Is the electronic health record (DES) mandatory for private clinics in Romania?
Yes. The duty to register and transmit data into the Electronic Health Record applies to every medical service provider, whether or not it holds a contract with a health insurance house. The rule and its penalties sit in Law 95/2006, under the title introduced by Law 45/2019.
Short answer
- Registering and transmitting medical data to the DES system is mandatory for all medical service providers (art. 346⁹ para. 2 of Law 95/2006).
- The duty also applies to private clinics and practices that hold no contract with a health insurance house.
- TRANSMITTING data to DES needs no patient consent; a doctor's ACCESS to it is, as a rule, allowed only with the patient's consent (art. 346⁶ para. 3).
- For providers WITHOUT an insurance house contract, a first breach draws a written warning and later ones a 3%–5% fine on the value of the untransmitted services, computed monthly; providers WITH a contract are penalised through the framework contract.
- A fourth breach within a period shorter than 24 months adds a 6-month suspension of the sanitary operating authorisation.
What the law says (in brief)
- Law 45/2019 introduced into Law 95/2006 title IX¹, “The patient's electronic health record” (articles 346¹–346¹²).
- Art. 346⁹ para. (2): registering and transmitting the data is mandatory for all providers, with no patient consent needed.
- Art. 346⁶ para. (3): DES data is accessible to doctors only with the patient's consent — the exception is the «Emergency summary» module, available in emergency structures and primary care.
- Art. 346¹²: a patient may expressly refuse the use of DES, in which case their data is anonymised; the refusal does not deprive them of medical services.
- Art. 346⁵ para. (1): the service is rolled out gradually, as the functionalities specific to each type of care are implemented in DES.
- Art. 346¹⁰ para. (6): a “later breach” means failing the same duty within a period shorter than 24 months; breaches are established by the Ministry of Health and the public health directorates (para. 7).
Who risks which penalty
Penalties for not transmitting data to DES, by provider type
| Provider type | First breach | Later breaches (within 24 months) |
|---|---|---|
| Private clinic or practice, no CAS contract | Written warning | 3%–5% of the value of untransmitted services, monthly |
| Inpatient unit, no CAS contract | 0.5% of the value of unregistered services, monthly | 1%–3% of the value of untransmitted services, monthly |
| Provider with an insurance house contract | Per the rules of the contractual relationship | Per the rules of the contractual relationship |
Practical examples
- Example: a private clinic with no CAS contract provides 40,000 lei of services in a month and does not transmit them to DES. On a second breach the fine is between 1,200 and 2,000 lei (3%–5%), for that month.
- Example: the same clinic repeats the breach a fourth time within 20 months. On top of the fine, it draws a 6-month suspension of its sanitary operating authorisation, because the interval is under 24 months.
Common mistakes
- Assuming the duty only covers providers with a CAS contract — the law says “all medical service providers”.
- Confusing the two consents: TRANSMITTING to DES needs none, but a doctor's ACCESS to the record does, outside the «Emergency summary» module.
- Confusing the electronic record inside your clinic software with DES — the record is your internal evidence, DES is the national system.
- Postponing the application update after the e-Sănătatea Mea platform launched (1 September 2026): CNAS asks providers for versions compatible with the new SIUI.
How 4clinics helps
Explicitly: 4clinics does not connect to the DES system — reporting goes through the application connected to the health insurance IT platform. 4clinics keeps the data you report complete and structured.
- The patient record keeps consultations, diagnoses, prescriptions and documents in one place — the source of the data you report.
- Every consultation carries a date and a doctor, and the appointment behind it keeps the fee — that is where the monthly list you report comes from.
- The patient list is searchable by name, personal ID, phone or e-mail, and from a record you reach that patient's whole history.
- Each clinic's data is isolated, and access rights are granted per section, by invitation, along GDPR principles.