Relevance. Federal legislation obliges all persons involved in the processing of information about the private life of citizens to comply with the established procedure for collecting, storing, using and distributing such information. Revocation of the patient's consent to the processing of personal data is not always legitimate and usually leads to conflicts between patients and medical professionals. The purpose of the study is to analyze the main regulatory legal acts regulating the collection, storage, use and dissemination of personal data about a patient in the healthcare system and in medical organizations. Research methods. A systematic review of the legislation of the Russian Federation, regulations, and current regulatory legal acts at the federal and regional levels regulating legal relations in the field of health protection has been carried out. Results. The current Constitution of the Russian Federation, in accordance with Article 24 of the Constitution of the Russian Federation, has determined that it is prohibited to collect, store, use and disseminate information about his private life without the consent of a citizen. According to part 1 of Article 92 of Federal Law No. 323-FZ of November 21, 2011 "On the basics of public health protection in the Russian Federation", the right to keep records of personal data of persons who receive medical care, as well as persons in respect of whom medical examinations, medical examinations and medical examinations are carried out is secured. Article 94 provides for a list of personal data about persons who receive medical care, as well as about persons in respect of whom medical examinations, medical examinations and medical examinations are carried out. Part 1 of Article 19 of the Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" is devoted to security issues, according to which the operator is obliged to take the necessary security measures to work with personal data when processing personal data. Meanwhile, despite the legislative guarantees of information protection, patients send requests to medical organizations demanding the completion of the processing of personal data and their removal from the information systems of the institution. The authors refer to the decisions of the courts of various instances, on which decisions were made on the withdrawal of personal data of patients, express the opinion about the insufficiency of legal regulation in the healthcare system on this issue. Conclusions. Analyzing the above provisions, the authors consider it expedient to develop a regulatory legal act that will determine the procedure, functions, specific actions of a medical worker, patient, legal representative, as well as the consequences of the presence or absence of consent to the processing of personal data.