Healthcare Compliance in Brazil

The Brazilian market is open to digital health. Law 14.510/2022 made telehealth permanent for all regulated health professions, and the Federal Council of Medicine (CFM) sets the ethical rules for telemedicine. Electronic prescribing is moving onto a national system run by ANVISA.

The regulators are spread out: the Ministry of Health, ANVISA and state and municipal health surveillance bodies, the professional councils (CFM and the regional councils, CRMs), the National Supplementary Health Agency (ANS) for private health plans, and the National Data Protection Agency (ANPD).

The biggest hurdle for a new digital entrant is getting signatures and records right. Prescribers need the correct signature level for each document, electronic telemedicine records must meet a set security level, and electronic controlled-substance prescriptions must move to SNCR-integrated platforms.

1. Who regulates this sector

Other health professions' federal councils set their own telehealth ethics rules (Law 8.080/1990, art. 26-D).

2. Licensing and authorisation

No federal licence is specific to telehealth. Lei nº 14.510, de 27 de dezembro de 2022 (Telehealth Law) [In force] added a telehealth title to Law 8.080/1990. It authorises remote services for every health profession regulated by the federal executive, and acts performed by telehealth are valid throughout Brazil (art. 26-B). A professional who practises in another state only by telehealth does not need a secondary registration there (art. 26-H).

Registrations that apply to a digital health business

Telemedicine intermediaries

Companies that contract doctors, directly or indirectly, to practise telemedicine must register with the CRM of the state where they are based and register a medical technical director there (Law 14.510, art. 3).

Seat in Brazil and directors

Legal entities providing telemedicine, communication platforms or data archiving must have their seat in Brazil and register with the CRM (CFM Resolution 2.314/2022, art. 17). The CFM treats telehealth companies as medical establishments even without physical premises: they need a medical technical director and clinical direction (CFM Opinion 15/2026).

Prescribing platforms

A public or private e-prescribing portal used by doctors must be registered with the CRM of its seat and name a medical technical director (CFM Resolution 2.299/2021, art. 5).

Physical health establishments still need a sanitary licence. Running one without it, or running an unregistered telemedicine intermediary, is a sanitary infringement punishable by warning, closure, licence cancellation and/or a fine (Lei nº 6.437/1977, art. 10, II; Law 14.510, art. 3).

3. Identity framework (AML rules do not apply)

Lei nº 9.613, de 3 de março de 1998 (AML Law) applies only to the persons listed in its article 9 (financial, insurance, payment, betting, real estate, luxury goods and virtual asset businesses, among others). Healthcare providers, telehealth platforms and e-prescribing services are not listed, so they have no customer due diligence, Council for Financial Activities Control (COAF) registration or suspicious transaction reporting duty under it.

Patient identity is instead governed by health-specific rules:

• Identity check before any medical document. Doctors must identify the person examined, and any legal representative, by checking an official identity document with photo and the CPF before issuing a medical document (CFM Resolution 2.381/2024, art. 3, as amended by Resolution 2.418/2024). Children under 16 claiming a social assistance benefit may be identified by birth certificate alone.
• Content of medical documents. Every medical document must give the patient's name and CPF (where the patient has one) and the doctor's name, CRM number, contact details and address; electronic documents need the doctor's qualified signature (CFM Resolution 2.381/2024, art. 2). Electronic prescriptions, certificates and reports issued in person or remotely must identify the patient by name and a legal document number (CFM Resolution 2.299/2021, arts. 1 and 2).
• Prescriptions. Every prescription must give the patient's name and residential address (Lei nº 5.991/1973, art. 35, as amended by Lei nº 14.063/2020).
• Telemedicine documents. When a report, certificate or prescription is issued remotely, the medical record must contain the patient's identification, address and place of care, and note that it was issued by telemedicine (CFM Resolution 2.314/2022, art. 13).
• The CPF as identifier. Lei nº 14.534/2023 makes the taxpayer number (CPF) the single and sufficient number for identifying citizens in public service databases, explicitly including the National Health Card (Cartão Nacional de Saúde).

The CFM identity check makes no exception for telemedicine and does not prescribe a remote method; no rule requires biometric matching. Platforms must also verify the prescriber through the CFM's National Register of Doctors or CFM attribute certificates (CFM Resolution 2.299/2021, art. 8).

4. Identity verification and onboarding

Patients

Patient onboarding on a medical platform has three parts: a check of an official photo identity document and the CPF (CFM Resolution 2.381/2024, art. 3), the name, CPF and address needed on every document, and informed consent. The patient or legal representative must authorise telemedicine care and the transmission of their images and data, electronically or by a recorded reading of the consent text, stored in the electronic health record (CFM Resolution 2.314/2022, art. 15). In SUS telehealth, the professional must record the consent (Ministry of Health Ordinance GM/MS 3.691/2024, art. 450).

The Ministry of Health's Meu SUS Digital app accepts gov.br accounts at any level (bronze, silver or gold) for services such as viewing care history.

Prescribers and signatures

Lei nº 14.063/2020 classifies electronic signatures as simple, advanced or qualified (ICP-Brasil certificate), the highest (art. 4).

• Prescriptions for controlled medicines and electronic medical certificates are valid only with a qualified signature (art. 13).
• Other electronic prescriptions need an advanced or qualified signature (Law 5.991/1973, art. 35 §2). ANVISA treats a gov.br signature as advanced: usable for ordinary and retention prescriptions (such as antimicrobials and GLP-1 agonists), never for controlled medicines.
• For doctors, the CFM sets a stricter ethical standard: every electronic medical document needs a qualified signature (CFM Resolution 2.381/2024, art. 2), with an ICP-Brasil NGS2 certificate verifiable through the National Institute of Information Technology (ITI) or a CFM validator (CFM Resolution 2.299/2021, art. 4). A doctor's gov.br-signed prescription can be legally valid yet breach CFM rules.

5. Digital channels: what's different

Bottom line: the patient identity check (photo ID and CPF) is the same online and in person, but remote care adds consent, location recording, periodic face-to-face visits and electronic-signature and numbering rules for prescriptions.

Consent and the right to refuse

Patients must give free and informed consent to telehealth and may refuse it, with face-to-face care guaranteed on request (Law 8.080/1990, arts. 26-A and 26-G). Professionals may also decline telehealth, including for a first consultation (art. 26-C). For doctors, consent must be documented in the electronic health record (CFM Resolution 2.314/2022, art. 15).

Continuity rules that shape product design

Face-to-face consultation remains the gold standard. A first consultation may be virtual, but follow-up must include face-to-face care, and chronic conditions need an in-person visit with the attending doctor at intervals of no more than 180 days (CFM Resolution 2.314/2022, art. 6 §§1 to 3).

Electronic prescriptions for controlled medicines

ANVISA's Resolução da Diretoria Colegiada (RDC) nº 1.000, de 11 de dezembro de 2025 [In force since 13 Feb 2026] covers electronic Notifications of Prescription (A, B, B2, retinoids, thalidomide), Special Control Prescriptions and prescriptions subject to retention. Paper remains valid. Electronic versions must be generated only by prescribing services integrated with ANVISA's National Prescription Control System (SNCR) through its API, and non-integrated services may not issue them (art. 4), subject to the transition below. The service requests SNCR numbering with a qualified signature and must let the patient present the prescription at any pharmacy (art. 5). Issuance is the prescriber's exclusive responsibility and may not be done by institutions or third parties on the prescriber's behalf (art. 6). Notifications and Special Control Prescriptions need a qualified signature, and retention prescriptions an advanced or qualified one (arts. 8 and 11). SNCR electronic functions opened on 30 September 2026 (RDC 1.028/2026). Under RDC 1.046/2026, Special Control and retention prescriptions may be issued electronically without SNCR numbering until 3 March 2027, and must carry it from 4 March 2027 [Transition until 3 Mar 2027].

6. Data protection and biometrics

The Brazilian Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD), Lei nº 13.709/2018, treats data concerning health and genetic or biometric data as sensitive personal data (art. 5, II). For digital health, three legal bases matter (art. 11):

• Health protection: processing without consent is allowed when indispensable for health protection, exclusively in procedures carried out by health professionals, health services or health authorities (art. 11, II, f).
• Fraud prevention: sensitive data, including biometrics, may be processed without consent to prevent fraud and protect the data subject in identification and authentication in electronic systems (art. 11, II, g).
• Specific consent: otherwise, consent must be specific and highlighted, for specific purposes (art. 11, I).

Two health-specific limits apply. Controllers may not share health data for economic advantage, except in providing health and pharmaceutical services for the patient's benefit, for portability or for the resulting transactions (art. 11 §4). Health plan operators may not use health data to select risks (art. 11 §5).

Patient records may be eliminated only after at least 20 years from the last entry, and digitisation must use an ICP-Brasil certificate or another legally accepted standard (Lei nº 13.787/2018, arts. 2 and 6). Electronic telemedicine records must meet security level NGS2 of the ICP-Brasil standard or another legally accepted standard, and patients may obtain a digital copy (CFM Resolution 2.314/2022, art. 3).

7. Sector-specific obligations

E-prescribing platform conduct

Platforms must verify that each prescriber is a doctor in good standing (art. 8) and train their users (art. 10). Doctors and platforms may not direct prescriptions to specific pharmacies (art. 11), and doctors may not use non-compliant platforms (art. 12) (CFM Resolution 2.299/2021).

Artificial intelligence in care

CFM Resolution 2.454/2026 [In force since 26 Aug 2026] gives patients the right to be told clearly when AI is used as relevant support in their care. Doctors may not delegate the communication of diagnoses to AI without human mediation, remain fully responsible for its use, and may share health data with AI systems only when strictly necessary.

Online sale of private health plans

ANS Normative Resolution 413, of 11 November 2016 [In force] makes online sale of private health plans optional for operators (art. 2), who are fully responsible for the security of contracting data (art. 3). Documents may be signed with a digital certificate, login and password after registration, biometric identification, a certified electronic signature or other legally permitted forms that ensure authenticity (art. 7). Where plans offer telehealth, it follows the same coverage rules as other care, including maximum waiting times (ANS board decision, December 2022).

8. Risk indicators and red flags

Digital health fraud and identity-abuse indicators

• Certificates without consultation: certificates sold through social media, messaging apps or websites without any consultation (CFM alerts, 2026).
• Borrowed or fictitious doctors: documents carrying CRM numbers of deceased doctors or of people who were never doctors.
• Wrong signature level: a controlled-medicine prescription signed with an advanced (for example gov.br) signature, which ANVISA treats as invalid.
• Unverifiable signature: an electronic prescription whose signature fails the ITI Validar service (ICP-Brasil and gov.br) or the issuing platform's validator, which pharmacies must check before dispensing.
• Off-system notification: an electronic Notification of Prescription issued outside an SNCR-integrated service, which pharmacies must not accept (ANVISA FAQ, 2nd edition).
• Unregistered intermediary: a telemedicine company or prescribing platform with no CRM registration or medical technical director.
• Prescriber not checked: a platform onboarding prescribers without checking the CFM National Register of Doctors.
• Steering to a pharmacy: prescriptions routed to a specific pharmacy, which CFM rules prohibit.

9. Enforcement and penalties

Sanitary infringements. Under Lei nº 6.437/1977, art. 2, penalties range from a warning to closure of the establishment and cancellation of licences. Fines are set by the seriousness of the infringement: R$ 2,000 to R$ 75,000 for minor infringements, R$ 75,000 to R$ 200,000 for serious ones and R$ 200,000 to R$ 1,500,000 for very serious ones. Fines double for repeat offences, and the authority must consider the offender's economic capacity.

Data protection. The ANPD can impose warnings, simple fines of up to 2% of the Brazilian turnover of the company or group in its last financial year (net of taxes), capped at R$ 50 million per infringement, and daily fines within the same cap. It can also publicise the infringement, block or delete the data concerned, and partly suspend the database or suspend the processing for up to six months, extendable once (LGPD, art. 52).

Professional discipline. Telemedicine ethics breaches are investigated by the patient's CRM and judged by the doctor's CRM (CFM Resolution 2.314/2022, art. 17 §2). Breaches of RDC 1.000/2025 are sanitary infringements (art. 26).

Recent actions. On 26 October 2026 the ANPD announced it had concluded a sanctioning proceeding against the Municipality of Feira de Santana. It imposed a warning, publicisation of the infringement and corrective measures after the names of 1,241 people with HIV, sickle cell anaemia and fibromyalgia were published in the municipal gazette. On 8 July 2026 it opened a sanctioning proceeding against Instituto Saúde e Cidadania (Isac) over a 2025 ransomware incident affecting about 500,000 patient records. Separately, CFM Resolution 2.382/2024, which made the Atesta CFM certificate platform mandatory, is suspended by the Federal Court (case 1087770-91.2024.4.01.3400) [Suspended by court].

10. Recent changes and what to watch

• 3 November 2026: RDC 1.046/2026 (adopted 29 October) lets electronic Special Control and retention prescriptions be issued without SNCR numbering until 3 March 2027 [Transition until 3 Mar 2027]. From 4 March 2027 they must carry SNCR numbering, so prescribing platforms must finish integration by then.
• 30 September 2026: SNCR electronic functions went live (RDC 1.028/2026), allowing electronic Notifications of Prescription A, B and B2 [In force]. Electronic issuance is optional, but where used it must run through an integrated platform.
• 26 August 2026: CFM Resolution 2.454/2026 on artificial intelligence in medicine took effect [In force]. Patient-facing AI features need disclosure and human mediation of diagnoses.
• 25 February 2026: Law 15.352/2026 turned the data protection authority into the National Data Protection Agency (ANPD) [In force]. LGPD sanctions are unchanged.
• 13 February 2026: ANVISA RDC 1.000/2025 took effect [In force]. Advanced signatures became usable for retention prescriptions such as GLP-1 agonists and antimicrobials, and new official paper models became mandatory for new printing (stocks printed by 12 February remain valid).
• Pending: the Atesta CFM mandatory certificate platform (CFM Resolution 2.382/2024) remains suspended by the Federal Court [Suspended by court]. Issuers of digital certificates should track the final ruling.

11. What this means for identity verification

• Document check: a remote check of an official photo identity document and the CPF for the patient and any legal representative, plus name, CPF and address on every document.
• Consent as evidence: a per-encounter consent record stored in the health record.
• Biometrics are optional: no rule requires face matching; where used against fraud, the legal basis is LGPD art. 11, II, g.
• Prescriber assurance is mandatory: CFM register checks and the right signature level for each document.
• Re-verification triggers: each new encounter, each controlled-medicine prescription, and chronic care reaching 180 days.
• Retention: at least 20 years from the last entry, in an NGS2-level system.