The Era of Electronic Informed Consent in Healthcare: How Will Consent Be Obtained via e-Nabız and SMS?

What did the Regulation change, and what did it leave unchanged?

The Regulation on Obtaining Informed Consent in the Electronic Environment (Bilgilendirilmiş Rızanın Elektronik Ortamda Alınması Hakkında Yönetmelik), published in Official Gazette (Resmî Gazete) No. 33413 of October 27, 2026, sets out the procedures and record-keeping rules to be followed in primary, secondary and tertiary healthcare facilities when the electronic consent method is chosen. The Regulation entered into force on the day of its publication; no separate transition period was provided in the text. [1] [2]

This new method does not make it mandatory to obtain all medical consents electronically. Nor is the electronic form a formality that replaces the duty to inform. The patient must be given information, in a form they can understand, about the nature of the intervention, its significant risks, the alternatives and the consequences of refusal. Technology changes the way this process is recorded; it does not remove its medical and legal character.

How will electronic consent be obtained?

If the electronic method is used, the Regulation provides for a verifiable and auditable sequence of steps.

1. The identity of the patient and of the healthcare professional is verified

The patient’s identity is verified within the framework of the rules to which the healthcare facility is subject. The healthcare professional conducting the consent process must also be authorized and must be registered and active on the Ministry of Health’s Integrated Institutional Transaction Platform (Entegre Kurumsal İşlem Platformu). The electronic consent process cannot be started without verification of the patient’s identity (Art. 6).

2. The patient’s mobile phone number is verified

If consent is to be obtained through e-Nabız (the Ministry of Health’s personal health record system), the phone number must have been verified in e-Nabız. If a device connected to the healthcare facility’s Health Information Management System (Sağlık Bilgi Yönetim Sistemi, SBYS) is to be used, a verified number must be on file at the facility; otherwise, verification must be carried out through a one-time code sent by SMS. A number verified in this way by the healthcare facility is recorded at the facility as a verified number for 12 months (Art. 7). This period does not mean that the patient has consented to all interventions for 12 months.

3. The intervention-specific form is presented to the patient

The relevant healthcare professional approves the form in the electronic environment and makes it available to the patient. The patient can review the form through e-Nabız or via the SMS link sent to their verified phone (Art. 8).

4. The patient’s acceptance is verified with an intervention-specific SMS OTP

If the patient accepts the intervention, an SMS one-time password (OTP) specific to that procedure is sent. On the e-Nabız route, the patient enters the code into the system themselves. When the healthcare facility’s electronic communication tool is used, the patient communicates the code to the relevant healthcare professional, and the code is transmitted through the system. Within the scope of the Regulation, consent is deemed to have been obtained through this verification step (Art. 8). Merely sending or opening the form link should not, on its own, be regarded as consent.

5. The form is recorded and made accessible on e-Nabız

The electronic consent form is transferred to the Ministry’s central health data system; the patient can access their form through e-Nabız (Art. 8).

Proof and record security: What information will be retained?

Article 9 of the Regulation requires the retention not only of the consent form but also of the audit trail records that make the transaction auditable. At a minimum, the date, time and transaction details of the declaration of intent, the sending and verification of the OTP, information about the healthcare professional who carried out the transaction, and the encryption, data integrity and timestamp measures must be kept on record.

The electronic data integrity value (hash) helps in checking whether a record has been altered afterwards, and the timestamp helps in verifying the time of the relevant electronic record. The electronic form and audit trail records are subject to the retention and destruction periods applicable to physical consent documents. This provision does not, on its own, introduce a new retention period common to all records.

Informing the patient and the electronic form of consent are different things

The fact that a patient opens a link and enters an SMS code does not in every case prove that they were adequately informed about the significant risks and options of the medical intervention. In a dispute, what information was conveyed, by whom, when and with what content is also of importance.

For this reason, healthcare institutions should keep their standard forms appropriate to the nature of the intervention; healthcare professionals, for their part, should give an explanation the patient can understand, answer their questions and make sure that consent is given of free will. An electronic record does not remove the need to assess the content of the information provided.

Who will carry out the process for minors and patients under guardianship?

Under Article 11 of the Regulation, for a minor patient or a patient under guardianship (kısıtlı), the procedures relating to electronic consent are carried out by the legal representative within the framework of the Patient Rights Regulation (Hasta Hakları Yönetmeliği). Identity and mobile phone verification also apply to the representative. If there is no legal representative, or the representative is unavailable or cannot be verified in the electronic environment, consent cannot be obtained by this method. This provision does not remove other special legal rules concerning medical intervention.

Health data and KVKK: Two separate consent issues

Informed consent to a medical intervention and explicit consent under the Personal Data Protection Law (KVKK) for the processing of personal data are not the same transaction. Medical consent concerns the patient’s acceptance of the intervention; the processing of health data is assessed separately under the appropriate legal grounds, notice and security obligations in the KVKK.

Article 10 of the Regulation provides for technical and administrative security measures in line with the Personal Data Protection Law No. 6698, additional Article 19 of Law No. 3359, the Cybersecurity Law No. 7545 and the relevant legislation. A patient giving electronic medical consent does not amount to unlimited permission for every kind of data processing or transfer.

Consequences for medical malpractice disputes

The electronic consent system can provide records that show, in a dispute arising later, on what date the form was presented, when the code was verified and which authorized person carried out the transaction. This is a significant development, particularly with regard to proving that the patient was informed and gave consent.

However, the existence of an audit trail does not mean that the scope of the information given was legally sufficient or that the medical procedure performed was carried out correctly. In a specific case, the content of the form, the explanations given to the patient, the medical records, the nature of the intervention and the other relevant evidence must be assessed together.

Implementation check for healthcare institutions and software providers

• Review whether the consent forms in use are specific to the intervention and whether they comply with the provisions on patient rights and on informing the patient.
• Check the system access of authorized healthcare professionals and the identity verification conditions.
• Test separately the e-Nabız and SBYS-connected device processes, and the verified phone and OTP steps.
• Verify that date and time, transaction, user, OTP verification, hash and timestamp records are actually being kept.
• Update the KVKK, access authorization, encryption, retention and destruction, and incident response procedures.
• For cases in which the representative of a minor or a patient under guardianship cannot be verified, define alternative processes that comply with the legislation.

Frequently Asked Questions

Is electronic consent mandatory?

No. The Regulation sets out the procedure to be followed if the electronic method is used; it does not force all healthcare facilities to use only the electronic method for all interventions.

Is it enough to merely send an SMS link?

No. The relevant form must be presented to the patient, and the patient’s acceptance of the medical intervention must be obtained through the identity and SMS OTP verification set out in the Regulation.

Does the 12-month phone verification mean consent for all procedures?

No. It is the period for which a phone number verified by the healthcare facility is kept on record. The informed consent required for each intervention is assessed separately.

Will the form be viewable on e-Nabız?

Yes. A consent form obtained in the electronic environment is transferred to the central health data system and made available for access through e-Nabız.

Does electronic consent remove the healthcare institution’s liability?

No. The healthcare professional must still act in accordance with medical practice standards and inform the patient adequately.

Sources

[1] Official Gazette (Resmî Gazete) — October 27, 2026, Issue 33413: Regulation on Obtaining Informed Consent in the Electronic Environment. View the source

[2] Ministry of Health, Antalya Provincial Health Directorate (İl Sağlık Müdürlüğü) — text of the Regulation. View the source

Güneş & Güneş: Health Law and Healthcare Institutions (in Turkish) · How Is Medical Malpractice Proven? (in Turkish)