Healthcare Compliance in Moldova

Moldova's healthcare market is open to private providers, but the rules are written for in-person care. Identification, insured-status checks and dispensing assume a person presenting an identity document. Digital tools exist inside that model (electronic prescriptions, online booking, a national insurance database queried by IDNP), while telemedicine and online pharmacy sales still wait for their own legal frameworks.

The principal authorities are the Ministry of Health, the National Health Insurance Company (CNAM), which runs compulsory health insurance and the eRețeta system, and the Medicines and Medical Devices Agency (AMDM). The National Center for Personal Data Protection supervises the handling of health data.

The biggest obstacle for a digital entrant is legal uncertainty: there is no defined route for remote consultations or for verifying a patient's identity remotely, and online medicine sales depend on a Pharmacy Law that is still in consultation.

1. Who regulates this sector

The National Council for Evaluation and Accreditation in Health, a public institution founded by the Ministry of Health, accredits providers (Law No. 552/2001 on evaluation and accreditation in health, art. 8) and, from 1 January 2027, certifies professionals.

2. Licensing and authorisation

Medical service providers

Article 9¹ of Law No. 411 of 28 March 1995 on health protection sets four conditions for a private provider of medical services: inclusion in the Ministry of Health's Nomenclator of medical institutions, services matching the Ministry's nomenclature of professional specialisations, a sanitary authorisation for the type of activity, and an accreditation certificate. The National Agency for Public Health issues the sanitary authorisation for 5 years (Law No. 10/2009 on state supervision of public health, art. 23²), and the accreditation certificate follows a decision of the National Council for Evaluation and Accreditation in Health (Law No. 552/2001, art. 11¹). There is no separate route for online-only providers. Care under compulsory health insurance is delivered by providers contracted by CNAM (Order No. 1089/288, point 2).

Professionals

Law No. 224 of 24 September 2026 rewrites the rules on practising health and pharmaceutical professions [Adopted, effective 1 Jan 2027]. From that date the National Council for Evaluation and Accreditation in Health authorises practice through certification and issues a national professional card (new art. 9 of Law No. 411/1995 and new chapter III¹ of Law No. 552/2001); some provisions apply from 1 January 2028 and others on EU accession.

Pharmacies, medicines and devices

• Pharmacies hold a pharmaceutical activity licence from AMDM (Law No. 1456 of 25 May 1993 on pharmaceutical activity, art. 14²). Retail supply of medicines is reserved exclusively to pharmacies (Law No. 153 of 19 June 2025 on medicines, art. 113).
• Medicines may be placed on the market only with a marketing authorisation (Law No. 153/2025, art. 47), granted by AMDM; the law has applied since 17 August 2025 and replaced Law No. 1409/1997.
• Medical devices, including software needed for a device to work, fall under Law No. 102 of 9 June 2017; CE-marked devices are notified to AMDM at least 10 working days before being placed on the market (art. 7).

Selling medicines without an AMDM licence, including at a distance, is a contravention (section 9).

3. Identity framework (AML rules do not apply)

Health providers and pharmacies are not reporting entities under Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing. Article 4(1) names no health service. One residual category can reach any business: selling goods for at least 200,000 lei in cash, in one or several linked operations (art. 4(1)(m)).

The sector therefore has no AML due diligence or reporting duty. Patient identity is governed instead by the compulsory health insurance norms (Joint Order No. 1089/288 of 23 December 2024 of the Ministry of Health and CNAM, last amended with effect from 1 September 2026), the rules on reimbursed prescriptions (Government Decision No. 106 of 23 February 2022, as amended by Government Decision No. 8/2024) and medical secrecy under Law No. 263 of 27 October 2005 on patient rights and responsibilities.

4. Identity verification and onboarding

Identifying the patient

Point 8 of the Order No. 1089/288 norms states that a person requesting medical care of any type identifies themselves with an identity document. Under point 9, health workers confirm insured or uninsured status by querying CNAM's automated information system for compulsory health insurance with the state identification number (IDNP) printed on the identity document, or with the series and number of a passport for people without an IDNP. In emergencies the check is done after care has been given.

The rules set no biometric check, assurance level or remote identification method.

Registration and access to records

To receive primary care, every person must be registered with one family doctor (Joint Order No. 894/249 of 1 November 2024, point 4). The registration form can be handed to the doctor on paper or signed electronically and emailed to the primary care provider (point 17); the order does not specify the type of electronic signature. Appointments for any outpatient care can be made by phone, online or at reception (Order No. 1089/288, point 25). Patients can book high-performance services themselves in CNAM's SIRSM system (point 80), entering their IDNP and the unique code on the doctor's referral. Patients obtain copies of their own records on a written or oral request; a written request carries the requester's identification data and is accompanied by the identity card, with court decisions or a notarised power of attorney for guardians and delegates, and is answered at the latest within 15 days (Ministry of Health Order No. 303/2010, points 9 to 14).

Prescribing and dispensing

Under Government Decision No. 106/2022, the doctor prescribes reimbursed medicines in the eRețeta system and applies a qualified electronic signature (point 10). On home visits a paper form printed from eRețeta is signed by hand and stamped (point 11). For children under 16, or at the patient's request, the doctor records the IDNP of the legal representative or of the person nominated to collect the medicines (point 12). The pharmacy dispenses to the patient, representative or nominee on presentation of the identity document, after checking the IDNP and/or scanning the prescription barcode (point 28).

CNAM's pharmacist guidance bars dispensing to anyone not named on the prescription or without an identity check.

5. Digital channels: what's different

Bottom line: the identification rules are channel-neutral on paper, but they assume physical presentation of an identity document, and Moldova has no telemedicine framework and no regime for online medicine sales yet, so remote care and online pharmacy models operate without defined identity rules.

Telemedicine has no legal framework yet

Neither the Law on health protection nor the Law on patient rights defines telemedicine, and no act regulating it has been published in the Official Gazette (as of 5 November 2026). The National Programme for Digitalisation and Innovation in Health 2025-2030 (Government Decision No. 556 of 3 September 2025) aims for at least half of medical institutions to offer telemedicine by 2030 and schedules a regulation on telemedicine services, with standard definitions, eligibility conditions and reporting, for the third or fourth quarter of 2026. Digital processes still start with a consultation: since 1 March 2026 sick-leave certificates are electronic documents signed with the doctor's qualified electronic signature after a consultation, and are extended only on consultations the doctor performs personally (Government Decision No. 667/2025, points 1, 12 and 13). The only remote consultation in the insurance norms is clinician-to-clinician, through the National Consultation and Inter-hospital Transfer Service (Order No. 1089/288, points 99 and 100).

Online sale of medicines

Law No. 1456/1993 contains no provision on distance or internet sales, and Law No. 153/2025 leaves retail supply to the legislation on pharmacies; its split between prescription-only and non-prescription medicines (art. 8) applies whatever the channel. The draft Pharmacy Law [Proposed, comments close 10 Nov 2026], in the text published for repeated consultation in September 2026, would let licensed community pharmacies sell non-prescription medicines and medicines prescribed through electronic prescriptions on their own website after notifying AMDM, ban marketplaces that do not directly involve a licensed pharmacy, limit delivery to Moldovan territory and require a common logo linked to an AMDM list of online pharmacies (draft arts. 28 and 29). The notification and logo rules (draft art. 29) would apply 12 months after publication; AMDM's 2026 action plan already includes an order on the design of the common logo for distance sellers.

6. Data protection and biometrics

Law No. 195 of 25 July 2024 on personal data protection, modelled on the EU General Data Protection Regulation, has applied since 23 August 2026 and repealed Law No. 133/2011 (art. 89).

• Special categories. Data concerning health and biometric data used to uniquely identify a person are prohibited from processing unless an exception applies (art. 9(1)). For healthcare, the main exception is processing needed for medical diagnosis, the provision of care or treatment, or the management of health systems, under law or a contract with a health provider, subject to the conditions and safeguards in art. 9(3) (art. 9(2)(h)).
• Biometric onboarding. A face match used to identify a patient is biometric processing that no health rule requires, so the care exception does not obviously cover it; providers should rely on explicit consent (art. 9(2)(a)) or another specific ground and document the choice.
• Data protection officer and impact assessment. A data protection officer is mandatory when core activities involve large-scale processing of special categories (art. 37(1)(c)); high-risk processing requires a data protection impact assessment (art. 35). The CNPDCP list of operations needing an assessment (Order No. 27/2022, updated by Order No. 39 of 10 August 2026) covers large-scale processing of health and biometric data and names medical institutions keeping patients' medical data as an example.
• Medical secrecy. All data on the patient's identity and condition are confidential, also after death, and may be disclosed only with the patient's explicit consent or in cases set by law (Law No. 263/2005, art. 12).

7. Sector-specific obligations

eRețeta operating rules

eRețeta replaced paper prescriptions for reimbursed medicines and devices from 2 April 2024. CNAM's guidance (updated February 2026) sets validity at 60 days for long-term treatment, 15 days for episodic treatment and 30 days for reimbursed psychotropic medicines, which use prescription form No. 1 under Ministry of Health Order No. 960/2012. Pharmacies keep handwritten home-visit prescriptions for 45 days and may not substitute the prescribed medicine. Under Government Decision No. 106/2022, each provider appoints an administrator who updates the list of eRețeta users within 3 days of staff changes (point 9).

Record retention

The State Archive Service's indicator of standard documents and retention periods sets retention for patients' medical records (clinical observation sheets): 25 years for inpatients and 5 years for outpatients, with records of particular importance for studying prevention, diagnosis and treatment methods kept permanently (Order No. 57/2016, indicator art. 523).

Health apps and software

Law No. 102/2017 covers devices for diagnosis, prevention, monitoring or treatment, including the software they need to work (art. 2), but does not expressly address standalone software, so the status of a medical app is not settled.

8. Risk indicators and red flags

Identity and fraud indicators in Moldovan healthcare

• Collection by an unnamed person: a third party seeks reimbursed medicines without being recorded by IDNP on the prescription.
• No identity document: dispensing or care requested without an identity document, outside an emergency.
• IDNP mismatch: the IDNP on the document does not match the CNAM record or the prescription.
• Unlicensed online sellers: websites or marketplaces selling prescription-only medicines without an AMDM licence.
• Health data leaving the clinic: requests from third parties (lawyers, employers) for diagnoses without consent or a legal basis.

9. Enforcement and penalties

Pharmaceutical contraventions. Article 77 of the Contravention Code, as rewritten by Law No. 153/2025, sets fines in conventional units per contravention. Selling or supplying medicines without an AMDM licence, including distance sales through information society services, carries 1,000 to 1,500 units (50,000 to 75,000 lei, at 50 lei per unit under art. 34) for individuals and, for legal persons, a fine equal to the value of the product but not less than 1,500 units (75,000 lei). Operating in premises not authorised by AMDM carries 1,250 to 1,500 units for legal persons.

Data protection. Law No. 195/2024 has two fine tiers (art. 88): up to 1,000,000 lei or 1% of prior-year turnover, whichever is higher, for breaches of controller obligations such as security and impact assessments; and up to 2,000,000 lei or 2% for breaches of the processing principles, consent and special-category rules (arts. 5 to 7 and 9), data subject rights and transfers.

Public actions. In November 2025 the CNPDCP reported that a district president had sent councillors extracts from patients' medical records; consent forms from only two patients, worded in general terms, were not valid consent, and the authority initiated contravention proceedings. A 2021 case on a health centre disclosing diagnoses to a lawyer ended in a court conviction for a contravention. Both predate Law No. 195/2024.

10. Recent changes and what to watch

• 3 to 10 November 2026: public consultation on the draft Pharmacy Law, with a hearing on 6 November [Proposed, comments close 10 Nov 2026]. It would create a route for online pharmacy sales.
• 20 October 2026: Law No. 224/2026 on health professions published [Adopted, effective 1 Jan 2027]. Practitioners will need a national professional card.
• 23 August 2026: Law No. 195/2024 on personal data protection and the updated CNPDCP impact assessment list [In force]. Health and biometric data face new art. 9 conditions and higher fines.
• June 2026: draft Ministry of Health order on the organisation and operation of private health providers [Proposed, not yet published]. It allows medical documentation to be kept on paper and/or electronically.
• 1 March 2026: Government Decision No. 667/2025 on sick-leave certificates [In force]. Certificates are electronic only and signed with the doctor's qualified electronic signature.
• 20 February 2026: Ministry of Health 2026 action plan schedules a Government decision on the Electronic Health Record and a national eHealth entity [Planned, not adopted].
• 17 August 2025: Law No. 153/2025 on medicines [In force]. It rewrote the contravention for unlicensed pharmaceutical activity to cover distance sales expressly.

11. What this means for identity verification

• The IDNP is the anchor. Insured-status checks, reimbursed prescriptions and SIRSM bookings key on the IDNP; patients without one are matched by passport series and number. IDNP plus referral code is a knowledge check, not proof of identity.
• Documents first. Reading the identity document reliably is the closest digital equivalent to what the norms describe.
• Biometrics need their own legal ground. Face match and liveness are not required by health rules and are special-category processing, so plan for explicit consent and a data protection impact assessment.
• Third-party access is identity-bound. Nominees collecting medicines are identified by IDNP on the prescription and show their own document; guardians and delegates requesting records add court decisions or a notarised power of attorney.
• Qualified signatures recur. eRețeta and sick-leave certificates need the doctor's qualified electronic signature; family-doctor registration can be signed electronically.
• Expect re-design. Telemedicine, Electronic Health Record and pharmacy rules could each add remote identification steps.