For clinics, centres and hospitals in São Paulo, Rio de Janeiro and across Brazil
Brazilian clinic software, built to help you achieve ONA Acreditado com Excelência.
In Brazil the vigilância sanitária licenses the clinic under ANVISA's rules, the CRM registers it and holds its diretor técnico responsible, and ONA accredits it in three levels, the third being Acreditado com Excelência. wai runs booking, signed clinical notes, patient messaging in Portuguese or any language, payments and an audit trail on one record, so the evidence each of them reads is kept as the work is done.
What do ANVISA, the CFM and ONA ask of a clinic in 2026?
Six areas that decide whether a Brazilian clinic may open, how it keeps its records and how far it climbs in ONA accreditation.
Six areas set by ANVISA, the CFM, the LGPD and ONA, from the licence to accreditation. Open one for the rules behind it.1
01The licença sanitária and boas práticasEvery health service needs a current licence from its state or municipal vigilância sanitária, displayed to the public, and must meet ANVISA's requirements for good operating practice under RDC 63/2011.6 requirements
RDC 63/2011 art. 10, licença atualizada, afixada em local visível ao público
RDC 63/2011 art. 14, responsável técnico e substituto, com alteração notificada
RDC 63/2011 art. 9, regimento interno atualizado
RDC 63/2011 art. 13, inscrição atualizada no CNES
RDC 63/2011 art. 23, documentação e registros mantidos disponíveis
Lei 6.437/1977 art. 10, funcionar sem licença sanitária é infração
02Patient safety and adverse eventsHealth services constitute a Núcleo de Segurança do Paciente, write a Plano de Segurança do Paciente and notify adverse events to ANVISA on a fixed clock, under RDC 36/2013. Individual consulting rooms are outside that RDC, and RDC 63/2011's safety measures apply to every service.6 requirements
RDC 36/2013 art. 4, Núcleo de Segurança do Paciente (NSP) constituído pela direção
RDC 36/2013 art. 8, Plano de Segurança do Paciente (PSP)
RDC 36/2013 art. 10, notificação mensal até o 15º dia útil do mês seguinte
RDC 36/2013 art. 10, parágrafo único, óbito notificado em até 72 horas
RDC 63/2011 art. 8, estratégias e ações de segurança do paciente
RDC 63/2011 art. 7, reclamações examinadas, registradas e investigadas
03CRM registration and the diretor técnicoA private clinic providing medical care registers with the CRM of its state, renews its certificate every year, and names a diretor técnico who answers to the council and the authorities for how it runs.6 requirements
Lei 6.839/1980, registro da empresa no conselho profissional
Resolução CFM 1.980/2011, registro da pessoa jurídica no CRM, com alvará da vigilância sanitária
Resolução CFM 1.980/2011 art. 7, alterações comunicadas em 30 dias
Resolução CFM 1.980/2011 art. 8, certificado renovado anualmente e disponível ao público
Resolução CFM 2.147/2016 art. 2, deveres do diretor técnico
Resolução CFM 2.147/2016 art. 10, afastamento comunicado ao CRM por escrito
04The prontuárioEvery patient has one record, dated, timed and signed at each assessment, reviewed by a committee, available to the patient, and kept at least 20 years from the last entry.6 rules
Código de Ética Médica art. 87, data, hora, assinatura e número do CRM em cada avaliação
Código de Ética Médica art. 88, acesso e cópia do prontuário ao paciente
Resolução CFM 1.638/2002, conteúdo mínimo e Comissão de Revisão de Prontuários
RDC 63/2011 arts. 24 a 28, registro, guarda, confidencialidade e acesso
Resolução CFM 1.821/2007, NGS2 e certificado ICP-Brasil para eliminar o papel
Lei 13.787/2018 art. 6, guarda mínima de 20 anos a partir do último registro
05Telemedicine, AI and health dataThe CFM sets the consent and record rules for telemedicine and, since August 2026, for AI in care. The LGPD treats health data as sensitive and sets a three working day clock for incidents.5 rules
Resolução CFM 2.314/2022 art. 15, termo de concordância e autorização no prontuário eletrônico
Resolução CFM 2.314/2022 art. 3, registro em SRES com NGS2
Resolução CFM 2.454/2026, IA como apoio, paciente informado e registro no prontuário
LGPD art. 11, dado de saúde como dado pessoal sensível
LGPD art. 48 e Resolução CD/ANPD 15/2024, incidente comunicado em três dias úteis
06ONA accreditationONA accreditation is voluntary and runs in three levels, assessed by a credentialed accrediting institution that checks what the clinic says it does, what it does and what patients perceive.5 levels
Nível 1, Acreditado
Nível 2, Acreditado Pleno
Nível 3, Acreditado com Excelência
Manual OPSS 2026, Jornada do Paciente e Requisitos Transversais
Triangulação, o que a organização diz que faz, o que faz e o que o paciente sente e percebe
What do the vigilância, the CRM and an ONA assessor look at?
Six areas named in RDC 63/2011, the CFM's resolutions and ONA's 2026 method.2
01
The licence and the RT
A current licença sanitária on display, a responsável técnico and substitute, and an up to date CNES entry.
02
Written procedures
A regimento interno and current written procedures for every work process, within reach of the whole team.
03
The prontuário
Dated, timed and signed entries with the CRM number, reviewed by the Comissão de Revisão de Prontuários.
04
Patient safety
An NSP, a written Plano de Segurança do Paciente and adverse events notified on time.
05
People
Every doctor's CRM registration and specialist title on file, and training recorded with date, content and instructor.
06
The patient's experience
What the clinic says, what it does and what patients perceive, the three perspectives ONA triangulates.
How is a Brazilian clinic judged?
The licence and the CRM registration decide whether the clinic may operate. ONA's three levels, decided after an assessment by a credentialed institution, show how far it has gone beyond that.3
Nível 1, AcreditadoSafety and compliance of care and organisational processes
Nível 2, Acreditado PlenoIntegrated processes and more mature management
Nível 3, Acreditado com ExcelênciaResults, continuous improvement, innovation and a consolidated culture
Licença sanitáriaThe legal permission to operate, from the state or municipal vigilância
1,803
organisations held ONA accreditation in 25 Brazilian states on ONA's map in October 2026.4
72 hours
is the limit to notify ANVISA's system of an adverse event that led to death, under RDC 36/2013.5
20 years
is the minimum time a prontuário is kept from the last entry before it may be eliminated, under Lei 13.787/2018.6
Operating a clinic without a licence from the competent sanitary body is an infraction under Lei 6.437/1977, punished by warning, interdiction, cancellation or a fine.
Failing to meet RDC 63/2011 or RDC 36/2013 is a sanitary infraction under the same law.
The CRM registration certificate is renewed every year and kept available to the public, and changes reach the CRM within 30 days.
ONA accreditation is voluntary, and Level 3 appears under the accreditation attribute in the ANS's QUALISS search.
What has changed for Brazilian clinics?
Three changes a clinic should know in October 2026, each in force.
In force. Resolução CFM 2.454/2026 on AI in medicine, published on 27 February 2026, took effect 180 days later. It keeps the doctor fully responsible, gives patients the right to be told and to refuse, and asks for AI used in a decision to be recorded in the prontuário.
In force. ONA assesses organisations on the Manual OPSS 2026, with a method built on the Jornada do Paciente and three perspectives triangulated by the assessor.7
In force. São Paulo city registers health establishments in the CMVS under Portaria SMS 266/2025, published on 6 May 2025.
Who does what in Brazil
Five bodies a private clinic answers to, and what each decides.8
Body
What it does
Where a clinic meets it
ANVISA
Writes the national sanitary rules, such as RDC 63/2011 and RDC 36/2013, and receives adverse event notifications
The RDCs, and the NSP's notifications
Vigilância sanitária
Issues and inspects the licença sanitária, at state or municipal level
Set the rules of medical practice, register clinics and hold the diretor técnico responsible
CREMESP in São Paulo, CREMERJ in Rio de Janeiro
ONA
Runs voluntary accreditation in three levels through credentialed institutions
Nível 1, Acreditado Pleno, Acreditado com Excelência
ANPD
Enforces the LGPD and receives security incident reports
Incidents reported within three working days
The Portuguese names
The official names behind this page, as clinics search for them.
Licença sanitária, the sanitary licence to operate, sometimes called the alvará sanitário.1
Responsável técnico (RT), the professional answerable to the vigilância for the service.
Diretor técnico, the doctor answerable to the CRM for how the clinic runs.
Prontuário, the patient record.
Comissão de Revisão de Prontuários, the committee that reviews records.
Núcleo de Segurança do Paciente (NSP), the clinic's patient safety unit.
Plano de Segurança do Paciente (PSP), its written safety plan.
Acreditado com Excelência, ONA's Level 3.
What should clinic software in Brazil run?
Each module runs part of the clinic and records the evidence for the requirements listed beside it.
01
Appointments and booking
Online booking from your own website, every clinician's diary read from their calendar, reminders, rebooking after a missed visit and waitlist offers when a slot opens.
Online booking at any hour, with a reminder before the visit.
For the business
Fewer missed appointments, and cancelled slots offered to the waitlist.
On the record
Every booking, reminder and change, with a time and a name.
02
Billing and payments
Card payments into your own Stripe account, the cancellation policy shown at booking, invoices, statements and reconciliation, with an export for your accountant.
A clear price and policy before they commit, and an invoice in their app.
For the business
Payments reconciled against visits, with an export for your accountant.
On the record
What was charged, when, against which visit, and the policy the patient saw.
03
AI scribe and clinical notes
The note, letters and referrals written from the consultation, cited to published clinical guidelines, with the transcript beside the note, for the clinician to read, edit and sign.
The clinician's attention stays on them during the consultation.
For the business
Less time spent writing notes after clinic.
On the record
A contemporaneous note, signed, with the time, the signature and the source it cites.
04
Follow-ups and patient messaging
WhatsApp, email and calls in one thread per patient, replies drafted in the patient's own language for your team to approve, a response clock on every new enquiry, and recalls a clinician approves.
A reply in the language they wrote in, approved by your team.
For the business
More enquiries answered within the hour, when they are most likely to book.
On the record
The whole conversation on one record, with response times.
05
Referrals, consent and audit trails
Recording consent taken at booking, referrals written from the visit, patient flags for controlled drugs and safeguarding notes, and every read of a record logged against a named account.
For each requirement, the records wai keeps, how you produce them, and what changes for patients and the business.
The licença sanitária and boas práticas
Systems running before the licence visit.
Named accounts for every person, with role-based access
Online booking, reminders and waitlist offers from the first day
Signed, timed notes on one record per patient
Records hosted in the clinic's own country, set up with you before go-live
On request. Show the record system and the staff accounts the vigilância inspector asks about, running on real patients.
For patients
A clinic that works properly from the first appointment.
For the business
A licence issued on time, with no weeks lost to a missing record.
Patient safety and adverse events
Adverse event reviews that start from the record.
An audit trail of who saw and changed what, and when
Signed, contemporaneous notes for every visit
Patient flags for controlled drugs and safeguarding notes
Reports for any period, produced on the day
On request. Pull the timeline behind an adverse event, with times and names, from the audit trail.
For patients
Problems found and fixed, with the reason recorded.
For the business
NSP reviews built from live data, without a separate collection exercise.
CRM registration and the diretor técnico
Every action under a named, registered doctor.
A named account for every clinician and every member of staff
Role-based access enforced in the database
The signing clinician recorded on every note and letter
Every read and change of a record logged against the account
On request. Show who holds which role, and every action taken under it, to the minute.
For patients
Their record seen only by the people whose role allows it.
For the business
A corpo clínico list and an access log that match, ready for the CRM.
The prontuário
A record where every entry has an author and a time.
Notes drafted from the consultation, read, edited and signed by the doctor
The transcript beside the note, so the source of each entry stays visible
Every read and change logged against a named account
The patient's own record exportable on request
On request. Open any consultation to see the note, its author, its signature and its time together.
For patients
A copy of their record when they ask for it.
For the business
Less time writing notes after clinic, and a record the review committee can read.
Telemedicine, AI and health data
A person approves every message, and the doctor signs every note.
Recording consent taken at booking, and the consent discussion in the note
Replies drafted in the patient's language for your team to approve
Every read of a record logged against a named account
Records hosted in the clinic's own country, encrypted
On request. Show where consent was taken, who approved each message and who read each record.
For patients
Told how AI supports their care, with a person behind every answer.
For the business
An incident scoped from the logs in hours, inside the ANPD's clock.
ONA accreditation
Every patient conversation on one record, in their language.
WhatsApp, email and calls on one thread per patient, with response times
The price and cancellation policy shown before the patient commits
Online booking, reminders and waitlist offers
Response, front desk and takings reports for any period
On request. Show the whole conversation with a patient, who replied and how fast.
For patients
Clear answers in Portuguese, English or the language they wrote in.
For the business
More enquiries answered within the hour, when they are most likely to become appointments.
What do patients and the business gain?
Published research on response times, ambient scribes and appointment reminders.
7x
An enquiry answered within the hour is nearly seven times as likely to become a real conversation.9
30%
Clinicians using an ambient scribe did 30% less work after hours.10
23%
Patients sent a notification before their visit were 23% more likely to attend.11
How does wai surface the evidence on request?
What may be asked for, where it is kept in wai, and how it is produced.
Asked forWhere it livesHow it is produced
The prontuárioThe patient record, beside the transcriptOpen the consultation to see the note, its author, signature and time together.
Changes to an entryThe audit trailWho changed the note, when, and the signed version that stands.
Access to recordsEvery recordWho read it, under which account, to the minute.
Corpo clínico and rolesAccounts and rolesWho holds which role, matched to the list the CRM holds.
ConsentThe booking and the noteThe recording notice the patient saw at booking, and the consent discussion in the note.
Patient communicationThe patient's threadEvery message, in Portuguese or any language, with response times.
Fees and policiesPaymentsWhat was charged, against which visit, and the policy the patient saw.
NSP and ONA indicatorsReportsResponse, front desk and takings reports for any period, on the day.
How do you prepare a Brazilian clinic for its licence and ONA?
A readiness checklist in four parts, from opening to Level 3.
01Licence and registration
A current licença sanitária, displayed where the public can see it.
A responsável técnico and a substitute named to the vigilância.
The clinic and every branch registered with the CRM, the certificate renewed each year.
A diretor técnico in place, exercising the role in person.
02Records
Every entry dated, timed and signed, with the doctor's CRM number.
A Comissão de Revisão de Prontuários, coordinated by a doctor.
Records kept at least 20 years from the last entry.
Patients can see their record and receive copies.
03Safety
A Núcleo de Segurança do Paciente and a written Plano de Segurança.
Adverse events notified monthly, and deaths within 72 hours.
Complaints examined, recorded and investigated.
A data incident procedure on the ANPD's three working day clock.
04Toward ONA
Written procedures that match what the clinic does.
Tracers of real patients, with the record and the patient's account compared.
Indicators reviewed in improvement cycles.
Consent for telemedicine and AI recorded in the prontuário.
What will the vigilância, the CRM or an ONA assessor ask you?
Questions that follow from the rules they apply, what to show, and where wai holds the answer.
01Who is the responsável técnico, and who is the diretor técnico?
What to show
The names, their CRM registration, and the notice given to the vigilância and the CRM.
Where wai has it ready
Named accounts and roles show who holds each role, and every action taken under it.
02Show me how the prontuário is kept.
What to show
Entries with date, time and signature, reviewed by the committee, kept at least 20 years.
Where wai has it ready
Notes are signed and timed by the doctor, and every change is logged against a named account.
03Which doctors work here, and are they registered?
What to show
The corpo clínico list, each doctor's CRM registration and specialist title on file.
Where wai has it ready
Every person has a named account, so the staff list and the access log match.
04How are adverse events found, analysed and notified?
What to show
The NSP's records, the analyses, and the notifications made on time.
Where wai has it ready
The audit trail gives each review its timeline, with times and names.
05How was this patient told about telemedicine or AI, and did they agree?
What to show
The term of agreement in the electronic record, and the AI use noted in the prontuário.
Where wai has it ready
Recording consent is taken at booking, and the consent discussion is in the signed note.
06Can I follow one patient from first contact to follow-up?
What to show
The booking, the messages, the note, the payment and the follow-up for one patient.
Where wai has it ready
One record holds the booking, the conversation, the signed note and the payment.
07How do you use AI in care?
What to show
Where AI is used, and who decides.
Where wai has it ready
AI drafts the note and the reply. The doctor signs the note, and a person approves every message.
What is at stake for a Brazilian clinic?
No clinic may operate without its licence, a data incident handled badly can cost up to R$50 million, and ONA's top level is a public signal to patients and plans.
R$1.5 million
is the highest fine for a very serious sanitary infraction under Lei 6.437/1977, doubled on a repeat.12
R$50 million
is the cap per infraction on an LGPD fine of up to 2% of a company's revenue in Brazil.13
2,500+
certifications homologated by ONA since it was founded in 1999.14
What is the best clinic software for ANVISA, CFM and ONA?
The best software for a Brazilian clinic is the system the clinic already runs on, so the evidence is kept as the work is done. Look for a record that shows the author and time of every entry, notes signed by the doctor, messaging in Portuguese and English, named accounts with role-based access and a full audit trail. wai is built that way, to help you achieve ONA Acreditado com Excelência.
Is there ANVISA or ONA approved clinic software?
The vigilância sanitária licenses health services under ANVISA's rules, the CRMs register clinics under the CFM's, and ONA, through its credentialed institutions, accredits health organisations. It does not approve, certify or endorse software, wai included, and software cannot earn an accreditation on a provider's behalf. wai keeps the records your team uses to show ONA how care is delivered, and ONA decides the accreditation.
Is ONA accreditation required to open a clinic?
No, ONA accreditation is voluntary. To operate, a clinic needs its licença sanitária from the state or municipal vigilância and, as a company providing medical care, its registration with the CRM.
Does a consulting room need a Núcleo de Segurança do Paciente?
RDC 36/2013 leaves individual consulting rooms, clinical laboratories and mobile and home care services out of its scope. RDC 63/2011's patient safety measures apply to every health service.
How long must a Brazilian clinic keep patient records?
At least 20 years from the last entry before a record may be eliminated, under Lei 13.787/2018, for paper, digitised and electronic records alike.
Can AI write notes in a Brazilian clinic?
Resolução CFM 2.454/2026 allows AI as a support tool. The doctor stays fully responsible, the patient is told and may refuse, and AI used in a decision is recorded in the prontuário. A note drafted by AI meets that when the doctor reviews, edits and signs it.
Where does wai keep our records?
In each clinic's own country, under that country's rules, encrypted, with a full audit log. For a Brazilian clinic that is Brazil. We set this up with you before go-live.
Fifteen minutes on video, in Portuguese or English, on your own clinic's records. Built to help you achieve ONA Acreditado com Excelência. wai hosts each clinic's records in its own country, under that country's rules. We set this up with you before go-live.
