Healthcare Compliance in Lithuania

Lithuania is open to digital health services, but on its own terms. For providers established in Lithuania, telehealth runs inside a licensed outpatient institution rather than as a standalone online business. Patient records, electronic prescriptions and online prescription orders all pass through the state e-health system, ESPBI IS. The Ministry of Health controls the system and the State Enterprise Centre of Registers is its main processor.

The principal authorities are the Ministry of Health, which sets the rules by ministerial order; the State Accreditation Service for Health Care Activities (licensing); the State Medicines Control Agency (pharmacies and online medicine sales); and the State Data Protection Inspectorate. For a new entrant the biggest obstacle is integration rather than permission. Issuing Lithuanian e-prescriptions and writing to patients' e-health records happen in ESPBI IS, whose processors are health institutions, so a provider needs a Lithuanian-licensed institution connected to the system, with a published patient identification procedure and in-person capacity alongside the remote service.

1. Who regulates this sector

2. Licensing and authorisation

Under Article 5(1) of the Law on Health Care Institutions (No I-1367), a legal entity established in Lithuania, or a Lithuanian branch of a foreign legal entity, may provide personal health care services only with a licence for personal health care activity. The licence has no expiry date and lists every licensed service, which may be provided only at the addresses named in it unless a ministerial order allows otherwise. Remote services may be provided where physical contact is not needed, under requirements set by the Minister of Health. There is no separate telehealth licence: a remote consultation is a way of delivering a service the institution is already licensed to provide (Order No V-2569, point 7).

Under the Licensing Rules for Personal Health Care Institutions (Order No V-156), the State Accreditation Service issues or refuses a licence within 30 calendar days of a complete application. It flags missing documents within 20 days, and the applicant then has up to 90 days to supply them (points 20, 22 and 23). Applications can be filed online, and conditions include founding documents, registered in the Register of Legal Entities, that allow the requested services, and a hygiene passport (point 24). The state fee for a licence for outpatient and general services is EUR 71 (EUR 140 for inpatient, EUR 166 for both; Government Resolution No 1458, point 3.15). Where the Service finds a breach, it sets a correction deadline of no more than 30 days and can suspend or revoke the licence in whole or in part (Law, Article 5).

Providers established in another EU country

Under the Cross-border Healthcare Directive 2011/24/EU, telemedicine is treated as provided in the Member State where the provider is established, and is governed by that state's legislation and standards (Articles 3(d) and 4(1)). Lithuania must allow prescriptions issued in another Member State for an authorised medicine to be dispensed, subject to national law (Article 11), and the prescribing rules provide for dispensing e-prescriptions issued in other EU states. Lithuanian e-prescriptions, however, are documents created in ESPBI IS (Order No 112, point 2.1), whose processors are health institutions and the National Health Insurance Fund (ESPBI IS Regulations, point 11.2.2).

Pharmacies need a pharmaceutical licence from the State Medicines Control Agency (Law on Pharmacy (No X-709), Article 20) and must notify the Agency at least 14 working days before selling online (Article 35¹(2)).

3. Identity framework (AML rules do not apply)

Healthcare providers are not obliged entities under the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275). Article 2(10) lists the other obliged entities (auditors, bailiffs, accounting and tax advisers, notaries and lawyers, trust and company service providers, gambling and lottery companies, closed-ended investment companies, real estate agents and certain high-value traders). Health care is not among them, in the current text or in the version applying from 1 January 2027.

Two links remain: a business trading goods worth EUR 10,000 or more for cash falls within Article 2(10)(6) whatever its sector, and under Article 20(8), financial institutions may not use the exemption for customers with large regular cash operations for customers in personal health care or pharmaceutical activity, so their cash transactions of EUR 15,000 or more are reported to the Financial Crime Investigation Service.

Identity in healthcare is governed instead by four layers:

Patient rights

Patients present an identity document to receive care, except in emergencies (Law on the Rights of Patients and Compensation of the Damage to their Health (No I-1562), Article 12(4)).

Remote consultations

Identity established under the institution's published procedure, and consent obtained, before each remote consultation (Order No V-2569).

E-health system

Patients authenticate through iPasas.lt or the E-Government Gateway; staff sending data authenticate strongly (ESPBI IS Regulations and Order No V-1079).

Prescriptions

Identity document at the pharmacy; online orders start from the patient's e-health login (Orders No 112 and V-1491).

4. Identity verification and onboarding

Documents and in-person identification

To collect medicines on an electronic prescription, the patient or their representative presents a valid identity document; during a declared emergency or quarantine another person may collect by giving the patient's personal code and name (Order No 112, points 41.2.1 and 41.2.2). The ESPBI IS Regulations (Order No V-267 of 25 March 2026) let the system hold identity document details. They also allow a facial image for two purposes: confirming the identity of an emergency patient who cannot produce a document, and preventing fraud in free health services (point 18.1).

Remote consultations

Order No V-2569 (new version from 1 July 2026) was adopted under Article 5(1) of the Law on Health Care Institutions and applies to institutions whatever their ownership. It covers remote consultations by doctors (including dentists since 24 October 2026), family-doctor team members and diabetes nurses, and doctor-to-doctor consultations. Remote means must be capable of identifying the person (point 2.4). Each institution must approve and publish a document setting out how patients or representatives are identified remotely, what additional data is processed (its examples are unique codes, login names and video data) and staff duties (point 10.1). Code- or question-based methods must be specified in detail (point 11). Identity must be established and consent obtained before the consultation begins (point 14).

Records access and the e-health portal

Patients log in to the e-health portal and the esveikata app (which requires a Lithuanian personal code) through iPasas.lt or the E-Government Gateway, by online banking, mobile signature, LT ID, chip card or another offered method. The Regulations rely on the Gateway for authenticated user data (point 19.3). Requests for record copies under Order No V-506 must be met within one working day (point 2). In person, the requester shows an identity document. By post, copies must be certified by a notary, consular officer, elder or lawyer. Electronic requests must carry a qualified electronic signature or come through means that identify the requester and protect the text's integrity (point 7).

Age and representation

Patients aged 16 and over consent to their own care; below 16, representatives consent (Article 14) and access the child's records (Article 7(4)). Patients aged 16 or over with listed diseases may be treated anonymously (Article 10), and their e-prescriptions are dispensed against an e-health identifier, birth year and the first two letters of the first name and surname (Order No 112, point 41.2.3).

5. Digital channels: what's different

Bottom line: Remote consultations and online prescription sales are allowed, but only as an extension of licensed, partly in-person care. The clinic publishes its own remote identification method and cannot run a remote-only service, and the route for online prescription orders runs through the state e-health portal.

The method is the clinic's choice, but must be published

Order No V-2569 lists no approved methods. Each institution chooses one, describes it publicly and applies it before every remote consultation (points 10.1, 11 and 14.1). Recording is prohibited (point 13), so any image or video used for identification must be a separate step with its own GDPR Articles 13 and 14 notice. Doctors may not use personal devices or personal platform accounts, and data transmission must be secure (point 9).

Strong authentication for clinic staff

Under Order No V-1079 (as revised from 11 July 2026), users of clinic systems that send data to ESPBI IS must authenticate with a qualified electronic signature; if they use a password instead, the institution answers for the data. Documents must be signed with a qualified electronic signature or sealed (points 16 and 17). [Adopted, effective 1 Jan 2027] Point 16 will require a qualified electronic signature or multi-factor authentication chosen in line with Implementing Regulation (EU) 2024/2690.

Online pharmacy runs through the state portal

Article 35¹(4) of the Law on Pharmacy allows online sale of registered prescription medicines against e-prescriptions, excluding controlled narcotic or psychotropic medicines, and of non-prescription medicines. Under Order No V-1491, the patient logs in to the e-health portal, picks the prescription and a pharmacy, and the portal sends the choice to that pharmacy; that notice is what entitles the pharmacist to prepare the electronic dispensing document (points 27 and 28). The pharmacy's site must show the EU common logo (Article 35¹(6)), which links to the Agency's national list of lawful online pharmacies. Parcels go only to the addressee, aged at least 16, or 18 for listed medicines such as antidepressants and antipsychotics (point 23.4).

6. Data protection and biometrics

Health data and biometric data used to identify a person are special categories under Article 9(1) GDPR. Clinical processing relies on Article 9(2)(h); a biometric identity check also needs an Article 9(2) condition, such as explicit consent. A clinic's remote identification document must list the extra data it processes, and its privacy notices and records of processing must be updated whenever remote services change (Order No V-2569, points 10.1 and 12). The Law on Legal Protection of Personal Data (No I-1374) bans publishing personal codes or using them for direct marketing (Article 3) and sets 14 as the age of consent for information society services (Article 6).

In ESPBI IS, a patient's data stays in the repository for life and in the archive for 75 years after death (ESPBI IS Regulations, points 47 and 48).

7. Sector-specific obligations

When a remote consultation is allowed

A doctor other than a dentist may consult remotely for an acute condition or exacerbation that is not the first contact for that episode, for chronic disease, for certain suspected communicable diseases, or where no direct contact is needed (Order No V-2569, point 18). It may include prescribing, e-sick-leave certificates and referrals (point 19).

Records and corrections

Access to records can be restricted only where it would harm the patient's health, by the treating doctor's recorded decision; justified corrections must be made within 15 working days (Article 7(1) and (2)). Dental records must be kept electronically in all institutions from 1 March 2027 (Order No V-657, as amended by Order No V-212).

Online pharmacy obligations

Only pharmacies may sell medicines online, hospital pharmacies excluded; pharmacies in other EEA states may sell into Lithuania within the same prescription limits (Law on Pharmacy, Article 35¹(1), (3) and (4)). No medicines may be sold to anyone under 16 (Article 35(9¹)).

8. Risk indicators and red flags

Identity and fraud indicators in Lithuanian healthcare

• Third-party collection: someone other than the patient or their representative collects e-prescription medicines outside a declared emergency.
• Altered paper prescriptions: corrections to reimbursed prescriptions, which pharmacists must report to the National Health Insurance Fund.
• Remote identity gaps: consultations held before identity is established or consent recorded.
• Record browsing: staff opening records of patients they do not treat.
• Weak staff log-ins: password-only access to systems that send data to ESPBI IS, or personal devices and messaging accounts.
• Free-care fraud: identity misuse to obtain free health services, which ESPBI IS may counter with a facial image.
• Unlisted online sellers: websites selling medicines without the EU common logo or absent from the national list.

9. Enforcement and penalties

Fines under the Code of Administrative Offences (No XII-1869) are set per offence in fixed bands:

GDPR fines reach EUR 20,000,000 or 4% of worldwide turnover (Article 83(5)). On 19 June 2026 the State Data Protection Inspectorate fined UAB InMedica EUR 450,000 after two investigations, one prompted by a third party's access to the internal data management system of a clinic it has since absorbed. The breaches involved many patients and large volumes of data, including health data. It found breaches of Articles 5(1)(f), 24(1) and 32(1)(b), and calculated the fine from the company's 2025 worldwide turnover of over EUR 147 million (Decision No 3R-1143). It could be appealed to the Regional Administrative Court within a month; no ruling had been published by 9 November 2026. On 8 April 2026 it reprimanded a public primary care centre whose staff had opened a patient's record without a care role, and ordered it to limit system access to staff who need it (Decision No 3R-592).

10. Recent changes and what to watch

• 26 March 2027[Adopted, applies 26 Mar 2027] European Health Data Space Regulation (EU) 2025/327 starts to apply; Article 16 gives patients using e-health data access services the right to identify with any eIDAS-recognised electronic ID, while the access services themselves phase in from 26 March 2029. Implementing Regulation (EU) 2026/2099 sets the cross-border identification mechanism; Member States notify their healthcare identity attributes by 26 March 2028.
• 1 March 2027[Adopted, effective 1 Mar 2027] Dental records must be electronic in all institutions.
• 1 January 2027[Adopted, effective 1 Jan 2027] Clinic system users sending data to ESPBI IS must authenticate with a qualified electronic signature or multi-factor authentication.
• 24 October 2026[In force] Order No V-966 brought dentists within the remote consultations order; remote dental services are allowed in the cases listed in Order No V-483.
• 1 July 2026[In force] Order No V-636 replaced the remote consultations order, adding diabetes nurses and setting out the identification procedure, the personal-device ban and the recording prohibition.
• 1 April 2026[In force] New ESPBI IS Regulations (Order No V-267) replaced the Government's 2011 regulations, confirming the Ministry of Health as controller and the Centre of Registers as main processor (point 11).

11. What this means for identity verification

• Method is configurable, documentation is mandatory. Any remote identification method can be used if the clinic's published procedure describes it; code- and question-based methods must meet the detail in point 11 of Order No V-2569.
• Identify before each consultation. The rule is per consultation, so returning-patient authentication matters as much as first onboarding.
• Separate identity capture from the consultation. The recording ban makes any image or video check a distinct processing step with its own notice and retention.
• Strong authentication on both sides. Patients use the E-Government Gateway or iPasas.lt; staff need a qualified e-signature or, from 2027, multi-factor authentication.
• Personal code is the anchor. The esveikata app requires a Lithuanian personal code, and ESPBI IS identifies patients by that code or another identification code; patients without one present an identity document at the pharmacy.
• Age thresholds are 14, 16 and 18. 14 for children's consent online, 16 for medical consent and medicines, 18 for listed medicines delivered online.