Healthcare Compliance in Georgia

The market is open to digital health providers. Telemedicine is recognised in statute, e-prescribing is mandatory nationwide and patients have an online view of their electronic health record. There is no telehealth-specific licence: the same certification, licensing and confidentiality duties apply whether the consultation happens in a clinic or over video.

The principal regulators are the Ministry of Internally Displaced Persons from the Occupied Territories, Labour, Health and Social Affairs of Georgia (the Ministry), its Regulation Agency for Medical and Pharmaceutical Activities, the Professional Development Council that certifies doctors, and the State Audit Office of Georgia, which now supervises personal data protection.

The biggest obstacle for a new entrant is not onboarding but integration: a provider that prescribes must connect its doctors to the state e-prescription system, key every patient to a Georgian personal number, and meet tightened 2026 limits on psychotropic prescribing.

1. Who regulates this sector

Georgia is a unitary state, so licensing and supervision are national. The National Center for Disease Control and Public Health and the Social Service Agency also operate in the sector, for public health programmes and social benefits respectively.

2. Licensing and authorisation

Authorisation works on two levels: the professional and the institution.

Professionals

Only a person holding a state certificate confirming the right to independent medical practice may practise medicine independently, and only in the specialty the certificate names, except in emergencies (Law of Georgia on Health Care, Articles 28 and 32). Certificates are issued by the Professional Development Council, which must decide within two months of an application, and are valid indefinitely (Law of Georgia on Medical Activity, No. 904, Articles 20, 22 and 25). Foreign specialists may be granted temporary independent practice for up to one year. Nurses and midwives obtain a state certificate or registration valid for five years (Law on Health Care, Articles 52⁴ and 52⁵).

Institutions and digital providers

The Ministry issues the licence or permit for medical activity, and a medical institution may not carry out activity that requires a licence or permit without it (Law on Health Care, Articles 54 and 56). Outpatient and day-care activities classed as high risk do not need a licence but must be notified to the Ministry and comply with technical regulations, with random control three times a year (Article 63¹). Form No. 2 medicines may be dispensed only by an authorised pharmacy registered in the e-prescription system under a code the Regulation Agency assigns on the basis of its permit.

Georgian law has no separate licence for telehealth platforms or health apps. A platform that delivers consultations does so through certified doctors, who carry personal responsibility for any recommendation given remotely (Law on Medical Activity, Article 90).

3. Identity framework (AML rules do not apply)

The list of obliged entities in Article 3 of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism, No. 5226-Iს covers financial institutions, lawyers, notaries, accountants, auditors, gambling organisers, dealers in precious metals and two public registries. Hospitals, clinics, telehealth providers and pharmacies are not on it, so the customer due diligence, suspicious transaction reporting and five-year AML record-keeping duties do not apply to them. Health insurers are obliged entities in their own right.

One AML-law duty does reach healthcare businesses: every natural and legal person must freeze, without notice, funds and property of persons designated under United Nations Security Council sanctions and report to the Financial Monitoring Service (Articles 1(3) and 41(7) to (9)). Since amendments in force from 28 November 2025, a first breach by a non-obliged person draws a warning and a repeat breach a GEL 1,000 fine (Article 43¹).

The identity framework that does govern the sector rests on three elements:

The personal number

Electronic prescriptions carry the patient's personal number, name and date of birth, and pharmacies retrieve active prescriptions by entering the personal number.

Professional identity

A doctor must tell a capable patient their identity and professional status before providing care, except in emergencies (Law on Medical Activity, Article 43).

Dispensing checks

For psychotropic and specially controlled medicines the pharmacy checks an identity document, or a representative's authority, before release.

4. Identity verification and onboarding

Patients

No Georgian health rule prescribes a document check when a patient registers with a clinic or app. Identity becomes a legal requirement at prescribing and dispensing. Under the rule for Form No. 2 electronic prescriptions (psychotropic medicines and products equated to specially controlled products), approved by Order No. 01-31/ნ of the Minister, 8 April 2022:

• A patient collecting medicine presents an identity document to the pharmacy's responsible person (amended by Order No. 86/ნ of 24 November 2023).
• Anyone else must present their own identity document plus proof of legal representation or a notarised power of attorney; the pharmacy keeps a copy for three calendar years and records its details in the system.
• The pharmacist may verify identity orally (name, date of birth) and visually against a photograph obtained through the web service of the Public Service Development Agency.

Minors

Patients aged 16 and over who can assess their condition may consent to treatment; patients aged 14 to 18 may consent alone for specific services such as contraception advice or HIV testing (Law of Georgia on Patient Rights, No. 283, Articles 40 and 41). Processing a minor's special category data requires the written consent of a parent or legal representative unless a law provides otherwise (Law of Georgia on Personal Data Protection, No. 3144, Article 7).

Biometrics and third-party reliance

Health rules neither require nor recognise selfie, liveness or facial matching for patients. If a provider uses them, the biometric test in Article 9 of the data protection law applies (section 6). The state database of the Public Service Development Agency is the reference source the rules name for photographs.

5. Digital channels: what's different

Bottom line: the rules are largely channel-neutral. Telemedicine is regulated as a professional act, not an onboarding event, so remote care adds confidentiality duties but no separate identity check, while prescriptions are digital for every channel.

Telemedicine is a professional act

The Law on Medical Activity defines telemedicine as the remote provision of medical services through information and communication technology (Article 5). Chapter XII allows only a certified independent practitioner to obtain a consultation by telemedicine and to give the patient a recommendation, makes that practitioner responsible for the outcome, places the confidentiality duty on them, lets the patient ask for identity and health data to be transmitted anonymously, and forbids technical staff from disclosing the consultation (Articles 90 to 92). It sets no patient identity verification method.

Prescribing is digital for everyone

Since 1 March 2022 Group II prescription medicines (Form No. 3) must be prescribed electronically through the unified state system, and since 11 April 2022 the same applies to Form No. 2 psychotropic prescriptions (Order No. 01-19/ნ of 26 February 2022; Order No. 01-31/ნ). Paper is allowed only if the system is unavailable for more than 10 minutes, and the doctor must enter a paper Form No. 2 prescription into the system within 24 hours. A remote prescriber therefore needs the same system registration as a clinic doctor.

Patient record access online

Patients may access and copy their medical records on written request to the institution (Patient Rights, Article 17) and obtain copies of their data within 10 working days (data protection law, Article 14). The State Audit Office's 2024 digital health performance audit reports that the patient page of the national electronic health record, showing records and access logs, has operated since November 2024.

6. Data protection and biometrics

The Law on Personal Data Protection treats health, biometric and genetic data as special categories (Article 3). The general regime applies to all sectors; its healthcare-specific features are:

• Legal basis. Health data may be processed without consent where necessary for preventive, diagnostic, therapeutic, rehabilitative and palliative care or health system management, under Georgian law or a contract with a health professional bound by professional secrecy (Article 6(1)(d)). Other uses, such as marketing, need written consent, which may be electronic (Articles 3(m) and 6(1)(a)).
• Biometrics. [In force since 1 May 2026] Article 9(1), rewritten by Law No. 1259-IVმს-XIმპ of 17 December 2025, permits private-sector biometric processing only where necessary for carrying out activities, security, property protection or preventing disclosure of secret information, and only if those aims cannot be achieved otherwise without disproportionate effort, or where a law directly provides for it. The controller must document in advance the purpose, data volume, retention period, destruction rules and safeguards (Article 9(2)).
• Officer and assessment. Medical institutions must appoint a personal data protection officer (Article 33). A data protection impact assessment is mandatory when special category data of a large number of people is processed; a significant number means at least 3 percent of the population (Article 31).
• Breaches and logging. Incidents must be notified to the State Audit Office within 72 hours unless significant harm is unlikely (Article 29), and all operations on electronic data must be logged (Article 27).
• Foreign providers. A controller established abroad that processes data using technical means in Georgia must register a special representative before processing, unless it is established in the European Union or a state the EU recognises as adequate (Article 34).

7. Sector-specific obligations

Tightened psychotropic prescribing

[In force since 1 April 2026] Order No. 9/ნ of 24 March 2026 caps a single Form No. 2 prescription at 14 daily doses for adults and 30 for patients under 18, bars a new prescription unless the patient has no more than five days' supply left, and bars prescribing where the system shows a parallel prescription from another doctor with more than five days' supply. Replacing lost medicine requires a written explanation, a repeat loss needs proof of a police report, and the doctor must notify the Ministry within five working days. Pharmacies may not dispense beyond the same caps.

Confidentiality and disclosures

Confidentiality survives the patient's death (Patient Rights, Article 27). Disclosure is permitted with consent, to protect identified third parties, to other staff involved in care, on court-ordered law enforcement request, or where law provides (Law on Medical Activity, Article 48). Amendments of 9 December 2025 added disclosure to the Ministry's Unified Information Base for Persons with Mental Health Problems and Alcohol, Drug or Substance Abuse (Law on Health Care, Article 42¹).

Medical records and electronic health records

Doctors must keep complete, timely records in the state language and sign each entry (Law on Medical Activity, Article 56). The State Audit Office's audit reports that since 1 August 2023 all inpatient and outpatient institutions must submit data on identified patients to the national electronic health record, with exemptions including village and family doctors.

8. Risk indicators and red flags

Prescription and identity abuse indicators

• Prescriptions for deceased patients: the 2024 audit found 38 doctors prescribing for dead patients and medicine dispensed for 56 of them (2021 to 2024).
• Dispensing without e-prescription: 67 percent of prescription-only units sold in nine months of 2023 had no electronic prescription.
• Proxy collection: a third party collecting Form No. 2 medicine without legal representation papers or a notarised power of attorney.
• Repeated loss claims: patients reporting lost or destroyed controlled medicine more than once.
• Doctor shopping: parallel prescriptions for the same active substance from different doctors.
• Paper fallback overuse: paper Form No. 2 prescriptions not entered in the system within 24 hours.
• Off-system prescribers: doctors or pharmacies not registered in the e-prescription system yet handling prescription medicines.

9. Enforcement and penalties

Professional liability. The Professional Development Council may issue a written warning, suspend a state certificate for up to six months, revoke it, or restrict the prescribing of narcotic, psychotropic and alcohol-containing medicines (Law on Medical Activity, Article 74). Three warnings in one calendar year allow suspension (Article 75(4)); grounds for revocation include serious breaches that cause significant harm or death and certificates obtained with false documents (Article 79). Nurses and midwives face a parallel scheme (Law on Health Care, Article 52¹⁵).

State control. The Ministry's agency may enter supervised facilities at any time without notice, seize documents, issue electronic penalty notices and impose administrative liability; its decisions are enforced immediately and an appeal does not suspend them (Law on Health Care, Article 16(3) and (4)). High-risk activities may be suspended where life, health or the epidemiological situation is endangered, subject to court approval sought within 24 hours (Article 63¹).

Recent practice. According to the State Audit Office's digital health performance audit (2024), the Regulation Agency carried out 1,875 control measures in 2022 and 2023, found prescription medicines dispensed without a prescription in 98 percent of them, and imposed fines totalling GEL 1,822,100.

Data protection. The State Audit Office may order remedies, suspend or terminate processing, order erasure, halt international transfers and impose administrative liability (Data protection law, Article 52).

10. Recent changes and what to watch

• 1 March 2028 [Adopted, effective 1 Mar 2028] Certified nurse and midwife practitioners will need a unified state certification examination; registration examinations follow from 1 January 2030. Providers employing nurses should plan for the new credential.
• 1 May 2026 [In force] Necessity test for biometric processing rewritten. Selfie or face-match checks in health apps need a documented necessity justification.
• 1 April 2026 [In force] Psychotropic prescription caps and anti-duplication rules (Order No. 9/ნ). Prescribing software should enforce dose and supply limits.
• 23 December 2025 [In force] Supervision of personal data protection transferred to the State Audit Office (Law No. 1289-IVმს-XIმპ, published 23 December 2025). Send breach notices and officer details there.
• 15 December 2025 [In force] Disclosure to the Unified Information Base for persons with mental health problems and substance abuse. Update confidentiality policies.
• 28 November 2025 [In force] Administrative liability for any person breaching the United Nations sanctions-freeze duty. Screen counterparties where funds or property could reach designated persons.

11. What this means for identity verification

Capture the Georgian personal number, name and date of birth at registration for any patient who may need a prescription, because the state e-prescription system cannot issue one without them. For foreign patients without a personal number, confirm the workflow with the Ministry before launch.

Document checks at registration are a business choice, not a statutory duty. Where a provider adds document capture, face matching or liveness, it must justify biometric processing under Article 9, document purpose and retention in advance, and cover it in a data protection impact assessment if processing is large scale.

Verify doctors as rigorously as patients: confirm each practitioner's state certificate and specialty, ensure they disclose identity and status at the start of a teleconsultation, and keep their e-prescription credentials individual.

Build parental consent flows for patients under 16 and recognise the narrower self-consent rights of 14 to 18 year olds. For medicines collected by others, plan for representation documents and notarised powers of attorney, and keep audit logs of every access to health data.