Regulation on the Obtaining of Informed Consent in Electronic Environment Has Been Published.
The Regulation on the Obtaining of Informed Consent in Electronic Environment (the “Regulation”), prepared by the Ministry of Health, was published in the Official Gazette dated October 27, 2026, and numbered 33413, entering into force on the same date. The Regulation is of significant importance regarding the procedures and principles governing the obtaining of the patient's informed consent in an electronic environment prior to medical interventions to be performed during the provision of healthcare services, the secure delivery of the consent form to the patient, and the recording of this process.
The Regulation aims to ensure that the patient is informed in a timely and comprehensible manner so as to enable them to make decisions of their own free will, and to verify the consent through a non-repudiable infrastructure. In this regard, the process of obtaining consent electronically has not been designed as an informal approval mechanism; rather, it has been anchored to technical and legal safeguards such as identity verification, verified mobile phone numbers, SMS OTP, and cryptographic audit log records.
The Regulation sets forth the fundamental rules that healthcare facilities and healthcare professionals must comply with during the electronic consent process, with the key highlights outlined below:
The Scope of the Regulation Is Not Limited to Specific Healthcare Institutions.
The Regulation covers all primary, secondary, and tertiary healthcare facilities, without distinction between public, university, or private sectors. In this framework, all healthcare institutions and organizations that perform medical interventions within their structure and wish to conduct the informed consent process via digital infrastructures are obliged to comply with the provisions of the Regulation.
The Electronic Consent Process Cannot Be Initiated Prior to the Completion of Identity Verification.
Pursuant to the Regulation, in order to initiate the electronic consent process, the identities of both the patient admitted to the healthcare facility and the healthcare professional carrying out the procedure must be verified prior to the medical intervention. The accurate identification process of patients shall be conducted in accordance with the relevant healthcare legislation and quality standards; the electronic consent stage cannot be accessed unless the identity verification is successfully completed. Furthermore, the personnel conducting the process must be defined and active on the Integrated Corporate Transaction Platform of the Ministry of Health.
A Verified Mobile Phone Number Is Mandatory for Obtaining Consent.
For the electronic consent to be valid, the patient must have a verified mobile phone number. Phone number verification may be performed via e-Nabız, or via SMS OTP through the Healthcare Information Management System (SBYS) of the healthcare facility. The validity period of phone number verification conducted via SBYS is limited to 12 months; upon expiration of this period, the number must be re-verified in order to obtain electronic consent. This duration pertains solely to the verification of the telephone number and must not be construed as the validity period of the patient's consent to the medical intervention.
Declaration of Consent Is Restricted to e-Nabız or Corporate Electronic Communication Devices.
Under the Regulation, after being approved by the healthcare personnel, the consent form is transmitted to the patient via e-Nabız or through a URL link delivered via SMS. Following the patient’s review, the declaration of consent is recorded through one of two methods: The patient may grant approval by directly entering the one-time password (SMS OTP) transmitted to them into the e-Nabız interface, or by stating the SMS OTP code to the healthcare professional to ensure its entry into the system via an electronic communication device registered in the healthcare facility’s corporate inventory. Informed consent shall be legally deemed obtained upon the successful entry of this verification code into the system. Therefore, merely transmitting the link to the form or viewing the form does not, on its own, complete the consent process. The form pertaining to the consent obtained electronically is transferred to the Ministry's central health data system and made accessible to the patient via e-Nabız.
Legal Representative Requirement and Prohibition of Electronic Process Regarding Minors and Restricted Persons.
If the patient is a minor or a restricted person (under guardianship), the procedures shall be carried out by their legal representative in accordance with the Regulation on Patient Rights. The provisions regarding identity and mobile phone verification shall also apply to the legal representative. In cases where the legal representative is absent, unavailable, or cannot be verified in the electronic environment, consent cannot be obtained electronically.
Records Must Be Preserved in a Manner Suitable for Evidentiary and Audit Purposes.
To ensure that the consent records obtained electronically constitute conclusive evidence in judicial and administrative investigations, the integrity and security of the records have been safeguarded. Accordingly, the date and time of approval, SMS OTP transmission and verification logs, and the credentials of the personnel performing the transaction shall be stored by applying an electronic data integrity value (hash) and a time stamp. These records must be retained in accordance with the retention and destruction periods applicable to physical documents. The relevant healthcare facility is responsible for retaining all transaction logs conducted via its electronic communication devices in compliance with these obligations.
Obligation to Comply with Personal Data Protection and Cybersecurity Legislation.
Full compliance with the provisions of the Law on the Protection of Personal Data No. 6698 (KVKK) and the Cybersecurity Law No. 7545 will be required in the processing of information, documents, and audit logs collected under the Regulation. Healthcare facilities and the Ministry are obliged to take all necessary technical and organizational measure particularly for the protection of special categories of personal data (sensitive health data and to strictly limit employees’ data access authorizations to their job descriptions.
Conclusion
The Regulation comprehensively governs the processes of informing, identity and telephone verification, transaction-specific consent declaration, and secure logging. Thus, while the consent processes previously executed on paper in healthcare services are digitalized, non-repudiation, data integrity, and patient rights are established as foundational principles.
It is essential for healthcare facilities to harmonize their systems with the Ministry’s central infrastructure and SBYS criteria, complete SMS OTP and time-stamp integrations, restrict access authorizations, and provide the necessary administrative and technical training to their personnel regarding these procedures. The verification of the telephone number and the granting of consent to a specific intervention must be conducted as distinct stages, ensuring the patient is afforded the opportunity to review and decide.
The Ministry is authorized to determine additional procedures and principles regarding implementation, including the standards, security, and retention of audit logs, time-stamping and encryption methods, and the SMS OTP infrastructure. Consequently, subsequent regulations and instructions issued by the Ministry must also be closely monitored during compliance efforts.
AUTHORS
Nuri Melih İnce
Sena Nur Temur
