The Regulation on Obtaining Informed Consent Electronically (the “Regulation”), issued by the Ministry of Health, was published in the Official Gazette dated October 27, 2026, and numbered 33413, and entered into force on the same date.
The Regulation establishes the procedures and principles governing the electronic collection of informed consent from patients prior to medical interventions performed in the course of providing healthcare services. In this context, it introduces various requirements covering patient identity verification, the electronic presentation of informed consent forms, the collection of consent through one-time verification codes, the retention of relevant records, and the protection of personal data.
The Regulation applies to primary, secondary, and tertiary healthcare facilities and is particularly significant for healthcare providers' digital patient admission and consent processes.
1- Obtaining Informed Consent Electronically
Under the Regulation, patients' informed consent may be obtained prior to medical interventions through the e-Nabız system or the healthcare facility's electronic communication channel. Accordingly, the informed consent form approved by the relevant healthcare professional will be made available to the patient through their e-Nabız account or a link sent via SMS to their verified mobile phone number. Once the patient has reviewed the form and agreed to the medical intervention, the consent process will be completed using a one-time SMS verification code (SMS OTP) generated specifically for the relevant intervention.
The Regulation makes the legal validity of electronically obtained informed consent subject to certain technical and procedural requirements. However, it does not make electronic informed consent mandatory for all healthcare services.
2- Mandatory Identity and Mobile Phone Number Verification
In order to obtain informed consent electronically, the identities of both the patient and the healthcare professional conducting the process must be verified. The electronic consent process cannot be initiated until the patient's identity verification has been completed. In addition, the relevant healthcare professional must be registered and active on the Ministry of Health's Integrated Institutional Transactions Platform.
The Regulation also requires patients to have a verified mobile phone number.
- For transactions conducted through e-Nabız, the mobile phone number must be verified through the e-Nabız system.
- For transactions conducted through the healthcare facility's electronic communication channel, the patient's verified mobile phone number must be registered in the healthcare facility's Health Information Management System (SBYS). If no verified number is available, verification must be completed through SMS OTP.
- A mobile phone number verified through the healthcare facility's electronic communication channel may be treated as verified for 12 months. Upon expiry of this period, the number must be verified again before electronic consent can be obtained using the same method.
3- Completion and Recording of the Electronic Consent Process
The Regulation provides for two different verification methods for obtaining electronic informed consent.
For transactions conducted through e-Nabız, patients will express their consent by entering the one-time verification code sent to their mobile phones directly into the e-Nabız system.
For transactions conducted through the healthcare facility's electronic communication channel, patients will share the verification code they receive with the relevant healthcare professional, who will then enter the code into the electronic system.
Under both methods, the patient's informed consent will be deemed to have been obtained upon completion of the electronic verification process. Electronically obtained informed consent forms will be transferred to the Ministry of Health's central health data system and made accessible to patients through e-Nabız.
4- Retention of Electronic Records and Evidentiary Requirements
The Regulation introduces detailed recordkeeping obligations to ensure the reliability of electronic consent transactions and their evidentiary value when required.
In this regard, healthcare facilities are required to retain:
- The date, time, and transaction details relating to the patient's declaration of consent;
- Records relating to the sending and verification of SMS verification codes;
- Information identifying the healthcare professional who performed the transaction; and
- Records relating to the encryption of electronic data, preservation of data integrity, application of timestamps, and other security measures.
These records must be stored using electronic data integrity values (hashes) and timestamps in a manner suitable for judicial and administrative examinations.
Furthermore, electronically obtained informed consent documents and the associated transaction records will be subject to the same retention and destruction periods applicable to documents obtained in physical form.
5- Personal Data Protection and Information Security
The Regulation also introduces obligations concerning the protection of personal data and information security in electronic informed consent processes. Accordingly, the Ministry of Health and healthcare facilities are required to implement the necessary technical and administrative measures under Law No. 6698 on the Protection of Personal Data (the “PDPL”), Cybersecurity Law No. 7545, and other applicable legislation to ensure the security of information, documents, and transaction records obtained electronically.
In particular, data access permissions must be restricted according to the relevant duties and responsibilities, access activities must be monitored, and the confidentiality and integrity of records must be maintained. It is important to emphasize that informed consent for a medical intervention and explicit consent for the processing of personal data under the PDPL are legally distinct concepts. Electronic informed consent obtained under the Regulation does not, in itself, constitute a legal basis for all forms of personal data processing or transfer. Healthcare facilities should therefore ensure that their electronic consent procedures comply with the applicable legal bases for processing personal data, privacy notice requirements, and data security practices.
6- Rules Applicable to Minors and Persons Under Legal Guardianship
Under the Regulation, electronic consent procedures for minors and patients subject to legal restrictions on their capacity must be carried out by their legal representatives in accordance with the provisions of the Patient Rights Regulation. In such cases, the identity and mobile phone verification requirements applicable to patients must also be fulfilled in respect of their legal representatives. Where a legal representative does not exist, is unavailable, or cannot be verified electronically, informed consent cannot be obtained through electronic means.
7- Implications for Healthcare Providers
The Regulation represents a significant step towards the digitalization of healthcare services by establishing the legal and technical framework for transitioning patient consent processes to electronic platforms.
Nevertheless, completion of the electronic verification process does not relieve healthcare professionals of their obligation to provide patients with sufficient, comprehensible, and timely information regarding the proposed medical intervention. For informed consent to be legally valid, patients must still be adequately informed about the medical intervention and must make their decisions of their own free will.
In this context, healthcare providers planning to implement electronic informed consent procedures should:
- Review their existing patient admission and informed consent procedures to ensure compliance with the Regulation;
- Assess whether their Health Information Management System (SBYS) infrastructure meets the requirements for identity verification, SMS OTP, and integration with the central health data system;
- Implement appropriate technical measures to ensure the integrity, security, and evidentiary reliability of electronic transaction records;
- Review their personal data processing activities and relevant privacy notices in light of electronic consent procedures; and
- Update their internal procedures and training processes for healthcare professionals.
The Ministry of Health is also authorized to establish additional procedures and principles concerning audit log standards, timestamping and encryption methods, SMS OTP infrastructure, and other implementation-related matters. Healthcare providers should therefore monitor any further technical regulations and instructions that may be issued by the Ministry of Health.
In conclusion, the Regulation establishes a legal and technical framework for obtaining informed consent electronically and introduces new standards for healthcare providers concerning patient rights, personal data protection, information security, and the evidentiary reliability of electronic records.
The full text of the Regulation is available here.