Healthcare Compliance in Romania

Romania is open to digital health. Telemedicine has a statutory basis in Law no. 95/2006 on healthcare reform, electronic prescriptions are the default for reimbursed medicines, and the national health insurance system maintains a patient electronic health record for every insured person. Private providers can deliver telemedicine without a contract with the health insurance system.

The Ministry of Health sets the rules, the National Health Insurance House (CNAS) runs the reimbursed system and its IT platform, the medicines agency (ANMDMR) polices the medicines market, and the professional colleges register doctors and pharmacists.

The main obstacle for a new entrant is integration rather than licensing: reimbursed services run through the CNAS platform, and every provider must upload records to the patient electronic health record.

1. Who regulates this sector

2. Licensing and authorisation

Providers and telemedicine

Preventive and curative care is delivered by the units listed in art. 30(1) of Law no. 95/2006 on healthcare reform (republished in Official Gazette Part I no. 652 of 28 August 2015): ambulatory practices, diagnostic and treatment centres, medical centres, laboratories, other public and private health units, and hospitals. Under art. 30¹ those same units may provide care by telemedicine, defined as medical services delivered at a distance, without the simultaneous physical presence of patient and staff, through information technology and electronic communications. Art. 30¹⁰ confirms that telemedicine is open to public and private units whether or not they have a contract with a health insurance house. There is no separate telemedicine authorisation: a platform delivering care must be, or work through, an authorised health unit.

Art. 30¹(6) recognises six forms: teleconsultation, tele-expertise, teleassistance, teleradiology, telepathology and telemonitoring; implementing norms were approved by Government Decision no. 1133/2022.

Professionals

Doctors practising in Romania, including EU, EEA and Swiss doctors established there, must register with the CMR, which issues a certificate of membership (art. 416). Pharmacists must register with the CFR (art. 591). Both duties apply to remote practice as well.

Reimbursed services

Providers paid from the national health insurance fund contract with a county health insurance house under the framework contract (Government Decision no. 521/2023) and its norms (joint Order no. 1857/441/2023 of the Health Minister and CNAS President), and use the CNAS IT platform.

Online pharmacies and medical devices

Retail sale of medicines is reserved to pharmacies and drugstores. Under art. 2(4¹) and art. 21 of Pharmacy Law no. 266/2008 (republished), only authorised community pharmacies and drugstores may sell non-prescription medicines online, after notifying the Ministry of Health; the notification is entered on the unit's operating authorisation. Order no. 444/2019 of the Health Minister sets the authorisation file for online activity (art. 12) and requires at least 10 m² of dedicated space (art. 31). Distance sale of medical devices requires an ANMDMR endorsement (art. 926(2) of Law no. 95/2006).

Selling medicines, including at a distance online, without the required authorisation is a contravention punishable by a fine of 50,000 to 100,000 lei (art. 875(1)(af) of Law no. 95/2006, inserted from 23 November 2023).

3. Identity framework (AML rules do not apply)

Healthcare providers, clinics, telemedicine platforms and pharmacies are not reporting entities under Law no. 129/2019 on preventing and combating money laundering and terrorist financing. Art. 5(1) does not list them; a health business falls in scope only under art. 5(1)(i), which covers any professional seller of goods or services in cash transactions of at least the lei equivalent of EUR 10,000, single or linked.

Patient identity is instead governed by three sets of rules:

Proof of insured status

Art. 223(1) of Law no. 95/2006 accepts the national health card, a document generated from the CNAS electronic tool, or a 3-month insurance certificate for people who refuse the card. Without one, contracted care is paid for (art. 343(3)).

Electronic identity card

Electronic identity cards issued to adults allow authentication on the health insurance IT platform, and the national health card ceases to be valid once its holder receives an electronic identity card (art. 338(4) and (5)).

Clinician identity

Telemedicine must establish the identity and professional standing of the doctors providing it (art. 30⁹(2)(a)). Doctors access the patient electronic health record with a qualified certificate registered with the health insurance house (art. 346⁶(4)).

Retaining patients' health cards, or using them without right to report and validate services, is the criminal offence of false identity under art. 327 of the Criminal Code (art. 337(1¹) of Law no. 95/2006).

4. Identity verification and onboarding

Documents and identifiers. The national health card carries the holder's name, personal numeric code (CNP), insurance identification code and card number (art. 338(1)). It is issued to insured adults; children are covered on documents showing their insured category (art. 343).

Transition to the electronic identity card. From 1 September 2026 the CNAS systems accept the electronic identity card in place of the health card, but CNAS has stated that its use is not yet mandatory for providers and that the national health card remains usable while software and card readers are adapted. Access to care is not conditional on the electronic identity card.

Patient access to the electronic health record. The law provides two ways for patients to open their record: a security matrix with a personal password, issued by a doctor holding a qualified certificate on the basis of the patient's identity document, or the health card with its PIN and password (art. 346⁷). Since 1 September 2026 the CNAS eSănătateaMea portal also gives patients access to their insured status, medical and prescription history and online booking, with login exclusively through ROeID, the national digital identity system. CNAS notes that ROeID identity approval can take 24 to 72 working hours.

Online pharmacy customers. An online pharmacy account requires name, e-mail address and delivery address, and medicines may be sold online only to patients over 18 (Order no. 444/2019, art. 33). The patient completes a consent declaration and a questionnaire giving date of birth, weight, height, sex, current treatment, allergies and pregnancy or breastfeeding status, and no sale may happen without a prior interactive exchange validated by the pharmacist (art. 32). The order sets the age limit but no method for verifying it.

5. Digital channels: what's different

Bottom line: the biggest difference is at the front door. In person, a contracted provider must read the patient's health card or electronic identity card; for a remote consultation the card is not required at all, so the remote channel relies on the CNAS status check, the doctor's own identification and an electronic audit trail.

Remote consultations without the card

Under arts. 237(4) and 337(4) of Law no. 95/2006, the framework contract defines which consultations may be delivered remotely, documents go to the patient electronically, and the health card requirement does not apply. The implementing norms allow chronic-disease consultations in primary care, among others, "by any means of communication", on the same conditions as consultations in the practice, and require the family doctor to log the means of communication used and the time slot (Order no. 1857/441/2023, Annex 1, point 1.1.3.2).

Telemedicine safeguards and the 2026 specialty limits [In force, norms pending]

Telemedicine must respect the Patient Rights Law no. 46/2003, establish the doctors' identity and qualification, inform the patient about the technical means of transmission, respect free and informed consent and medical secrecy, secure the data and enter the resulting documents in the electronic health record (art. 30⁹). Government Ordinance no. 2/2026, adopted on 30 January 2026, added art. 30¹(7) and art. 30¹²: telemedicine is to be delivered differently by specialty and service type, with norms setting the permitted services, limits and the cases where a face-to-face consultation is mandatory. The Senate adopted the approval law on 18 March 2026 and it is before the Chamber of Deputies; the per-specialty norms had not been adopted as of October 2026.

Online pharmacies

An online pharmacy website must show the Ministry of Health contact details, link to the Ministry's register of online pharmacies and display the EU common logo on every page offering medicines, linked to the unit's entry in that register (Law no. 266/2008, art. 21(5)). Order no. 444/2019 bans online sale of prescription medicines, limits sales to adults and requires a responsible pharmacist; only technical operations may be outsourced (arts. 1, 32, 33 and 37).

6. Data protection and biometrics

The GDPR applies directly; Law no. 190/2018 implements it in Romania. Health data and biometric data are special categories. Law no. 190/2018 adds two rules that bite on digital health onboarding: processing genetic, biometric or health data for automated decision-making or profiling is allowed only with the data subject's explicit consent or under an express legal provision with appropriate safeguards (art. 3(1)), and processing the personal numeric code (CNP), including by collecting identity documents that contain it, is allowed only on a GDPR art. 6(1) basis, with extra safeguards where the basis is legitimate interest (art. 4).

ANSPDCP Decision no. 174/2018 makes a data protection impact assessment mandatory for large-scale processing of health data and of biometric data used to uniquely identify a person, which can include face-match or liveness checks run at scale by a telehealth platform.

Under Title IX¹ of Law no. 95/2006, the electronic health record is created and fed by providers without the patient's consent (arts. 346¹(3) and 346⁹(2)), but doctors may view it only with consent, except for the emergency summary (art. 346⁶(3)). A patient who refuses the record has the data anonymised without losing care; records are kept for life (art. 346¹²). Confidential patient information may be disclosed only with explicit consent or where the law expressly requires it (Law no. 46/2003, arts. 21 and 22).

7. Sector-specific obligations

Electronic prescriptions

Reimbursed outpatient medicines are prescribed only on the online electronic prescription, with an offline version in justified cases (Order no. 1857/441/2023, Annex 36, art. 1). The prescriber signs online prescriptions with an extended electronic signature. After a remote consultation, the patient or a representative presents or forwards the document received from the doctor, and the pharmacist confirms dispensing with their own electronic signature. Anyone collecting medicines without presenting their own health card signs the dispensing record, by hand or digitally. The form is set by joint Order no. 674/252/2012.

Cross-border care

Telemedicine is treated as provided in the EU member state where the provider is established (art. 903(d) of Law no. 95/2006); online pharmacies supplying other member states follow the destination country's law (Law no. 266/2008, art. 21(4)).

Platform integration

Providers' own IT systems must be compatible with the CNAS platform (art. 30(2) of Law no. 95/2006). Since 1 September 2026 referrals, medical letters and sick-leave certificates are shown to patients in eSănătateaMea, which requires updated provider software.

8. Risk indicators and red flags

Identity and fraud indicators in Romanian digital health

• Card retention: a provider holding patients' health cards to report or validate services (a criminal offence of false identity).
• No EU common logo: a website selling medicines without the logo or a link to the Ministry register.
• Prescription medicines offered online: any online offer of prescription-only medicines is unlawful.
• Unregistered seller: the pharmacy is absent from the Ministry of Health register of online pharmacies.
• Unauthorised products: medicines offered online that are not authorised in Romania.
• Marketplace listings: medicines offered through general classifieds or marketplace sites by unauthorised sellers.
• Insider extraction: staff copying patient files and contact details to use elsewhere.

9. Enforcement and penalties

• Unauthorised sale of medicines: 50,000 to 100,000 lei per contravention, including distance selling online (art. 875(1)(af) of Law no. 95/2006). On 30 April 2026 ANMDMR sanctioned OLX Online Services SRL under this provision in respect of medicines offered on olx.ro, according to its published table of sanctions (updated 3 July 2026).
• Failure to upload to the electronic health record: providers with a CNAS contract are sanctioned under their contract. Providers without one get a written warning for a first breach, then fines of 3% to 5% of the monthly value of services not transmitted; hospitals without a contract face 0.5% for a first breach and 1% to 3% for repeats. A fourth repeat within 24 months adds a six-month suspension of the sanitary operating authorisation (art. 346¹⁰).
• Data protection: private providers face GDPR administrative fines under art. 83 of the GDPR. Public bodies, including public hospitals, first receive a warning with a remediation plan; fines of 10,000 to 100,000 lei or 10,000 to 200,000 lei, depending on the breach, follow only if the plan is not carried out (Law no. 190/2018, arts. 13 and 14). In February 2026 ANSPDCP fined dental practice Hayat Dent SRL 10,190 lei after a former employee copied patients' medical files and the practice failed to answer the authority.

10. Recent changes and what to watch

• 1 September 2026, eSănătateaMea portal [In force]: patients log in through ROeID; providers must update software so medical forms appear in the portal.
• 1 September 2026, electronic identity card in the health system [Transition, card still accepted]: the eID card works with CNAS systems, but its use is not yet mandatory for providers and the health card remains usable.
• July 2026, framework contract changes [Proposed, consultation July 2026]: CNAS drafts would extend remote delivery of outpatient services.
• 18 March 2026, approval of Ordinance no. 2/2026 [Passed Senate, before Chamber]: Parliament may amend the telemedicine provisions when approving them.
• 30 January 2026, Ordinance no. 2/2026 on telemedicine [In force, norms pending]: per-specialty limits and mandatory face-to-face cases will be set by new government norms.
• January 2026, electronic prescription form [Draft order, January 2026]: amendments to Order no. 674/252/2012, mainly on co-insured persons and programme codes.
• 26 March 2027, European Health Data Space Regulation (EU) 2025/327 [Adopted, applies 26 Mar 2027]: the rules on access to and exchange of patient summaries, e-prescriptions and e-dispensations apply from 26 March 2029, and to imaging, test results and discharge reports from 26 March 2031.

11. What this means for identity verification

• No statutory remote patient-proofing standard. The law requires the doctor's identity to be established in telemedicine but sets no method for verifying the patient remotely.
• Plan for two credentials. In-person flows must read both the health card and the electronic identity card.
• National eID as the patient login. The state patient portal uses ROeID only; providers building patient apps can expect many patients to hold a verified national digital identity, and from 2029 the European Health Data Space requires health professionals' access services to use electronic identification recognised under eIDAS (Regulation (EU) No 910/2014).
• Age gate for online pharmacy. Online sales are limited to adults; the verification method is left to the pharmacy.
• Biometrics need an impact assessment. Large-scale face matching or liveness checks on patients require a prior data protection impact assessment, and any automated decision based on biometric or health data needs explicit consent or a legal basis.