E-prescriptions, e-referrals, information cards, test results—medical records are now digital, and each of these documents requires an electronic signature. We explain what type of signature to use for electronic medical records (EDM), how a ZUS certificate differs from a qualified signature, and when a healthcare facility might need a qualified seal.
From January 1, 2021. As a general rule, medical records are maintained in electronic form — Paper-based documentation is permissible only if a regulation expressly permits it or if organizationalprevent the use of digital records (Regulation of the Minister of Health of April 6, 2020, on the types, scope, and templates of medical records, as amended, Journal of Laws of 2024, item 798).
However, it is important to distinguish between two concepts that are often confused in these institutions:
Today, EDM includes:
📌 The EDM catalog is defined by the Regulation of the Minister of Health of May 8, 2018, on the types of electronic medical records (i.e., Journal of Laws of 2023, item 1851, as amended)—and it is growing steadily. A facility that streamlines its signing processes today saves itself the implementation rush with each subsequent expansion.
The Act on the Health Care Information System (Article 2, point 6) recognizes a document as an EDM only if it has been signed using one of the following four tools:
Each of these methods is legally valid for EDM. The differences become apparent in practice—in terms of cost, scope of application, and convenience when signing several dozen documents a day:
| Criterion | ZUS Certificate | Trusted signature | Personal Signature (e-dowód) | Qualified Signature (QES) |
|---|---|---|---|---|
| Cost | free | free | free certificate in the e-ID (requires an NFC reader) | paid subscription |
| Validity | 5 years | 3 years (renewable) | for the duration of the e-ID's validity | 1–3 years (renewable) |
| Scope of Application | only documents related to the provision of services: e-ZLA, e-prescriptions, EDM | EDM + Government Affairs in Poland | EDM + Public Administration | universal: EDM + contracts, HR, KSeF, e-Deliveries, tenders, the entire EU |
| Convenience for bulk signing | tall (mounted in an office unit) | low (each signature must be authorized by logging in) | average (each time: card reader/NFC-enabled phone and PIN) | high (cloud-based signature, integration with the HIS system) |
ZUS Certificate This is a natural starting point for a doctor: you can download it for free from the ZUS portal (eZUS/PUE) or via the app gabinet.gov.pl, is valid for 5 years, and an application for renewal can be submitted as early as 28 days before it expires. It has one limitation, but it is a significant one: it is valid only in the field of healthcare. You cannot use it to sign a contract with a business partner, HR documents, a bid for an NFZ tender, or a company report.
Trusted signature It works well for occasional signing, but requires authorization for each transaction—with dozens of documents a day, this becomes a bottleneck. We explain the differences between it and QES in this article: Differences between trusted profile and qualified electronic signature. As for where the signature layer will be used in the e-ID, we discuss this in the article: Personal Signature from an E-ID Card — When Does It Work, and When Doesn't It?
Qualified signature, e.g., mobile SimplySign, is a paid service, but it’s the only one that supports both EDM and everything beyond it: contracts with the National Health Fund (NFZ), employment contracts, invoices in the KSeF format, and correspondence via e-Doręczenia. For doctors who sign documents frequently, convenience is also important: the cloud-based signature works from a phone or computer, without a card or reader. And if you’re worried about „running out” of signatures—check this out: Qualified Signatures and Limits — How Many Times Can You Sign Documents?
Not every entry in the practice management system requires an electronic signature. The Regulation on Medical Records (§ 4) permits, for internal documentation — e.g., current entries in the medical history — use of internal mechanisms of the information and communications technology system: The system must uniquely identify the person making the entry and record the time and scope of each change. In practice, this means approving an entry in the account of a logged-in doctor or nurse.
💡 A full signature (one of the four methods prescribed by law) is, however, absolutely required for EDM documents from the catalog described above—because without it, an information sheet or test result is not considered an EDM under the law and cannot circulate within the exchange system.
From July 1, 2021. Every service provider—from a solo practice to a teaching hospital—has two obligations to the P1 platform:
This is an important architectural detail: P1 does not keep records—the facility does, for at least 20 years (Article 29 of the Patient Rights Act). This means that signatures on electronic medical records must remain verifiable for decades—long after the certificate used to create them has expired. We explain how to ensure this in our guide: How to secure a document for years to come? Preservation of electronic signatures in practice.
The digitization of healthcare is, in fact, accelerating: starting from January 1, 2026. works central online registration (Act of September 26, 2025, Journal of Laws 2025, Item 1537), initially covering cardiology, preventive mammography, and cytology, with the integration of healthcare providers to take place during 2026. The more efficiently a facility manages electronic signatures and electronic medical records (EDM), the easier it is for it to integrate into subsequent central systems.
A small office and a medical practice. A doctor running a private practice usually starts with a free package: the gabinet.gov.pl app or a commercial practice management program plus ZUS certificate for e-prescriptions, e-referrals, and e-sick leave certificates. This solution is entirely legal and convenient—as long as the practice is limited to medical treatment. In practice, however, the clinic owner is also a business owner: he or she signs lease agreements, documents for the Social Insurance Institution (ZUS) and the tax office, from April 1, 2026. issues invoices in KSeF (National e-Invoice System), and his company receives correspondence via e-Delivery. The ZUS certificate is not mentioned here—it is required QES, which can handle everything with a single tool.
Primary care clinics and medical centers. The primary care manager oversees the signatures of the entire team: doctors and nurses sign the EDM (ZUS certificate or QES), the registration department digitizes paper documents, and management signs contracts, reports, and HR documents. A sensible model is mix: ZUS certificates or qualified digital signatures for medical staff, QES for management, and a qualified digital seal for the entity (more on that in a moment).
Hospital. Scale changes everything: hundreds of information sheets and test results every day, shift work, and multiple doctors at a single workstation. A cloud-based signature system SimplySign It has an advantage over a card with a reader—the doctor signs from their phone or directly from the HIS system, without a „portable” reader and without having to log in to external portals. You can find a comparison of both options in the article: Mobile signature SimplySign or signature with reader Certum Mini? When to choose the right solution.
Qualified Electronic Seal (QSeal) It is the „corporate equivalent” of a signature: it identifies entity (clinic, hospital, medical company), rather than an individual, and, in accordance with eIDAS, this creates a presumption of the document’s integrity and authenticity of origin.
Let's start with the limits, because that's where it's easiest to make a costly mistake:
Where does the seal actually serve the facility?
You can find the cloud-based version of the seal here: SimplySign qualified electronic seal (starting at 1,289 PLN). The principle behind the division of roles is simple: The doctor signs — the facility stamps it.
The law provides healthcare facilities with four equally valid methods for signing electronic medical records (EDM), but the choice of tools is an organizational decision: what a doctor needs to issue an e-prescriptions, a different one for a manager signing contracts, and yet another for an entity that will be invoicing in the KSeF format starting in April 2026.
As authorized partner Certum We help healthcare facilities select and implement qualified digital signatures and seals—from individual practices to hospitals. We’ll advise you, set everything up, and train your team.
📞 Call us: +48 22 417 05 55 | ✉️ [email protected] Meet with an advisor at the office in Warsaw, Kraków, Wrocław, or Radom — or online and at a location of your choice.
Related products:
Pursuant to Article 2(6) of the Act on the Health Care Information System, an EDM must be signed with a qualified electronic signature, a trusted signature, a personal signature (e-dowód), or using a free ZUS certificate. All four methods are legally equivalent for EDM—they differ in cost, convenience, and scope of application outside the healthcare sector.
Yes. The ZUS certificate is valid for 5 years; it can be downloaded for free from the ZUS portal or the gabinet.gov.pl app and is used to sign e-ZLA forms, e-prescriptions, e-referrals, and other electronic medical documents (EDM). However, it works exclusively in the healthcare sector—it cannot be used to sign contracts, offers, or company documents.
A trusted signature is one of the four acceptable methods for signing electronic documents (EDM), so it is formally sufficient. In practice, however, it requires authorization of each signature, which is cumbersome when dealing with a large number of documents daily—which is why doctors more often opt for a ZUS certificate or a qualified digital signature integrated with their practice management system.
No. A qualified seal identifies a healthcare entity, not an individual, so it does not meet the legal requirement for a medical professional to sign an EDM. Within the facility, it is used for other purposes: authentication in KSeF, stamping organizational documents, and mass company correspondence.
Pursuant to Article 13b of the Act on the Health Care Information System, digitization involves creating a digital copy and affixing a qualified electronic signature to it, a trusted signature, or a personal signature by a person authorized by the service provider to confirm that the digital copy conforms to the paper document. A qualified seal is not required in this context.
No. Internal documentation (e.g., ongoing entries in health and medical records) can be approved using the internal mechanisms of the ICT system, which identifies the author and the time of the entry. A full electronic signature is required for EDM documents from the statutory catalog, including e-prescriptions, information cards, and laboratory test results.
