Updated · July 2026 · Deadline extended

HM Digital — officially certified CEZIH application manufacturer (HZZO)

CEZIH for Private Practices in Croatia: Deadline Extended to 1 January 2027

A guide for private practices, polyclinics, and private hospitals preparing to connect to CEZIH by the new deadline, 1 January 2027.

Goal: 14 days from "we haven't even started" to production data exchange with CEZIH.

The deadline for private healthcare institutions to connect to the Central Health Information System (CEZIH) has been extended to 1 January 2027. — the obligation has not been abolished, only the final deadline has moved. This guide explains what the obligation actually means, what penalties apply to those who do not comply in time, and the fastest path to compliance.

Fastest path to compliance Read the FAQ

In 60 seconds

The deadline to connect to CEZIH has been extended to 1 January 2027 — for both non-contractual providers and contractual providers (for the services they deliver privately). The obligation has not been abolished.
Fines up to €13,200 per breach, under the Health Data and Information Act (NN 14/2019, Articles 28 and 36) — and personal liability for practice owners — apply after the deadline passes.
Required exchange: ambulatory exam reports, specialist findings, hospital discharge letters.
Fastest path to compliance: a cloud solution. No installation, no server, no waiting on IT.
First step if not yet connected: obtain a healthcare institution code from HZZO (a prerequisite). Signing in CEZIH uses your AKD/HZZO card — it is mandatory (must be in the reader on the office computer). Certilia is an optional add-on for remote work from another device after the card is active, but it does not replace the card.

If you're in one of these situations, this guide is for you

The guide is written for 4 typical situations. If you recognize yourself, the next steps below are concrete.

Opening a new private practice

Run these in parallel: Ministry of Health decision → HZZO institution code → AKD card (qualified certificate, mandatory) → choosing CEZIH-certified software. A cloud solution shortens the technical part to days.

I have legacy software without CEZIH integration

Legacy software without CEZIH does not meet the legal obligation. You need to switch to a certified solution — fastest via the cloud option, which requires no new on-site equipment.

Non-contractual private provider without an HZZO code

A healthcare institution code (the "Dodjela šifre neugovorni" form) is a prerequisite. File the request immediately — send it to sifriranje.neugovorni@hzzo.hr along with the Ministry of Health decision.

Polyclinic or practice on multiple locations

You need a single software that supports multiple locations and one certificate per signer. A cloud solution lets you work and sign from any location once the session is established.

Deadline extended to 1 January 2027 — the obligation remains.

The original operational deadline for private healthcare providers to connect to CEZIH fell in the first months of 2026 (CEZIH notices and January 2026 press coverage cited a "by May" deadline). Because that window was too short for most private practices, the final deadline for full connection of all private providers — both HZZO-contracted and non-contracted — has been extended to 1 January 2027. This is stated explicitly by the Croatian Medical Chamber (HLK) and confirmed by July 2026 reporting ("the deadline was too short for most, so it was extended to 1 January 2027").

Important: this is not an abolition of the obligation. The legal basis (Health Data and Information Act, NN 14/2019) remains in force, and fines of up to €13,200 continue to apply to institutions that do not comply by the new deadline. Note: the list of certified software solutions on cezih.hr is actively being expanded — verify the latest status before choosing software.

For a detailed verification of the deadline change, the source list, and a note on how HLK and the press explain the deadline, see our dedicated page: CEZIH deadline for private practices — confirmation and sources

Who is covered

Non-contractual providers (private practices, polyclinics, and hospitals without an HZZO contract) — must begin CEZIH data exchange
Contractual providers (those already using CEZIH for HZZO services) — must also begin exchange for services they deliver privately
All specialties — family medicine, dentistry, specialists, diagnostics, private hospitals
All sizes — from solo practices to multi-location polyclinics

CEZIH non-compliance penalties

The legal basis is the Health Data and Information Act (NN 14/2019). Article 28 establishes the obligation to integrate with CEZIH; Article 36 sets the penalties for non-compliance.

up to €13,200 per established breach

under Article 36 of the Health Data and Information Act (NN 14/2019) — read the act on Narodne novine (Croatian).

Sanctions also apply personally to practice owners — not only to the legal entity.

Practical consequences for a practice

Monetary fine in misdemeanor proceedings
Risk of additional HZZO inspections (controls of healthcare delivery)
Possible difficulties when renewing HZZO contracts
Reputational risk with patients who expect a modern, connected healthcare system

Math: a single €13,200 fine equals 14 years of using a modern cloud CEZIH solution at €79/month. Technical compliance is consistently cheaper than non-compliance.

What exactly must be exchanged with CEZIH

Under the law and implementing regulations, private healthcare institutions must share three core categories of documents through CEZIH: Detailed technical guidance is published in the official CEZIH onboarding PDF.

Ambulatory reports

Reports from outpatient examinations at private healthcare facilities, with conclusions and recommendations.

Specialist findings

Findings from specialist consultations, diagnostic procedures, and other medical interventions in a standardized format.

Hospital discharge letters

Discharge letters following hospitalization or day-care treatment in private hospitals.

Why the exchange is mandated

The goal is to keep all of a patient's findings and treatments in one place — reducing the risk of errors, duplicated treatments, or duplicated tests, and critically supporting emergency care when a patient is treated by a doctor other than their primary physician.

Concrete examples by document type

Document type	Concrete examples
Ambulatory reports	Report after a family physician visit; systematic exam report; GP report after initial workup
Specialist findings	MRI / CT / ultrasound findings; blood test results; specialist consultations (cardiologist, dermatologist, orthopedist, ophthalmologist, …)
Discharge letters	Discharge letter after hospitalization; day-hospital report after a procedure

What is CEZIH (and who runs it)

CEZIH (the Central Health Information System of the Republic of Croatia) is the central IT system that connects healthcare providers, the Croatian Health Insurance Fund (HZZO), and other stakeholders in healthcare. The system is operated by HZZO; the regulatory framework is set by the Ministry of Health.

CEZIH is the channel for issuing and exchanging ePrescriptions, eReferrals, eFindings, and other medical documentation. The system has been operating in public healthcare for over a decade — per Black Book Research (2026), more than 15 million eReferrals and over 60 million prescriptions and findings are issued through CEZIH each year.

Official CEZIH website

CEZIH modules for private practices: ePrescription, eReferral, eFinding

A private practice typically uses three core CEZIH modules. Modern medical software integrates all of them in a single interface — no switching between portals.

ePrescription

Electronic prescription issuance directly from the medical software. The patient picks up the prescription at any pharmacy using their OIB or e-ID — no paper copy needed.

eReferral

Electronic referral for specialist consultations, diagnostics, or hospitalization. The referral is submitted to CEZIH and immediately visible to the receiving facility.

eFinding

Submission of test and specialist findings to CEZIH, where they are immediately accessible to the patient and to other treating physicians (with appropriate authorizations).

Authentication and signing: AKD card + Certilia

HZZO still requires a strict technical setup for CEZIH data exchange: a Windows computer, a qualified certificate (an AKD smart card or the new official healthcare-worker ID card), VPN access, and the software vendor's local agent. At least one machine in the practice must satisfy all of these requirements to establish a CEZIH session.

What is required to access CEZIH

A Windows computer (at least one in the practice)
A qualified certificate — an AKD smart card or the new official healthcare-worker ID card (from 1 July 2026 the old HZZO smart cards no longer grant access to CEZIH) + a reader
VPN access into the HZZO network
The software vendor's local agent (the component that bridges the application and CEZIH protocols)

Two signing modes once the session is established

AKD smart card

Classic card-based signing in the reader. Each CEZIH action (ePrescription, eReferral, eFinding) is signed directly with the card.

Certilia (mobile / remote signing)

Once the session is established on the office computer (card + reader + VPN + agent are running), you can sign CEZIH actions via the Certilia mobile app — without physically touching the card for every signature. Useful when you are in another room of the practice, at another location, or working from home.

Our software supports both modes: card-based signing and Certilia mobile remote signing. Pick whichever fits the situation.

Common login issues

The system does not recognize the card — most often caused by outdated middleware or an improperly connected reader.
VPN is not active — without VPN there is no access, regardless of the card.
The local agent is not running — verify the service is started on the office computer.
Expired certificate — qualified certificates have a limited validity period and must be renewed before they expire.
Wrong PIN — multiple incorrect attempts can lock the card.

How to connect to CEZIH without your own server (cloud vs local)

CEZIH data exchange technically still requires an office Windows computer with a card, reader, VPN, and the software vendor's local agent — regardless of whether the application itself is "cloud" or "local". The cloud-vs-local choice is not about bypassing that setup; it is about where your data lives, how the application is updated, and how you reach the system from devices other than the main office computer.

Legacy software (no CEZIH) vs CEZIH-certified cloud

A quick at-a-glance view — what you gain by switching from outdated software without CEZIH integration to a certified cloud solution.

What you gain	Legacy software (no CEZIH)	CEZIH-certified cloud software
Legal CEZIH compliance	✗	✓
No on-premise server	✗	✓
Automatic CEZIH protocol updates	✗	✓
Onboarding in days (not weeks)	✗	✓
Work and sign from another device (laptop / phone) between patients	✗	✓
Eliminates the up-to-€13,200 fine risk	✗	✓

Important: both cloud and local solutions require one Windows computer in the practice with card, reader, VPN, and agent — that is an HZZO requirement, not a software limitation. Cloud removes the on-prem server and opens up additional devices for work once the session is established. See our cloud CEZIH software.

The fastest compliance path for unprepared practices

If your practice is not yet connected, here is the order of steps that, in practice, takes 1–2 weeks — assuming the administrative work is not delayed. Step 1 (HZZO administration) is the slowest, so start it immediately.

1

Week 1
Obtain a healthcare institution code from HZZO

A healthcare institution code (šifra zdravstvene ustanove) is a prerequisite for CEZIH connection for non-contractual providers. Fill out the "Dodjela šifre neugovorni" form, sign it (digitally) and stamp it with the authorized representative's seal, then submit the request — with the Ministry of Health decision (rješenje Ministarstva zdravstva) attached — by email to sifriranje.neugovorni@hzzo.hr.
2

Week 1
Prepare your AKD card for access and signing (Certilia optional)

Access to CEZIH and signing of documents uses your AKD card (the HZZO smart card, or from 1 Jul 2026 the new healthcare-worker ID card) — the card is mandatory and must be in the reader on the office computer. Certilia is an optional add-on that lets you work and sign from another device (phone, laptop) after the card is already active; it is not required, and it does not replace the card.
3

Week 1
Choose CEZIH-certified (or in-certification) software

Check the list of certified solutions on cezih.hr — that list is actively being expanded for non-contractual providers. Cloud solutions have an advantage because they remove installation and on-premise server requirements.
4

Week 2
Onboarding and software configuration

The vendor configures the practice, users, code lists, and templates. With cloud solutions this typically takes 1–2 days.
5

Week 2
Test and production exchange + training

Verification that ePrescriptions, eReferrals, and eFindings are correctly delivered to CEZIH; switch to production exchange and a short team training session (1–2 hours).

Need urgent compliance? See our cloud CEZIH software

Want us to handle the technical side for you?

VPN, certificates, AKD card, CEZIH module — we take care of the whole process. Cloud onboarding takes days, not weeks.

Request a free consultation See the cloud CEZIH software

How to choose CEZIH software: 7 criteria

If you are choosing under deadline pressure, these criteria protect you both from fines and from a poor long-term decision. Check the list of certified solutions on the official CEZIH website.

CEZIH certification (or in-process)

The software must appear on the official list of CEZIH-certified solutions on cezih.hr. HM Digital is on that list (category Software solutions for private/institutions, G500). The list is actively being expanded for non-contractual providers — verify the latest status before signing.

Cloud (no on-premise server)

No installation, no physical server, no dependency on a local computer. Updates roll out automatically.

Onboarding speed

Ask explicitly: "How long from contract signature to production?" Target — days, not weeks.

Specialization for your practice type

Dentistry, family medicine, physiatry — templates and workflows must match your specialty.

Pricing fit for a practice (not a hospital)

Subscriptions of ~€79–€199 per month should be enough for a solo practice or smaller polyclinic. Hospital systems are not appropriate.

No long-term lock-in

Monthly cancellable, no multi-year contracts. Freedom to switch if the solution is not a fit.

Croatian-language support

Phone and email support in Croatian, with hands-on knowledge of CEZIH and the local regulatory framework.

Questions to ask the vendor before signing

How long from contract signature to production data exchange with CEZIH?
How are existing data migrated from my current software?
What is the support level and SLA — phone, email, response time?
Is there contractual lock-in or an exit clause? Monthly cancellable?
Can I export my data in a standardized format if I ever cancel?

Frequently asked questions

What if my practice is not yet connected to CEZIH?

You are not alone — a significant share of private practices is in the same position. The fastest path to compliance is a CEZIH-certified cloud solution that requires no installation or on-premise server. Before that, obtain a healthcare institution code from HZZO (a prerequisite for connection). Signing in CEZIH uses your AKD card (the HZZO smart card, or from 1 Jul 2026 the new healthcare-worker ID card) — the card is mandatory and must be in the reader on the office computer. Software onboarding with modern cloud solutions takes a few days.

Do I need a special code from HZZO before connecting to CEZIH?

Yes. Per CEZIH and HZZO guidance, non-contractual healthcare providers (those without an HZZO contract) must obtain a healthcare institution code (šifra zdravstvene ustanove) from HZZO as a prerequisite for CEZIH connection. The request is filed via the "Dodjela šifre neugovorni" form, signed (digitally) and stamped, and submitted to sifriranje.neugovorni@hzzo.hr — with the Ministry of Health decision (rješenje Ministarstva zdravstva) attached.

Will HZZO inspectors definitely fine me?

Inspections and misdemeanor proceedings are not triggered automatically, but the legal basis for fines exists and applies after the (extended) 1 January 2027 deadline passes. The longer you remain non-compliant after the deadline, the higher the probability of an inspection — especially if patients or other institutions report the absence of data exchange.

How large is the fine, exactly?

Under Article 36 of the Health Data and Information Act (NN 14/2019), fines go up to €13,200 per established breach for the legal entity. Sanctions also apply personally to the practice owner.

Can I keep operating privately without CEZIH if I have no HZZO contract?

No. The obligation to connect to CEZIH does not depend on whether you have an HZZO contract. The exchange of ambulatory reports, specialist findings, and discharge letters is mandated for all healthcare providers.

What if I use legacy software without CEZIH integration?

Legacy software without CEZIH integration does not meet the legal obligation — regardless of whether it has worked for you so far. Switching to a CEZIH-certified solution is required. Cloud solutions ease migration because no new on-site equipment is needed.

How long does the full onboarding take?

With CEZIH-certified cloud software, only a few business days can pass from contract signature to production data exchange — assuming you already have a Certilia / AKD certificate. If you are still obtaining the certificate, add 1–2 weeks for that step.

What is the difference between CEZIH-certified and CEZIH-compatible software?

"Certified" means the solution has passed an official readiness review and appears on the list of approved software solutions on cezih.hr. "Compatible" is a marketing term with no legal weight. Legal compliance requires certified software. HM Digital appears on the official CEZIH list of certified application manufacturers (category Software solutions for private/institutions, G500) — you can verify us independently on cezih.hr.

Do I need a smart card reader and VPN?

Yes. For CEZIH data exchange, HZZO requires at least one Windows computer in the practice with an AKD card, a reader, VPN access, and the software vendor's local agent. Certilia (mobile remote signing) does not bypass that requirement — it kicks in only after the session has been established. Once it has, every CEZIH action can be signed via the Certilia mobile app, without physically using the card for every signature. Our software supports both signing modes (card + Certilia mobile).

What is sent to CEZIH? Will my data be visible to everyone?

Ambulatory reports, specialist findings, and discharge letters are sent to CEZIH. Access is strictly regulated — other physicians only see documents for patients they are actively treating, and the system maintains audit trails of every access.

Can I cancel a cloud solution if I change my mind?

With quality cloud solutions — yes, on a monthly basis and without penalties. Insist explicitly on "no long-term lock-in" before signing. Your data must remain exportable (in a standardized format) for migration to another vendor.

I work only privately and have no HZZO contract — do I have to join CEZIH?

Yes. Per CEZIH and HZZO guidance, the CEZIH obligation also covers non-contractual healthcare providers — those who work exclusively privately, without an HZZO contract. The first step for you is obtaining a healthcare institution code (šifra zdravstvene ustanove) from HZZO — a prerequisite, filed via the "Dodjela šifre neugovorni" form and emailed to sifriranje.neugovorni@hzzo.hr, with the Ministry of Health decision attached. Only after the code is issued can you start the technical CEZIH connection.

I have practices on two locations — do I need two systems or multiple certificates?

You need a single software that supports multiple locations (cloud solutions handle this natively) and one qualified certificate per signing person. Technically, every location where CEZIH exchange happens requires at least one Windows computer with an AKD card, a reader, VPN access, and the local agent. Certilia mobile signing lets you sign from any location once the session has been established.

What if an inspector arrives while I have already signed a vendor contract but I am not yet in production?

Document everything — the vendor contract, the HZZO forms you have submitted, the certificate issuance status, the planned production date. Although a process in progress does not undo the breach itself, misdemeanor proceedings weigh both the degree of negligence and the steps taken toward compliance. The more evidence you have that the process is actively underway, the higher the chance of leniency. The safest strategy is still to avoid an inspection by accelerating production — with cloud solutions, that is days, not weeks.

Next step: compliance in days, not weeks

If you are looking for the fastest path to CEZIH compliance — without installation, without a server, without waiting on IT — see our cloud CEZIH software. It is purpose-built for private practices and polyclinics, with onboarding that takes days, not weeks.

See the cloud CEZIH software Request a free consultation

Sources and further reading

This content is informational and does not constitute legal advice. For specific legal assessments, consult a qualified attorney or the relevant authority.