The Regulation on Obtaining Informed Consent in Electronic Form Published

The Regulation on Obtaining Informed Consent in Electronic Form ("Regulation"), prepared by the Ministry of Health ("Ministry"), was published in the Official Gazette dated October 27, 2026 and numbered 33413 and entered into force on the date of its publication.

The Regulation governs, where the informed consent required before a medical intervention is obtained in electronic form, the process relating thereto, the delivery of the consent form to the patient in a secure and accessible manner, and the recording of the consent.

In this article, we assess the process introduced by the Regulation and the consequences of the arrangement for personal data protection and compliance processes.

The Basis of the Arrangement and Its Scope

The Regulation is based on Article 70 of Law No. 1219 on the Practice of Medicine and Its Branches, Article 19/A of the Fundamental Law on Health Services No. 3359, and Article 358 of Presidential Decree No. 1 on the Organization of the Presidency.

The scope has been determined as first, second and third level health facilities. The arrangement draws no distinction between public and private health facilities. For this reason, it may be considered that private hospitals, medical centres and polyclinics, together with establishments providing first level health services, should also assess whether they fall within the scope.

Electronic Consent Has Not Been Made Mandatory

Article 1 of the Regulation frames electronic consent not as an obligation but as an option. The expression "where it is obtained in electronic form" contained in that article shows that the paper procedure has not been abolished. Indeed, it is separately provided that, in matters for which the Regulation contains no provision, the provisions of the Patient Rights Regulation apply.

The Regulation entered into force on the date of its publication and no transition period has been provided for. For this reason, health facilities that already use the electronic method, or that will begin to use it, must structure their process in accordance with the Regulation as from that date.

The Process Cannot Be Initiated Without Identity Verification

Article 6 of the Regulation requires that, before the medical intervention, the identity of both the patient and the healthcare professional conducting the process be verified. The same article expressly states that the electronic consent process cannot be initiated until the identity verification process has been successfully completed.

The patient's identity verification is carried out in accordance with the legislation to which the health facility is subject and with the quality standards published by the Ministry concerning the correct identification of patients. Where the medical intervention falls within the scope of reimbursement by the Social Security Institution, it is provided that the identity determination arrangements set out in Law No. 5510 and in the Health Implementation Communiqué are also to be taken into account.

As regards the healthcare professional, the processes relating to identity determination are to be carried out in accordance with the legislation to which that professional is subject, and the person concerned is required to be defined and active on the Integrated Corporate Transaction Platform. That condition aims to prevent consent from being obtained through personnel who lack authority or whose records are not up to date.

The Verified Mobile Phone Number Requirement and the Twelve-Month Period

In order for electronic consent to be obtained, the patient must have a verified mobile phone number. The verification method differs according to the channel used.

Where consent is obtained through e-Nabız, the number is required to have been verified by means of e-Nabız. If no verified number exists, the number is entered into the relevant field in e-Nabız and the verification is completed by the patient entering into the system the one-time password sent to them.

Where consent is to be obtained by means of the health facility's electronic communication device, the number must exist as verified in the facility's health information management system. If no such number exists, a one-time password is sent to the patient, the patient declares the password to the healthcare professional, and the healthcare professional transmits the password online by means of the facility's device.

It is provided that a number verified in this way is recorded in the facility's records as a verified number for a period of twelve months from the date of verification, and that re-verification will be required after the expiry of that period. It is considered that the twelve-month period in question also has the character of a retention and validity period, and that it may therefore be appropriate to show it as a separate item in the facility's retention and destruction policy and personal data processing inventory.

The Consent Process and the One-Time Password

Article 8 of the Regulation governs the process in detail. Consent is obtained either through e-Nabız or by means of the health facility's electronic communication device.

The healthcare professional conducting the process logs into the device used by the facility with a username and password or with one of the other identity verification methods determined by the Ministry. The informed consent form is approved by means of one of those devices and made available to the patient, with access being provided through the link contained in the short message sent to the patient's verified mobile phone or through e-Nabız.

Where the patient examines the form and accepts the medical intervention, a one-time password generated solely for use within the scope of the relevant medical intervention is transmitted to their verified number. As it has been expressly provided that the password is generated specifically for the intervention, it may be considered that obtaining consent for more than one intervention by means of a single password would not be compatible with the Regulation.

The declaration of the consent differs according to the channel used. Where consent is obtained through e-Nabız, the patient enters the password into the relevant tab directly. Where consent is obtained by means of the facility's electronic communication device, the patient shares the password with the healthcare professional and the password is transmitted online by that professional.

Informed consent is deemed to have been obtained upon the completion of that verification. The form relating to the consent is transferred to the Ministry's central health data system and made available to the patient through e-Nabız.

Record-Keeping, Retention Periods and Evidence

No new retention period has been introduced by the Regulation. It is provided that the records relating to consent obtained in electronic form, together with the audit trail records, are to be retained and destroyed in accordance with the retention and destruction periods applicable to consent documents obtained in paper form. The existing periods remain valid.

The audit trail records are required to be kept with their confidentiality, availability, security and integrity ensured. It is provided that those records are to be preserved, using an electronic data integrity value and the time stamp defined in the Electronic Signature Law No. 5070, in a manner suitable for judicial and administrative examination and inspection.

The Regulation also lists the records that must be kept, as a minimum, for the purposes of evidential suitability. These are the date, time and transaction information at which the patient declared their consent, the information relating to the sending and verification of the password, the information relating to the healthcare professional carrying out the transaction, and the information relating to encryption, integrity, the application of the time stamp and other security measures. All transaction records made by means of the facility's electronic communication device must be preserved by the health facility concerned.

It may be said that the centre of gravity of these arrangements lies less in the obtaining of the consent than in verifying to whom the consent belongs and in enabling the transaction to be proved subsequently. As it is provided that, where consent is obtained by means of the facility's device, the password is declared orally by the patient to the healthcare professional, keeping complete audit trail records in that channel is of even greater importance in evidential terms.

Information Security and the Relationship with the Cybersecurity Law

Article 10 of the Regulation provides that the Ministry and the health facility are to take all necessary technical and administrative measures, in accordance with the Cybersecurity Law No. 7545 and the relevant legislation and with national and international standards, in order to ensure the security of the information and documents obtained, of the transactions carried out and of the audit trail records relating thereto. That article further requires that data access rights be determined and audited within the framework of the limits of duties and responsibilities.

Given that access rights are required not only to be determined but also to be audited, it will be important for facilities to set out their authorization matrix in writing and to keep records of periodic access reviews.

Matters Standing Out in Terms of the Protection of Personal Data

The second paragraph of Article 10 of the Regulation provides for the personal data within its scope to be processed in accordance with the Personal Data Protection Law No. 6698 ("Law") and Article 19/A of Law No. 3359, and for the necessary administrative and technical measures to be taken. It is considered that the following matters stand out in the application of the arrangement.

First, it is necessary to bear in mind that the informed consent under the Regulation and the explicit consent under the Law are different institutions. The consent under the Regulation is in the nature of consent to a medical intervention and is assessed within the framework of Law No. 1219 and the Patient Rights Regulation. Article 6 of the Law, on the other hand, sets out as a separate processing condition the processing of health data for the purposes of medical diagnosis, treatment and care services by persons under an obligation of secrecy or by authorized institutions and organizations. For this reason, it may be considered that the legal ground for data processing in the course of treatment is, as a rule, not explicit consent. It would be appropriate for the consent form and the privacy notice to be kept as separate documents and for the two forms of consent not to be combined in a single text. Otherwise, an impression may arise that the withdrawal of the consent to the intervention also brings the legal ground for the data processing to an end.

A need for updating also arises as regards the obligation to inform. The move to the electronic method creates a new data processing flow comprising the short message sent to the patient, the access link, the password verification and the keeping of audit trail records. The privacy notices falling within the scope of Article 10 of the Law should be reviewed so as to reflect that flow.

As health data constitutes a special category of personal data, it is also mandatory under Article 6 of the Law to take the adequate measures determined by the Board. The measures listed in the Board's decision dated January 31, 2018 and numbered 2018/10 include the existence of a separate policy and procedure, the restriction of access rights, the storage of data in electronic environments by cryptographic methods, the regular keeping of access records, and the provision of a two-step identity verification system where remote access is required. It is apparent that the one-time password mechanism and the audit trail obligation under the Regulation overlap to a significant extent with those measures. For this reason, it may be recommended that facilities pursue their compliance with the Regulation together with their obligations under that decision through a single set of documentation.

Supplier relationships should also be assessed separately. The health information management system provider, the short message delivery service provider and the suppliers providing the infrastructure of the facility's electronic communication device may, depending on the circumstances, be in the position of a data processor. Given that under Article 12 of the Law the data controller and the data processor are jointly responsible for the obligations relating to data security, it is important that data processor provisions, audit trail and retention obligations and the use of sub-processors be expressly regulated in supplier agreements.

Finally, the electronic consent process constitutes a new processing activity. The verified mobile phone number record, the password sending and verification records, the audit trail records and the transfer to the central health data system should be entered into the personal data processing inventory and VERBIS records. Bearing in mind that the audit trail records themselves contain personal data, it would be appropriate to include those records within the retention and destruction policy.

Minor Patients and Patients Under Legal Incapacity

It is provided that the transactions to be carried out by the patient are, where the patient is a minor or under legal incapacity, to be carried out by their legal representative in accordance with the Patient Rights Regulation. The provisions laid down for the patient concerning the verification of identity and of the mobile phone number also apply to the legal representative.

The third paragraph of Article 11 of the Regulation states that, where the legal representative does not exist, is unable to be present or cannot be verified in electronic form, consent cannot be obtained electronically. As a return to the paper procedure will be required in such cases, it may be recommended that facilities determine the fallback process to be applied in writing and inform the relevant personnel accordingly.

Actions to Be Taken by Health Facilities

Following the Regulation, it is important for health facilities to review the following matters:

• Deciding whether the electronic consent method will be used and, if so, setting out the process flow in writing step by step.
• Making the identity verification step technically mandatory before the process is initiated and ensuring that the consent form cannot be sent until verification has been completed.
• Checking periodically whether healthcare professionals are defined and active on the Integrated Corporate Transaction Platform.
• Tracking in the system the twelve-month validity period applicable to verified mobile phone numbers and establishing an alert mechanism that triggers re-verification at the end of that period.
• Ensuring technically that the one-time password is generated solely for the relevant medical intervention and cannot be reused.
• Keeping the minimum content listed in the Regulation in full in the audit trail records and applying an electronic data integrity value and a time stamp to those records.
• Determining the retention and destruction period for electronic consent records in the same manner as for paper consent documents and updating the retention and destruction policy accordingly.
• Drawing up the consent form and the privacy notice as separate documents and not combining them in a single text.
• Updating the privacy notice so as to cover the electronic consent flow, the sending of short messages, the password verification and the keeping of audit trail records.
• Regulating by agreement the data processor relationship with the relevant suppliers, in particular the health information management system provider and the short message delivery service provider.
• Adding the new processing activities and the transfer to the central health data system to the personal data processing inventory and VERBIS records.
• Restricting access rights according to job descriptions, setting out the authorization matrix in writing and recording periodic access reviews.
• Setting out in writing the step for moving to the paper procedure to be applied where the legal representative does not exist or cannot be verified.

Conclusion

The Regulation provides a legal framework for the electronic consent processes already carried out in practice and ties those processes to three fundamental elements, namely identity verification, the declaration of intent by means of a password, and the audit trail.

It may be considered that two matters are capable of giving rise to debate in practice. The first is that, where consent is obtained by means of the facility's electronic communication device, the password is declared orally by the patient to the healthcare professional. That method is capable of creating tension with the principle, set out in Article 5 of the Regulation, that the consent be verified by reliable methods as belonging to the person concerned and that the non-repudiation of transactions be ensured. The second is that the record-keeping and security standards have not been determined in detail in the Regulation. Article 12 of the Regulation confers on the Ministry the power to determine additional procedures and principles in matters such as audit trail standards, time stamp and encryption methods and the provision of the password infrastructure. For this reason, facilities will need to follow secondary legislation and the Ministry's instructions.

It may be recommended that health facilities frame their fundamental control question as follows: "Do we obtain informed consent in electronic form, and if so, has identity and mobile phone verification been made technically mandatory, do our audit trail records carry the minimum content listed in the Regulation together with an integrity value and a time stamp, and have we reflected this process in our privacy notices, our inventory and our supplier agreements?"

If there is no clear answer to these questions, mapping the existing electronic consent flow against the provisions of the Regulation will be the priority step.

You can access further details on this matter in the "Regulation on Obtaining Informed Consent Electronically" published in the Official Gazette. (In Turkish)