Healthcare Compliance in Ukraine

Ukraine is open to digital health businesses, but only through the state's own infrastructure. The national electronic health system is the backbone of care: it holds the patient register, declarations with family doctors, medical records, referrals and electronic prescriptions, and every licensed provider and pharmacy has to connect to it through an accredited medical information system.

The principal authorities are the Ministry of Health, which sets policy and licenses medical practice; the National Health Service of Ukraine, which owns and administers the central eHealth database and pays providers under the medical guarantees programme; and the medicines regulator, which licenses pharmacies and keeps the list of pharmacies allowed to sell online.

The biggest obstacle for a new entrant is not a separate digital licence but integration: a telehealth service that wants to prescribe, refer or be paid by the state must hold a medical practice licence, connect to eHealth, and give its clinicians qualified electronic signatures.

1. Who regulates this sector

Ukraine is a unitary state, so licensing and supervision are national. The table lists the bodies whose rules shape patient identity and digital care.

2. Licensing and authorisation

Medical practice. Article 35-6 of the Fundamentals of the Legislation of Ukraine on Health Care (Law No. 2801-XII of 19 November 1992) provides that care using telemedicine may only be delivered by health care institutions or individual entrepreneurs registered and licensed for medical practice. There is no separate telemedicine licence: the same medical practice licence covers in-person and remote care.

eHealth connection as a licence condition. In February 2022 the Cabinet of Ministers amended the Licence Conditions for medical practice so that every licensee, public or private and whether newly licensed or not, must register in the central eHealth database and keep electronic medical records. Clinicians need a qualified electronic signature on a secure medium to work in the system.

Medical information systems. Under the Procedure for the Functioning of the Electronic Health Care System (Cabinet of Ministers Resolution No. 411 of 25 April 2018), providers reach eHealth through a medical information system whose operator has passed the administrator's testing and signed a connection contract. Technical equipment of the central database must be located in Ukraine. The administrator may suspend or disconnect a system, for example for breaches of information protection requirements or for findings by the State Service of Special Communications.

Pharmacies. Retail sale of medicines requires a licence under the Licence Conditions approved by Cabinet of Ministers Resolution No. 929 of 30 November 2016. Since amendments by Resolution No. 1055 of 27 September 2022, retail licensees had to connect to eHealth by 31 March 2023, with an exception for pharmacies in areas of hostilities or occupation.

State payment. Providers paid by the NHSU under the medical guarantees programme contract with the NHSU through eHealth and report services there; the programme for 2026 was set by Cabinet of Ministers Resolution No. 1808 of 31 December 2025.

3. Identity framework (AML rules do not apply)

Healthcare providers and pharmacies are not reporting entities under the Law of Ukraine on Prevention and Counteraction to Legalisation (Laundering) of the Proceeds of Crime, No. 361-IX of 6 December 2019. The customer due diligence, beneficial ownership and suspicious transaction reporting regime does not apply to them as healthcare businesses; it applies only if a group also runs a separately regulated activity, such as a payment service.

Patient identity is instead governed by four instruments:

eHealth Procedure

Resolution No. 411 requires each user to be unambiguously identified at registration. Self-registration uses electronic identification; registration at a provider uses an identity document under the Law on the Unified State Demographic Register (No. 5492-VI).

Register of Patients

MOZ Order No. 2755 of 30 November 2020 sets the data recorded about each patient and the authentication method chosen for confirmation codes.

Medical records and prescriptions

MOZ Order No. 587 of 28 February 2020 governs the register of medical records, referrals and prescriptions, and makes electronic entry mandatory for licensees.

Data protection and medical secrecy

The Law on Personal Data Protection (No. 2297-VI) restricts health data processing to defined grounds, and medical secrecy binds clinicians.

Sanctions screening under the Law on Sanctions (No. 1644-VII) is a general obligation for any business, not a healthcare-specific one.

4. Identity verification and onboarding

Registration data. The Register of Patients in Resolution No. 411 holds the patient's unique number in the Unified State Demographic Register (where one exists), the taxpayer registration number (RNOKPP) or, for those who refuse one on religious grounds, passport details, full name, date and place of birth, address, the identity document's details (passport, temporary certificate, birth certificate for children under 14, permanent residence permit or refugee and protection documents), optional contact details and any legal representative. Register data are restricted-access information.

In person. Any doctor working in eHealth, primary or specialist, can register a patient. The patient shows an identity document and, from age 14, the tax number; the patient checks the entered data and the doctor signs the request with an electronic signature, which creates the patient's unique identifier.

Remotely. Self-registration requires electronic identification. The Cabinet of Ministers extended eHealth in 2024 with a personal patient cabinet, entered with the patient's own electronic signature, and allowed registration and declarations through Diia. Since February 2026 the patient cabinet has been open to all adults and to teenagers aged 14 to 18 who hold their own electronic signature; it can be reached through the state e-cabinet or through verified private patient information systems.

Documentary methods only. The eHealth rules recognise identity documents and electronic signatures. They contain no rule on selfie matching, liveness detection or chip reading, and no identity assurance level of their own; a private service that uses such methods must still register the patient through a recognised route before eHealth documents can be issued.

Legal representatives. A representative registers a patient at a provider, which checks the documents proving the representative's authority.

5. Digital channels: what's different

Bottom line: the duty to keep records and prescribe in eHealth is channel-neutral, but remote onboarding works only for patients with their own electronic signature, and selling medicines online is a separately listed activity with its own age rule.

Remote identity rests on electronic signatures

Resolution No. 411 lets patients self-register through electronic identification, and the patient cabinet is entered with the patient's own electronic signature. A patient without one, or a teenager without their own signature, has to be registered by a provider in person. Remote onboarding flows therefore need an in-person fallback.

Telemedicine runs under a martial-law procedure

MOZ Order No. 1695 of 17 September 2022 approves a procedure for medical and rehabilitation care using telemedicine for the period of martial law [Martial-law regime, in force], last amended in 2024. The 2015 telemedicine rules in MOZ Order No. 681 remain formally in force. MOZ Order No. 595 of 7 May 2026, registered on 24 June 2026, approves a new telemedicine procedure that will replace Order No. 681 [Adopted, not yet in force].

Patient data may leave Ukraine for telemedicine, temporarily

Law No. 2494-IX of 29 July 2022 added a transitional rule to the Law on Personal Data Protection: during martial law and for six months after it ends, personal data needed for telemedicine may be transferred to foreign parties with protection under the law of the country where care is provided, as an exception to the usual adequacy requirement [Temporary exception].

Online pharmacy is a listed activity

Under Resolution No. 929, electronic retail and delivery of medicines may only be carried out through pharmacies included in the list kept under a MOZ procedure, non-prescription medicines may be sold online only to people aged 14 or over, and certain categories may not be sold or delivered online at all.

6. Data protection and biometrics

Article 7 of the Law on Personal Data Protection (No. 2297-VI of 1 June 2010) prohibits processing of data concerning health, and of biometric and genetic data, unless an exception applies. Two exceptions matter for digital health: the data subject's unambiguous consent, and processing needed for health care, diagnosis, treatment, medical services or the operation of eHealth, provided the data are handled by medical or rehabilitation staff of a licensed provider who are responsible for data protection and bound by medical secrecy.

The eHealth Procedure applies the same test to the registers: health-related data in eHealth may only be processed by staff bound by medical secrecy and by NHSU staff responsible for data protection. Patients can grant and withdraw access to their data, and see who requested it; a request to revoke consent must be processed within three working days. A biometric check used by a private app to onboard a patient falls under Article 7 in its own right, so it needs explicit consent unless it is part of the provider's medical processing.

The Ukrainian Parliament Commissioner for Human Rights supervises compliance. The general data protection regime is being rewritten: the draft Law on Personal Data Protection (bill No. 8153) [Bill, preparing for second reading] has passed first reading and was included in the agenda of the current session in September 2026.

7. Sector-specific obligations

Electronic prescriptions

MOZ Order No. 587 makes electronic prescriptions mandatory for all medical practice licensees: for systemic antibacterial medicines from 1 August 2022, and from 1 April 2023 for the medicines covered by the MOZ prescription rules. Any doctor registered in eHealth with a qualified electronic signature may prescribe, whatever the employer. According to the medicines regulator, an e-prescription is valid for 30 days for ordinary prescription medicines and 10 days for narcotic medicines. Paper prescriptions remain possible during martial law in defined cases, such as a power or connection failure, an eHealth outage, or a patient paying privately who asks for one.

Confirmation codes and patients without phones

Codes, prescription numbers and referral numbers are sent to the patient's phone. Since 20 February 2025 they go by Viber first, with SMS as the guaranteed fallback, following amendments to Resolution No. 411. For patients registered with the "by documents" authentication method, who have no phone, the doctor prints an information sheet with the code.

Dispensing

For prescription medicines other than narcotic and reimbursed ones, the pharmacist redeems the e-prescription without applying a qualified signature, and may dispense in parts when the patient pays privately.

Administration of the central database

Cabinet of Ministers Resolution No. 26 of 2025 made the NHSU responsible for administering the central database, with some administrator functions performed by a state enterprise under its management.

8. Risk indicators and red flags

Healthcare is outside the AML regime, so the relevant risks are identity abuse and false records in eHealth.

Identity and record abuse in digital health

• Duplicate patient records: the same person appears twice in the patient register, a problem eHealth support handles on request.
• Mismatch with state registers: verification against state registers finds data that do not match, which the user must correct within 10 working days.
• Systematic false entries: a user repeatedly enters unreliable data, a ground for suspending access to the central database.
• Phone number changes before prescriptions: codes travel to the registered phone, so a recent change of number deserves scrutiny.
• Reports that drive payments: records behind state payments are cross-checked between the Ministry of Finance and the Pension Fund under a 2026 procedure.
• Narcotic prescriptions: short validity and signature at dispensing reflect higher diversion risk.

9. Enforcement and penalties

Enforcement in digital health works through access to the system as much as through fines. Under Resolution No. 411 the administrator can suspend a medical information system's access to the central database, or disconnect it, on an exhaustive list of grounds that includes breaches of information protection, findings of the State Service of Special Communications on cryptographic and technical protection, failed testing and breach of the connection contract; access is restored once the breach is fixed. Individual users who systematically enter false data can have their access suspended.

Because eHealth registration and electronic records are licence conditions, a provider that does not comply is in breach of its medical practice or pharmacy licence and exposed to the licensing authority's measures.

Data protection breaches are administrative offences under Article 188-39 of the Code of Ukraine on Administrative Offences. Fines are set as multiples of the non-taxable minimum income of citizens, with higher bands for officials and entrepreneurs than for individuals, a separate offence for failing to protect data in a way that leads to unlawful access, and a higher band for repeat offences within a year.

10. Recent changes and what to watch

• September 2026: [Bill, preparing for second reading] Bill No. 8153 on personal data protection was included in the session agenda; a new law would reshape consent, breach notification and supervision for health data.
• 24 June 2026: [Adopted, not yet in force] MOZ Order No. 595 on telemedicine was registered; it will replace the 2015 rules, so telehealth providers should map their processes to it now.
• 10 February 2026: [In force] The patient cabinet opened to all adults and to teenagers with their own electronic signature, allowing online declarations and access management through state or private e-cabinets.
• 20 February 2025: [In force] eHealth codes and prescription numbers began to be delivered by Viber, with SMS as fallback.
• 2025: [In force] Resolution No. 26 of 2025 moved administration of the central eHealth database to the NHSU.
• 2024: [Martial-law regime, in force] The martial-law telemedicine procedure (Order No. 1695) was last amended; it applies only while martial law lasts.

11. What this means for identity verification

The recognised remote route is the electronic signature. eHealth self-registration and the patient cabinet rely on the patient's own electronic signature or other electronic identification, for example through Diia. Document capture, face matching or liveness checks can support a private service's own onboarding, but they do not by themselves register a patient in eHealth.

Collect the data the register needs. A flow that ends in eHealth must capture the RNOKPP (or the passport alternative), the identity document's type, number, issuer and validity, and contact details, and must handle the document types the register accepts, including birth certificates, residence permits and refugee documents.

Design for minors and representatives. Teenagers aged 14 to 18 can act online only with their own electronic signature, and legal representatives are verified at a provider.

Treat the phone as a security factor. Prescription and referral codes go to the registered number, so changes to that number are a re-verification trigger.

Age checks in online pharmacy. Selling non-prescription medicines online requires confirming that the buyer is at least 14.

Retention and location. Medical records live in eHealth, whose central database must be hosted in Ukraine; biometric data processed by a private app need their own legal basis and should be kept no longer than needed.