Information Note on the Regulation on Obtaining Informed Consent Electronically

On 27 October 2026 the Regulation on Obtaining Informed Consent Electronically (the Regulation), prepared by the Ministry of Health, was published in Official Gazette No. 33413 and entered into force.

The Regulation establishes the procedures and principles governing the electronic collection of patients’ informed consent prior to medical interventions performed in the provision of healthcare services, the secure and accessible delivery of relevant forms to patients, the recording of consent transactions and the protection of personal data.

The key provisions of the Regulation are summarised below.

Scope of the Regulation and General Principles

The Regulation covers primary, secondary and tertiary healthcare facilities. Pursuant to Article 5 of the Regulation, when informed consent is obtained electronically, patients must be provided with adequate, comprehensible and timely information to enable them to make decisions regarding medical interventions of their own free will. Patient rights must be protected, and reliable methods must be used to verify that consent has been given by the relevant individual. Furthermore, electronic consent processes must be secure, accessible, traceable and auditable, and the integrity, confidentiality, accuracy and accessibility of records must be ensured.

Verification of Identity and Mobile Telephone Number

Pursuant to Article 6 of the Regulation, the identities of the patient and the relevant healthcare professional conducting the consent process must first be verified before informed consent can be obtained electronically. The electronic consent process cannot be initiated until the patient’s identity verification has been completed. In addition, the relevant healthcare professional must be registered and active on the Ministry of Health’s Integrated Corporate Operation Platform.

Under Article 7 of the Regulation, having a verified mobile telephone number of the patient is mandatory for obtaining informed consent electronically. Accordingly, where consent is obtained via e-Nabız, the mobile telephone number must be verified through the e-Nabız system. Where consent is obtained through the healthcare facility’s electronic communication tool, a verified mobile telephone number must be available in the healthcare facility’s Health Information Management System (SBYS). A mobile telephone number verified through the healthcare facility’s electronic communication tool will remain valid for 12 months from the date of verification and must be re-verified at the end of this period.

Obtaining Informed Consent Electronically

Pursuant to Article 8 of the Regulation, patients’ informed consent may be obtained via e-Nabız or through the healthcare facility’s electronic communication tool. In this context, the informed consent form approved by the relevant healthcare professional will be made available to the patient via a link contained in a text message sent to the patient’s verified mobile telephone number or through e-Nabız. If the patient agrees to the medical intervention after reviewing the form, a one-time verification code (SMS OTP), valid exclusively for the relevant medical intervention, will be sent to the verified mobile telephone number.

Where the electronic consent process is conducted via e-Nabız, it will be completed when the patient enters the verification code into the system. Where it is conducted through the healthcare facility’s electronic communication tool, it will be completed when the patient shares the verification code with the relevant healthcare professional and the healthcare professional submits it to the system. The patient’s informed consent will be deemed obtained upon the execution of the specified verification procedure. The form documenting the consent obtained electronically will be transferred to the Ministry of Health’s central health data system and made accessible to the patient via e-Nabız.

Record-Keeping and Data Security

Article 9 of the Regulation establishes obligations concerning the retention of informed consent records obtained electronically and relevant transaction logs. Electronic consent records must be retained and destroyed in accordance with the retention and destruction periods applicable to informed consent documents obtained in physical form.

Records relating to transactions conducted electronically must be retained in a manner suitable for judicial and administrative examinations by utilising electronic data integrity values and timestamps. Accordingly, it is envisaged that, at a minimum, records concerning the date and time of the patient’s consent statement, transaction details, SMS OTP transmission and verification logs, details of the relevant healthcare professional and the security measures implemented must be maintained.

Protection of Personal Data

Pursuant to Article 10 of the Regulation, the Ministry of Health and healthcare facilities are obliged to take the necessary technical and administrative measures to ensure the security of information, documents and transaction logs obtained during electronic informed consent processes. In this context, data access authorisations must be defined and audited within the scope of the relevant duties and responsibilities. Furthermore, personal data within the scope of the Regulation must be processed in accordance with the Law on the Protection of Personal Data No. 6698, Supplementary Article 19 of the Basic Law on Healthcare Services No. 3359 and the relevant legislation. With regard to data security measures, the Regulation also refers to the Cybersecurity Law No. 7545 and related legislation, as well as national and international standards.

Procedures Applicable to Minors and Restricted Persons

Pursuant to Article 11 of the Regulation, where the patient is a minor or a restricted person, electronic informed consent procedures will be carried out by their legal representative in accordance with the Patient Rights Regulation. In such cases, the identity and mobile telephone number verification requirements applicable to the patient will also apply to the legal representative. Where a legal representative is absent, unavailable or cannot be verified electronically, informed consent cannot be obtained electronically.

Entry into Force and Evaluation

The Regulation entered into force on 27 October 2026. It establishes a legal and technical framework for obtaining informed consent electronically in healthcare facilities, setting out obligations relating in particular to identity verification, the use of SMS OTP, the evidentiary value of electronic records and the protection of personal health data. Accordingly, it is of vital importance that healthcare facilities within the scope of the Regulation review their electronic informed consent practices, existing information management systems, identity verification methods, record retention procedures and personal data security measures in light of the new Regulation.

Should you require further information on this matter, please feel free to contact us at any time via the contact numbers below.

Contact Information