The Regulation on Obtaining Informed Consent Electronically (“Regulation”), prepared by the Ministry of Health, was published in the Official Gazette and entered into force on 27 October 2026. The Regulation sets out the procedures and principles governing the obtaining of patients’ informed consent electronically, prior to medical interventions carried out in the provision of healthcare services.
Informed Consent
Under the Regulation, informed consent is defined as the patient’s acceptance of a medical intervention of their own free will and on an informed basis. The primary purpose of obtaining informed consent electronically is to ensure that patients can make decisions regarding medical interventions freely and on the basis of sufficient information. Accordingly, it is essential that patients are provided with sufficient and understandable information in a timely manner, that patient rights are protected, and that the consent is reliably verified as belonging to the relevant patient. The electronic consent process must be conducted in a secure, accessible and traceable manner and in a way that allows it to be audited where necessary. The confidentiality, integrity, accuracy and accessibility of consent records must also be ensured.
Verification of Identity and Mobile Phone Number
Pursuant to the Regulation, before informed consent can be obtained electronically, the identities of both the patient and the healthcare professional conducting the process must be verified prior to the medical intervention. The Regulation provides that the process of obtaining consent electronically cannot begin before the patient’s identity has been verified. The procedures relating to identity verification shall be carried out in accordance with the relevant legislative provisions.
A verified mobile phone number belonging to the patient is required for informed consent to be obtained electronically. The mobile phone number may be verified in one of two ways: through e-Nabız (Türkiye’s national online health record system, enabling individuals to access and manage their personal health information through a secure digital platform.) or through the healthcare facility’s own electronic communication tool.
- For informed consent to be obtained through e-Nabız, the patient’s mobile phone number must have been verified through e-Nabız. If there is no verified number registered in e-Nabız, the mobile phone number must be entered in the relevant field in e-Nabız and verified by entering online into the system the one-time password (the “SMS OTP”) sent to that number.
- Where the healthcare facility’s own electronic communication tool is used, the healthcare facility must have a verified mobile phone number belonging to the patient in its Health Information Management System (“HIMS”). If the patient’s mobile phone number has not been verified in the healthcare facility’s HIMS, an SMS OTP is sent to the patient’s number, and the patient communicates this password to the relevant healthcare professional. A number verified in this manner may be used for 12 months from the date of verification. Once this period expires, the number must be verified again.
Obtaining Informed Consent Electronically
In line with the Regulation, once the patient’s identity and mobile phone number have been verified, the patient’s informed consent may be obtained through e-Nabız or the healthcare facility’s electronic communication tool. In this context, the informed consent form is approved by the relevant healthcare professional and made available to the patient either through a link sent by SMS to the patient’s verified mobile phone number or through e-Nabız. If the patient accepts the medical intervention, an SMS OTP valid solely for the informed consent process relating to that particular intervention is sent to the patient’s verified mobile phone number.
The patient may communicate their consent electronically in one of two ways, depending on the system used:
- Where informed consent is obtained through e-Nabız, the patient enters the SMS OTP sent to their verified mobile phone number through e-Nabız into the relevant section of e-Nabız themselves and submits it online.
- Where informed consent is obtained through the healthcare facility’s electronic communication tool, the patient shares the SMS OTP sent to their verified mobile phone number with the relevant healthcare professional, who then submits the password online through the electronic communication tool.
Following this procedure, the informed consent forms for which consent has been given are transferred to the Ministry of Health’s central health data system and made available to the patient through e-Nabız.
Record-Keeping and Data Security
The Regulation emphasizes that audit logs relating to informed consent obtained electronically and the relevant transactions must be retained in accordance with the retention and destruction periods applicable to consent forms obtained in physical form. In this context, the confidentiality, accessibility, security and integrity of the records must be ensured. Furthermore, records must be maintained in a manner suitable for judicial and administrative reviews and audits, using electronic data integrity values and timestamps.
In addition, the Regulation provides that the following information must be retained for the purpose of proving that consent was given: (i) the date, time and transaction details relating to the patient’s expression of consent; (ii) information concerning the sending and verification of the SMS OTP; (iii) information relating to the healthcare professional who carried out the transaction; and (iv) records concerning encryption, data integrity, timestamps and other security measures.
Accordingly, healthcare facilities are required to take the necessary technical and administrative measures to ensure the security of the information, documents and transaction records covered by the Regulation. With regard to the processing and protection of personal data, compliance with the Personal Data Protection Law No. 6698 and the relevant legislation is also underlined.
Application to Minors and Persons Under Legal Restriction
Where the patient is a minor or a person under legal restriction, the electronic procedures required to be carried out must be performed by the patient’s legal representative in accordance with the Regulation on Patient Rights. Accordingly, the provisions concerning identity and mobile phone number verification shall also apply to the legal representative. In cases where the legal representative is absent, not present or cannot be verified electronically, informed consent cannot be obtained electronically.
Authors: Begüm Şahinkaya, Rana Deliktaş