Healthcare Compliance in Poland

The Polish market is open to online healthcare. Telemedicine is written into the statutes on medical activity and the medical profession, and remote-only clinics register with the regional governor or the relevant medical chamber in the same way as physical clinics. Prescriptions, referrals and medical records run through the national e-health system, which every prescriber must connect to.

The principal authorities are the Minister of Health, the National Health Fund (NFZ), the e-Health Centre, the Chief Pharmaceutical Inspectorate and the Patient Ombudsman, with the President of the Personal Data Protection Office (UODO) supervising health data.

The biggest obstacle for a new entrant is prescribing. In-person examination rules for listed controlled substances, monitoring of prescribing patterns, and stated Ministry plans to curb prescription mills all shape what a remote service can offer.

1. Who regulates this sector

Poland is a unitary state, so healthcare rules are national. Registration of providers is handled regionally, by the voivode (regional governor) for medical entities and by the professional chambers for individual practices.

The Office for Registration of Medicinal Products, Medical Devices and Biocidal Products also matters where a health app qualifies as a medical device. Device classification is outside the scope of this guide.

2. Licensing and authorisation

Under the Ustawa o działalności leczniczej [Act of 15 April 2011 on Medical Activity] (consolidated text Dz.U. 2026 poz. 156), medical activity consists of providing health services. Art. 3(1) states that those services may be provided through ICT or communication systems. A company that intends to operate as a medical entity applies for entry in the register of entities performing medical activity (art. 100). The register is kept by the voivode for medical entities and by the regional medical or nursing chamber for individual professional practices (art. 106). The register is public and runs as an IT system.

The Act carves out remote-only providers in two places:

• Premises. The detailed premises and equipment requirements do not apply to an entity that provides only outpatient services remotely (art. 22(3a)). The Minister may set separate requirements for its premises, equipment and IT systems (art. 22(3b)).
• Patient information. Such an entity publishes its organisational information on its website, and in the Public Information Bulletin where applicable, instead of displaying it at the place of care (art. 24(2a)).

Every prescriber issues e-prescriptions through the national e-health system (P1). Publicly funded care additionally requires a contract with the NFZ.

A pharmacy that sells non-prescription medicines online must notify the regional pharmaceutical inspector at least 14 days before starting. Mail-order sale is limited to non-prescription medicines that are not age-restricted (Prawo farmaceutyczne [Pharmaceutical Law], art. 68(3) and (3c)).

3. Identity framework (AML rules do not apply)

The list of obliged institutions in art. 2(1) of the Ustawa o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu [Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing] (consolidated text Dz.U. 2025 poz. 644) does not include healthcare providers. The nearest catch-all, art. 2(1)(23), reaches businesses only for cash payments for goods of EUR 10,000 or more, so a pharmacy could fall into it in that narrow case. Providers therefore have no customer due diligence, beneficial ownership or suspicious transaction reporting duties as healthcare providers.

Identity is governed instead by four sets of rules:

Eligibility for public care

Art. 50 of the Act on publicly funded healthcare services requires identity confirmation and an eligibility check against NFZ data by PESEL (national identification number), or a signed statement of entitlement.

Prescription content

A prescription must carry the patient's name, address and patient identifier (Pharmaceutical Law, art. 96a(1)(1)). The identifier is the PESEL, or for people without one, a passport or other identity document number.

Record access

Records are released to the patient, the legal representative or a person the patient authorises (Patient Rights Act, art. 26). Providers must log who received what (art. 27(4)).

Account access

Patients reach the Internet Patient Account only after authenticating with electronic identification or the mObywatel app (Health Information System Act, art. 7b).

4. Identity verification and onboarding

Accepted documents in person. To skip presenting an eligibility document, a patient confirms identity with an identity card, passport, driving licence, school ID (only for people under 18) or the mObywatel digital document (art. 50(2)(1)).

Remote confirmation. A provider delivering care remotely may confirm identity on the basis of data the patient transmits through those systems. The patient may also make the eligibility statement remotely (art. 50(2a)). Identity can also be confirmed through an electronic patient account that was created after identity was confirmed in person or through national electronic identification (art. 50(2b)). Neither provision names a document scan, a selfie or a liveness check, so the method is the provider's choice.

Patient identifiers. Since 1 July 2026, the national system accepts additional identifiers for patients without a PESEL: a passport or other identity document number, the EU cross-border eID identifier, or the personal identification number used by European Digital Identity Wallets (amendment to art. 4(3) of the Health Information System Act by Dz.U. 2026 poz. 791).

Minors. A school ID is accepted only for patients under 18. Parents reach a child's patient account through NFZ and family-benefit data, or after the e-Health Centre confirms their identity and authority (art. 7b(2) to (4)).

5. Digital channels: what's different

Bottom line: remote care is lawful and identity rules are lighter online. Prescribing is the exception: listed opioids and medical cannabis require an in-person examination, whatever the channel.

Controlled substances and the in-person examination

The Minister of Health's regulation on narcotic drugs and psychotropic substances, as amended by Dz.U. 2024 poz. 1600 (in force 7 November 2024), sets two rules for prescriptions of listed narcotic drugs, psychotropic substances and category 1 precursors.

• History check. The prescriber must first check the patient's prescription history in the national e-health system, or take a history from the patient.
• In-person examination. For the substances in Annex 2 (fentanyl, morphine, oxycodone, and non-fibre cannabis herb, extracts and resin), the prescriber must examine the patient in person (§ 7(2a)).

A repeat prescription without a new examination is allowed only if the last examination was no more than 3 months earlier (§ 7(2b)). Primary care doctors under an NFZ contract, excluding night and holiday care, are exempt from the history check. They are also exempt from the in-person rule when continuing existing treatment (§ 7(2c) and (2d)). The checks must be described in the medical record (§ 8(2)).

Prescriptions without examination

Outside that list, a doctor may issue a prescription needed to continue treatment without examining the patient, where the medical record justifies it (Physician Act, art. 42(2)). This is the legal basis for many repeat-prescription services.

What is changing

In a September 2025 reply to a parliamentary question, the Ministry of Health said it was analysing legislative measures against prescription mills, including penalties [Under analysis, no bill published]. The Ministry, the e-Health Centre and the Chief Pharmaceutical Inspectorate are working on these together. The same reply noted that the national system cannot tell at the time of issue whether a prescription came from an in-person visit or a teleconsultation, so compliance checks rely on providers' medical records.

6. Data protection and biometrics

The EU General Data Protection Regulation (GDPR) applies directly, supplemented by the Act of 10 May 2018 on the Protection of Personal Data, with UODO as supervisor. Health data and biometric data used to identify a person are special categories under the GDPR, so a remote onboarding flow that uses face matching needs a valid exemption for that processing.

Polish health law adds three points that bite on identity capture:

• Who may see records. Only medical professionals, and staff authorised by the data controller, may process data in medical records. Processors must keep patient information secret even after the patient's death (Patient Rights Act, art. 24(2) to (6)).
• No voice biometrics in central registration. For the national central e-registration voice assistant, the law prohibits identifying or verifying patients from biometric voice features and prohibits storing voice templates. Recordings are kept for no more than 3 years (art. 23f of the Act on publicly funded healthcare services, in force 1 July 2026). The rule binds that state system only, but it signals how the legislature views voice biometrics in health contexts.
• Pseudonymised data. Since 1 July 2026, data that allow pseudonymisation to be reversed must be stored with special security measures (art. 5a of the Health Information System Act).

Medical records are kept for 20 years from the end of the year of the last entry. The exceptions are 30 years for deaths from injury or poisoning and for blood-tracing data, 22 years for children under 2, 10 years for X-ray images held outside the record, and 5 years for referrals (Patient Rights Act, art. 29). Records are released in person, as copies or printouts, by electronic means or on a data carrier (art. 27(1)).

7. Sector-specific obligations

Health apps and the national system

The Act of 15 May 2026 amending certain acts in connection with the development of e-health services (Dz.U. 2026 poz. 791, in force 1 July 2026) creates a Home Medical Care module in the national Medical Information System. Patients can feed it through their patient account. Makers of medical devices and wellbeing apps may transmit data only at the patient's request and with consent, and only if their systems meet the minimum interoperability conditions (new art. 11c). Data are kept for 5 years. The Minister will publish a list of qualifying apps and devices.

The Act also lets the e-Health Centre restrict or block a provider's or professional's access to the system on suspicion of unlawful use or a security threat (art. 7(3d) to (3k)).

Patient summary and cross-border access

The same Act introduces a patient summary drawn from the national system, defined by reference to Regulation (EU) 2025/327 on the European Health Data Space (new art. 30b of the Patient Rights Act). It can be sent to another EU or European Economic Area (EEA) country only after the patient consents through the patient account. A professional requesting foreign data must verify the patient's identity.

Assistants issuing documentation

Since 1 July 2026, a doctor may authorise a medical professional or an assistant to issue electronic documentation, including prescriptions, in the doctor's name for up to 12 months at a time. The authorisation is granted and revoked through the Register of Medical Assistants (Physician Act, art. 41a). Prescriptions now carry the identifier of the authorised person as well as the prescriber's.

8. Risk indicators and red flags

Prescription fraud and identity abuse in remote care

• High-volume prescribing: a single doctor issuing unusual numbers of prescriptions, a pattern the e-Health Centre monitors.
• No real contact: prescriptions issued after a paid form, with no live consultation.
• Controlled-substance repeats: psychotropic or narcotic repeats with no examination in the last 3 months.
• Advertising: platforms promising a prescription or sick note without examination.
• Doctor shopping: patients obtaining controlled substances from several remote services.
• Unverified representatives: proxies or legal representatives acting without a confirmed right to act.
• Unlicensed sellers: online sellers of medicines that do not appear in the pharmacy register.

9. Enforcement and penalties

In the same September 2025 reply, the Ministry confirmed that the e-Health Centre runs daily monitoring of prescriptions for psychotropic and narcotic medicines. Under a Minister of Health order of 14 November 2024, these reports go to the Ministry every two weeks. Anomalies are passed to the pharmaceutical inspectorate, the NFZ, the medical chamber or prosecutors.

10. Recent changes and what to watch

• 26 March 2027: [Adopted, applies 26 March 2027] Regulation (EU) 2025/327 on the European Health Data Space starts to apply, with later dates for some patient-access and electronic health record system duties.
• By about 1 December 2026: [Adopted, launch due within 5 months of 1 July 2026] The Home Medical Care, e-Consultation and Intelligent Services Platform systems must go live. App and device makers should prepare for interoperability conditions and the published list.
• 18 September 2026: [Bill, not enacted] The Sejm passed a Pharmaceutical Law amendment lifting the pharmacy advertising ban and raising the penalty for unlawful advertising. It is at the Senate stage.
• 20 August 2026: [Passed, referred to Constitutional Tribunal] The President referred the amendment to the Patient Rights Act on pseudo-medicine and impersonation of specialists to the Constitutional Tribunal. It is not in force.
• 1 July 2026: [In force] The e-health act took effect: the patient summary, EU Digital Identity Wallet identifiers, assistant authorisations and access blocking.
• 1 January 2026: [In force] Central e-registration for selected services began. The voice-assistant rules and the ban on voice biometrics apply from 1 July 2026.
• 7 November 2024: [In force] The in-person examination rule for the opioids and medical cannabis listed in Annex 2 took effect.

11. What this means for identity verification

Remote patient identification in Poland is principle-based rather than method-based. A provider may rely on data the patient submits, so the legal minimum is low. In practice, the PESEL or document number must be right because every prescription, referral and record entry is keyed to it.

Linking accounts to national eID or mObywatel gives the strongest statutory footing (art. 50(2b)), since an account created that way can be used to confirm identity for later visits. For patients without a PESEL, the system now accepts identity document numbers and EU digital identity identifiers, which suits document capture and NFC chip reading of passports.

Biometric checks are not required by health law. Where they are used, they are special-category processing under the GDPR and need a documented exemption and retention limits.

Some events should trigger an identity re-check:

• a prescription for a controlled substance, which also triggers the history check and, for Annex 2 substances, an in-person visit;
• a legal representative or proxy acting for the patient;
• a request to release records to a third party.

Identity evidence kept in the medical record follows the record's retention period, generally 20 years.