The Regulation on Obtaining Informed Consent in Electronic Form was published in the Official Gazette of 27 October 2026 (No. 33413) and entered into force the same day. Informed consent for a medical intervention can now be obtained through e-Nabız, the Ministry of Health’s personal health record system, or through the health facility’s own system, using a one-time password (SMS OTP) sent to the patient’s verified mobile number. The regulation does not abolish paper consent; it sets the process, identity checks and audit trail for facilities that choose the electronic route. This note covers the statutory amendment behind the regulation, the step-by-step process, the evidentiary and data protection dimensions, the gaps in the text and what hospitals and health-tech companies should do now.
Where the regulation comes from: Article 70 of Law No. 1219 and Law No. 7557
The statutory basis for consent to medical treatment in Türkiye is Article 70 of Law No. 1219 of 1928 on the Practice of Medicine. It requires physicians and dentists to obtain the prior consent of the patient, or of the parent or guardian where the patient is a minor or under guardianship, for every intervention, and requires that consent to major surgery be in writing. Article 3 of Law No. 7557, published in the Official Gazette of 24 July 2025, added two sentences: consent under this paragraph may also be obtained electronically, through an information or electronic communication device, using identity documents capable of verifying the person’s identity, biometric methods or electronic identity verification methods. The same amendment tasked the Ministry of Health with setting the procedures after obtaining the favourable opinion of the Information and Communication Technologies Authority. Today’s regulation is that procedure, fifteen months after the statute opened the door.
The second basis is Additional Article 19 of the Basic Law on Health Services No. 3359, inserted by Law No. 7538 in January 2025. It provides the statutory footing for processing the personal data of people receiving health services, for the Ministry’s central health data system and for the system that gives individuals access to their own data (e-Nabız). The regulation’s use of e-Nabız as a consent channel rests on this article.
Who is covered and what does not change
The regulation applies to all primary, secondary and tertiary health facilities and draws no distinction between public and private providers; private hospitals, medical centres and polyclinics are within scope. Three points should be clear from the outset:
- The electronic route is an option, not an obligation. The purpose clause applies “where informed consent is obtained electronically”. A consent form signed on paper remains valid under Articles 24 and 26 of the Patient Rights Regulation, which also fills any gap in the new text (Article 13).
- The duty to inform is unchanged. Article 5 keeps the principle that the patient must receive adequate, understandable and timely information so as to decide freely. A form delivered by SMS does not replace the information conversation; it records its outcome.
- The subject is consent to medical intervention. Consent to clinical research remains governed by its own rules, and explicit consent under the Personal Data Protection Law (KVKK) is a different concept altogether (see below).
The process step by step
The regulation defines two channels: e-Nabız, which the patient operates alone, and the “health facility’s electronic communication tool”, operated by the health professional, which must be registered in the institution’s inventory and connected to the facility’s health information management system (SBYS). That definition matters: a staff member’s personal phone or messaging app is not such a tool.
| Step | e-Nabız channel | Facility channel |
|---|---|---|
| 1. Identity verification (Art. 6) | The patient's identity is verified under the rules applicable to the facility and the Ministry's patient identification quality standards; where the Social Security Institution reimburses the intervention, its implementing communiqué applies too. The health professional must be defined and active on the Ministry's Integrated Institutional Processing Platform. | Same |
| 2. Verified mobile number (Art. 7) | The number must be verified in e-Nabız; if not, the patient enters it and confirms with an SMS OTP. | If the SBYS holds no verified number, an SMS OTP is sent to the patient, who reads it to the professional, who enters it. The number counts as verified for 12 months; after that it must be verified again. |
| 3. Making the form available (Art. 8/2-4) | The professional logs in with a username and password or another Ministry-approved method and approves the form, which appears in the patient's e-Nabız. | The form opens through a link in an SMS sent to the verified number. |
| 4. Review and acceptance (Art. 8/5-6) | The patient reviews the form. On acceptance, an SMS OTP generated only for that intervention is sent to the verified number. | Same |
| 5. Declaration of consent (Art. 8/7) | The patient enters the OTP in e-Nabız personally. | The patient shares the OTP with the professional, who enters it through the facility's tool. |
| 6. Result (Art. 8/8-9) | Consent is deemed given once verification is complete. The form is transferred to the Ministry's central health data system and made available to the patient in e-Nabız. | Same |
For minors and persons under guardianship, the legal representative acts in accordance with the Patient Rights Regulation, and the identity and phone verification rules apply to the representative. Where no representative exists, is present or can be verified electronically, consent cannot be obtained electronically (Article 11).
Audit logs: the consent record becomes an information security control
Article 9 carries the weight of the regulation. Electronic consent records and their audit logs must be retained and destroyed under the same periods that apply to paper consent documents. Audit logs must be kept with confidentiality, availability, security and integrity assured, using an electronic data integrity value (a hash) and a time stamp, in a form fit for judicial and administrative review. The minimum evidence set is listed: the date, time and transaction details of the patient’s declaration; the sending and verification of the SMS OTP; the details of the professional who performed the transaction; and the encryption, integrity, time-stamping and other security measures applied. The facility is responsible for retaining every record generated through its own tool.
One detail carries a cost. The regulation ties “time stamp” to the definition in the Electronic Signature Law No. 5070, where a time stamp is a record verified by electronic signature by an electronic certificate service provider. A server-clock timestamp does not meet that definition; the SBYS will need qualified time stamps from an authorised provider.
Article 10 obliges the Ministry and the facility to take the technical and administrative measures required by the Cybersecurity Law No. 7545 and applicable standards, and to define and audit access rights by role. Standards for audit logs, time-stamping and encryption methods and the provision of the SMS OTP infrastructure are left to further Ministry instructions (Article 12). In other words, the technical specification has not been written yet; SBYS vendors will be waiting for it.
What changes in terms of evidence
Under settled Court of Cassation practice, the burden of proving that the patient was informed and consented lies with the physician and the health institution. Until now that burden was discharged with a two-copy consent form signed by patient and physician. In the electronic channel, OTP verification and the audit log take the place of the signature. An SMS OTP is not a secure electronic signature within the meaning of Law No. 5070, but consent to medical treatment is not a contract; it is a declaration that renders the intervention lawful, and Law No. 7557 now states expressly that the written-form requirement for major surgery can be met electronically. Before a court, the audit log will be weighed as a document under the Code of Civil Procedure, and the minimum evidence list in Article 9 reads as preparation for exactly that assessment.
The weak point is the facility channel. When the patient reads the OTP to the physician and the physician enters it, the record blurs the line between the patient’s declaration and the professional’s act; non-repudiation is far stronger in the e-Nabız channel. A sensible institutional policy is to prefer e-Nabız for high-risk interventions and keep the paper form for patients who cannot use it. The second weak point is timing: a link sent minutes before surgery leaves a visible trace that the “timely information” principle in Article 5 was not met. Because the electronic channel also records when the information conversation took place, it both protects and exposes the physician.
Anyone who works in financial regulation will recognise the pattern: identity verification, strong customer authentication by OTP, non-repudiation and an auditable log. The Central Bank's remote identification rules for payment institutions and the banking rules on remote contracting built the same architecture years ago. The difference in healthcare is that the counterparty is not a customer but, often, a patient under stress.
The KVKK side: informed consent is not explicit consent
The consent form and the audit logs contain health data, which is special category personal data under Article 6 of the KVKK. The legal basis for processing it is not the patient’s explicit consent under the KVKK but the exception for health services delivered by persons bound by professional secrecy, together with Additional Article 19 of Law No. 3359; Article 10(2) of the regulation says as much. The practical consequence: adding a KVKK explicit-consent checkbox to the medical consent form conflates two different consents and, if the patient later withdraws the KVKK consent, puts the legal basis of the treatment record in question. The KVKK privacy notice should be given separately and the consent form should stay confined to the medical intervention.
Other data protection points: storing the verified mobile number for 12 months is a purpose-limited processing activity that belongs in the data inventory; the SMS should contain only the link, never the diagnosis or the name of the procedure; and the regulation is silent on how the SMS link is protected against being opened by someone other than the patient, a gap the Ministry’s Article 12 standards should close. The Data Protection Board’s decisions on authentication and access security indicate the expected standard. The 2019 Regulation on Personal Health Data continues to apply.
Gaps and open questions
- Emergencies and capacity. The regulation has no provision for emergencies or unconscious patients. The exception in Article 24 of the Patient Rights Regulation and the “unable to express consent” rule in Article 70 of Law No. 1219 apply; the electronic channel requires the patient’s active participation and is in any case unavailable in those situations.
- Technical standards. The hash algorithm, the time-stamp provider, encryption and the “provision” of the OTP infrastructure are left to Ministry instructions. For SBYS vendors the real compliance timeline starts with those instructions.
- Foreign patients. For medical tourism facilities the e-Nabız channel is usually unavailable; sending an SMS OTP to a foreign number and verifying identity by passport through the facility channel appears possible, but the regulation does not address it expressly.
- Retention. No separate period is set; the text refers to the archive periods applicable to paper documents. Destruction of electronic records should follow the same calendar.
- Sanctions. The administrative fine in Article 70 of Law No. 1219 is nominal. The real sanctions are civil liability and Ministry inspection; without the audit log, the electronic consent loses its evidentiary value.
What to do now
Hospitals and clinics: adopt a written procedure deciding which intervention groups move to the electronic channel and which keep the paper form; check that health professionals are registered on the Integrated Institutional Processing Platform; build phone verification and the 12-month renewal into patient admission; align retention and destruction of audit logs with the archive rules; update the KVKK data inventory, privacy notice and VERBİS registration for the new processing activity.
SBYS vendors and health-tech companies: design the consent module around the minimum evidence list in Article 9; put qualified time-stamp and OTP provider contracts, the access rights matrix and integrity verification on the product roadmap; bring the new module into the registration and audit processes under the SBYS Regulation; and write into hospital contracts who holds the audit logs, audit rights and the allocation of liability. For health AI products the medical device classification question remains separate.
Physicians: the information conversation and its timing are unchanged; never enter the OTP on the patient’s behalf, and record when and where the patient read out the code; fall back to the paper form when verification fails. Our data protection and cybersecurity team advises on process design and contracts.
Frequently asked questions
Is paper consent being abolished?
No. The regulation sets the procedure where consent is obtained electronically. A signed paper form remains valid under the Patient Rights Regulation.
Does SMS consent satisfy the written-form requirement for major surgery?
Yes. The sentence added to Article 70 of Law No. 1219 by Law No. 7557 states that consent under that paragraph may also be obtained electronically, and the regulation sets the procedure. For high-risk interventions the e-Nabız channel, with its stronger non-repudiation, should be preferred.
Are private hospitals and polyclinics covered?
Yes. The regulation covers all primary, secondary and tertiary health facilities and makes no distinction between public and private providers.
Is it safe for the patient to read the OTP to the physician?
The regulation allows it, but because the physician is the person entering the code, non-repudiation is weaker than in the e-Nabız channel. Facilities can limit this channel to low-risk interventions or add safeguards such as witnessed entry.
How does the process work for children?
The legal representative acts, and the identity and phone verification rules apply to the representative. Where no representative exists, is present or can be verified electronically, consent cannot be obtained electronically and the paper procedure applies.
Sources. Regulation on Obtaining Informed Consent in Electronic Form, Official Gazette 27.10.2026, No. 33413 (in Turkish); Law No. 1219, Article 70 as amended by Article 3 of Law No. 7557; Law No. 7557, Official Gazette 24.7.2025, No. 32965; Law No. 7538, Article 2 (Additional Article 19 of Law No. 3359), Official Gazette 15.1.2025; Patient Rights Regulation (Official Gazette 1.8.1998, No. 23420); Electronic Signature Law No. 5070, Article 3; Cybersecurity Law No. 7545 (Official Gazette 19.3.2025, No. 32846); Regulation on Health Information Management Systems (Official Gazette 25.8.2022, No. 31934); Regulation on Personal Health Data (Official Gazette 21.6.2019, No. 30808).
Author
More from Vircon Insights
Türkiye Raises the Qualified Investor Threshold to TRY 50 Million and Ends the Carve-Out for VC and Real Estate Funds
October 26, 2026Bartz v. Anthropic: What the USD 1.5 Billion AI Copyright Settlement Decided, What It Did Not, and the Lessons Under Turkish Law
October 28, 2026Instant and A2A Payments in Türkiye: FAST, TR Karekod and the EU Instant Payments Regulation for Merchants and Fintechs
October 27, 2026Advertising a Game in Türkiye: The Commercial Advertising Regulation, the Influencer Guide, Children and the Word "Free"
October 25, 2026Türkiye's Age Verification Regulation for Social Networks: the e-Devlet Token, Rules for 15 to 17 Year Olds and the Deadlines
October 16, 2026Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →