, Austrian HealthCERT (§ 8a).

ELGA storage duties

ELGA providers must store discharge letters, laboratory and imaging findings and medication data, unless the patient has opted out (§ 13(3) GTelG 2012). From 1 January 2027 hospitals and care facilities must also store medication data when they prescribe [Adopted, effective 1 Jan 2027]. Patients may opt out in full or in part at any time (§ 15(2)) and may not be treated worse in access to care or cost because of how they use their ELGA rights (§ 16(3)).

Cross-border e-prescriptions and patient summaries

Since 15 February 2026 the GTelG 2012 provides for a national contact point for digital health with the EU e-prescription and EU patient summary (Part 6, BGBl. I 71/2025). The EU e-prescription went live in February 2026, first with Czechia; during the pilot, patients opt in online through the ELGA portal with ID Austria or in writing (Ministry, 26 February 2026). When an Austrian patient is treated abroad, the Ministry provides an E-ID application that creates a unique identifier for the foreign provider to check (§ 24l(1)).

8. Risk indicators and red flags

Identity abuse and fraud indicators in Austrian digital health

• e-card without a photo presented by a patient aged 14 or over: cards without a photo had to be exchanged by the end of 2023.
• Mismatch with the patient index: remotely captured identity data that do not match must not be used to open ELGA.
• Expired access window: ELGA requests more than 90 days (28 for pharmacies) after the last identity check.
• Staff browsing records without a treatment relationship: the Data Protection Authority found a doctor's look-up of an acquaintance's e-vaccination record unlawful (June 2021, not final).
• Prescription medicines offered online to Austrian customers: always illegal.
• Missing or unlinked EU logo on a site selling non-prescription medicines, or a pharmacy not in the BASG register.
• Reused e-prescription codes: each social insurance e-prescription can be redeemed only once.
• Social media sales of GLP-1 medicines such as semaglutide, often through fake profiles that misuse official logos.

9. Enforcement and penalties

Administrative fines are set per offence:

The Data Protection Authority keeps its own powers alongside the GTelG fines (§ 25(4) GTelG 2012). On 8 August 2025 it fined a doctor EUR 1,000 for unlawful video surveillance in a practice. On 20 October 2025 the Federal Administrative Court upheld its finding that a clinic was responsible when a manager, ignoring internal procedures, passed an emergency patient's health data to the police (Data Protection Authority, activity report 2025). On 4 September 2025 BASG warned of a sharp rise in falsified GLP-1 medicines sold through fraudulent websites and social media.

10. Recent changes and what to watch

• 26 March 2027: European Health Data Space Regulation and its cross-border identification rules [Adopted, applies 26 Mar 2027]; online cross-border requests need eIDAS ID at level substantial, high from March 2030.
• 1 January 2027: Hospitals and care facilities must store medication data when prescribing [Adopted, effective 1 Jan 2027]; the ELGA portal moves from the Federation of Social Insurances by 31 December 2026.
• 1 October 2026: Austrian HealthCERT [In force] for health-sector cyber security (§ 8a GTelG 2012).
• 1 July 2026: Fax transition extended [Relief to 30 Jun 2027]; the full confidentiality rules apply to these providers from July 2027.
• 15 February 2026: EU e-prescription, EU patient summary and cross-border identification rules [In force] (BGBl. I 71/2025).
• 1 January 2026: Private doctors must use the e-card system and check patient identity [In force] (§ 31a(7a) ASVG).
• 12 December 2025: Federal, provincial and social insurance partners agree a nationwide basic service for the 1450 health line; doctor video consultations with sick notes and e-prescriptions are a planned next step [Planned, no date set].

11. What this means for identity verification

• Offer both remote routes. ID Austria opens ELGA and the patient portal; the e-Berechtigung e-card tap gives a doctor the same 90-day access for patients without ID Austria.
• Plan for EU-level assurance. Cross-border online requests need an eIDAS ID at level substantial from 2027 and high from 2030; ID Austria is notified at assurance level "high".
• Track the access window. Re-identify the patient before the 90-day (or 28-day) window lapses.
• Document checks have a narrow role. Passport or identity card data are allowed only for eHealth applications other than ELGA and cross-border services, and Austrian documents must be checked against the passport register.
• Biometrics are optional and need their own basis. No healthcare rule requires a face match or liveness check; if used, they are Article 9 processing.
• Keep evidence with the record. Retain identification evidence for at least ten years where it forms part of the treatment documentation.