Patient Privacy and the Protection of Health Data: Patient Rights, KVKK, Violations and Compensation

Patient privacy is not merely a matter of keeping information about illnesses secret; the person’s body, the examination and treatment setting, their psychological and social life, their medical records and their digital health data are protected together. A patient’s use of healthcare services does not give the physician or hospital staff the authority to view health records without limit, to share them with relatives or to publish them for promotional purposes. The route to follow in the event of a violation of rights varies depending on whether the incident concerns physical privacy or the processing of personal data, whether it took place at a public or a private healthcare institution, and the consequences of the violation. In particular, the 2024 amendments to the KVKK and the personal health data regulations of December 3, 2025 and July 4, 2026 should be taken as the basis in assessing applications and access.

What is patient privacy and which rights does it protect?

Patient privacy means that, during healthcare, the person shares only medically necessary information and bodily characteristics, with the necessary persons and institutions and to the extent of a legitimate purpose, and that their examination, diagnosis and treatment are carried out under appropriate conditions of confidentiality. Article 21 of the Regulation on Patient Rights (Hasta Hakları Yönetmeliği) sets out respect for privacy as a fundamental principle. The right does not depend on citizenship status or on whether the treatment is paid for. The patient also has the right to protect their corporeal and spiritual existence under Article 17 of the Constitution, and their private life and personal data under Article 20 of the Constitution. Article 8 of the European Convention on Human Rights provides a safeguard of respect for private and family life. [1] [2]

Seeing privacy merely as drawing a curtain or putting a password on a database is insufficient. Protection has four interconnected dimensions: physical privacy (access to the body and the treatment area), informational privacy (diagnosis, laboratory, prescription, psychiatric, genetic and payment information), psychological/cognitive privacy (the person’s will as to which information about themselves to share and with whom) and social privacy (the person not being stigmatized because of their illness and not being exposed to unnecessary disclosure among relatives or in their work environment). These are not disconnected from one another; in most incidents they may be violated together.

What does Article 21 of the Regulation on Patient Rights require?

The privacy safeguard in the Regulation includes conducting medical assessments confidentially, carrying out examination and treatment in an appropriate setting, allowing a relative to be present where there is no medical objection, keeping persons unrelated to the intervention out, avoiding interference with private/family life that the illness does not require, and protecting the source of healthcare expenses. These items may also be requested separately by the patient. Just as much as the physician closing the door of the room, not announcing the patient’s diagnosis aloud at a counter where others can hear is also part of privacy. [2]

Privacy, being informed and informed consent are different rights

Being informed and informed consent enable the person to decide on the nature, benefits, risks and alternatives of the medical intervention. Privacy, by contrast, limits by whom and under what conditions these explanations, records and procedures may be seen. Consent given for an operation does not amount to blanket permission for the patient’s image to be published on the internet or for everyone within the hospital to look at the records. The use of photographs/video, disclosure to third parties and the processing of health data for a different purpose require a separate legal assessment. [1] [2] [3]

How is physical privacy ensured during examination and treatment?

The outpatient clinic room, the emergency department, intensive care, the operating room, the delivery room, the dialysis center and the imaging unit do not share the same conditions; but the common principle is necessity, proportionality and respect for the patient’s human dignity. Unauthorized persons should be kept away from the examination area; curtains, doors, personal space, clothing and methods of explanation should be balanced against medical necessity. Emergency interventions do not eliminate the right to privacy either; practices that may be restricted because of urgency are kept limited to what is necessary.

Outpatient clinics, patient rooms and imaging units

In the doctor’s office, another patient or an employee unrelated to the treatment should be prevented from listening to the conversations and seeing the patient’s body. The patient may ask for information about them to be discussed with the physician in a more private setting. However, removing a nurse, healthcare staff member, companion or interpreter who needs to be present at the examination for medical safety may not be possible in every case; in such situations the roles are explained and the least intrusive method is chosen. In imaging and physical examinations, only the necessary area of the body should be uncovered, and waiting and changing areas should be arranged appropriately. [2]

Intensive care, emergency departments and teaching hospitals

In intensive care and emergency settings, multidisciplinary teamwork does not mean that privacy ends. When bedside conversations, visible screens and clinical boards are organized, access should be ensured only for the necessary staff. In teaching institutions, if persons not directly involved in the treatment need to be present during the procedure, the patient’s separate consent should be obtained under Article 21 of the Regulation on Patient Rights. The presence of students cannot be imposed as a routine practice without being disclosed to the patient. [2]

Companions, interpreters and the choice of physician/staff

Where there is no medical objection, the patient may ask for a relative to be present and for privacy requirements to be observed. Where there is a communication barrier or a foreign language is involved, confidentiality is also protected in conversations conducted through an interpreter. The rights to choose/change physicians and staff are assessed depending on the relevant legislation, the capacity of the healthcare institution, medical necessities and any applicable fee conditions; providing a physician of a particular gender is not an absolute right to demand in every case. The patient’s religious, cultural and psychological sensitivities are taken into account to the extent compatible with the safe delivery of the service. [2]

Why is health information a special category of personal data?

Information on illness and diagnosis, surgical notes, psychiatric assessments, genetic results, disability reports, sexual health data, prescriptions and test results are special categories of personal data within the scope of Article 6 of Law No. 6698. The date of a hospital visit and identity or contact information are also personal data depending on the context; sometimes even disclosing that a person visited a particular healthcare institution may give rise to an inference about their state of health. Whether health data is on paper, in the hospital information system, in e-Nabız, in an email or in the cloud does not change the principle of protection. [3] [4]

The 2024 amendment: Is explicit consent required for every processing operation?

No. Article 6 of the KVKK was amended by Law No. 7499, and the new processing conditions entered into force on June 1, 2024. Explicit consent is not the only valid processing condition. Conditions such as express provision in the laws, necessity for the protection of the life/bodily integrity of the person or of another, the establishment/exercise/protection of a right and, with respect to persons under a duty of confidentiality or authorized institutions, public health, diagnosis, treatment, care and the financing of healthcare services may be relevant to the specific processing operation. However, the existence of one of these conditions does not give everyone who processes data a right to access all health records indefinitely. Purpose limitation, data minimization, confidentiality and security measures still apply. [3] [4]

Where explicit consent is required, the consent should be specific, based on information and given of free will. Making a patient’s access to treatment conditional on consent to advertising, commercial messages or publication that is not necessary for the treatment may also give rise to unlawfulness. Obtaining consent does not create unlimited permission for an activity that other legislation expressly prohibits. [3] [5]

The hospital as data controller and the responsibility of employees

The healthcare institution should implement technical/administrative measures such as access roles, user account management, retention of records, removal of authorization when staff change, access logs, protection of password/e-signature use, confidentiality training and incident response. A physician or secretary sharing the account assigned to them, the institution failing to carry out the necessary oversight, or the inability to determine which staff member carried out an access brings the data security obligation into play, depending on the specific circumstances. The fact that a patient’s data is on a screen that only authorized staff can see does not mean that every query by those staff members can be considered lawful. [6] [7]

Who can access e-Nabız health data?

While the e-Nabız system makes it easier for the patient and authorized healthcare providers to access information, it requires that access authority be used for treatment purposes and within the limits set by the legislation. A user setting a broader viewing preference does not amount to consent to patient data being queried out of curiosity or because of a personal relationship. In decision No. 2023/695 of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) dated May 2, 2023, the fact that the records were open under a broad access preference did not legitimize a query by a staff member unrelated to the treatment. The Board also separately examined the protection of the staff member’s account and the data controller’s measures. [6]

Access periods after December 3, 2025 and the medical-purpose limit

Article 6 of the Regulation on Personal Health Data (Kişisel Sağlık Verileri Hakkında Yönetmelik) was reorganized on December 3, 2025. Limited to the processing conditions in Article 6(3) of the Law, no general time restriction is provided for access by the family physician, while access by the physician consulted and by the physicians on duty at the healthcare institution is regulated until the end of the days on which healthcare is received, the consultation/follow-up period and the procedures directly connected with the service. At the facility where the patient is admitted, the relevant physicians may access the data until discharge; in emergency department admissions, the physicians on duty at that facility may do so until discharge, limited to the relevant healthcare service. In light of this provision, one cannot speak of a general 24-hour access period applicable to everyone. In every case, the query should have a connection with the relevant patient’s service. [8]

The patient’s e-Nabız security settings and the system’s code-based access methods also apply. The 2025 amendment regulated certain exceptions concerning admissions/emergency departments and situations such as pretrial detention/serving a sentence in which the verification code cannot be accessed in practice. None of these permits queries outside treatment. A record kept “hidden” or invisible in the system is not automatically removed from the legal retention obligation; turning off visibility on the profile and deleting the data are not the same operation. [8]

How should an unauthorized query be investigated?

The patient’s first step is to record the suspicion of access with the date, institution and physician/staff information and, where necessary, to request an explanation of the query from the data controller and the relevant health authorities. It is especially important to request that the access logs be preserved: the user ID, session time, type of record accessed, the reason for access, and any sharing or export operation can be examined. A screenshot alone does not always prove which data a person accessed and why, or that they transferred the data to a third party. The institution’s technical records should be assessed together with employee statements and transaction traffic. [6] [7]

Access rights of children, divorcing parents and caregivers

For a child’s health data, custody, age, capacity of discernment and the best interests of the child are assessed together. Under Article 8 of the Regulation, while parents’ access to the child’s health records via e-Nabız is the rule, a child with capacity of discernment may make parental access to their own health history subject to permission. This right should not be interpreted as an unlimited authority to access or conceal independent of family relationships; the duty to protect the child and the relevant legislation should be applied together. [8]

Access during divorce proceedings and after custody is settled

Under the December 3, 2025 amendment, while divorce proceedings are pending, the parent who has been granted custody on an interim basis, and after the divorce, the party who has custody, may access the child’s health data. The parent who does not have custody may apply to the relevant Directorate General of the Ministry of Health (Sağlık Bakanlığı). If deemed appropriate, limited data on the child’s state of health that does not reveal the location and contact information of the custodial parent or of the child may be provided. Protective measures, domestic violence and the child’s safety are of particular importance in such a review. For this reason, a general statement such as “parents can see everything without permission in every case” is incomplete. [8]

Access concerning persons with disabilities and by caregivers

The provision added to Article 9 of the Regulation in 2025 provides that caregivers may access the health data of persons who hold a disability report. However, caregiver status does not mean that the person’s entire right to privacy ceases to exist. The authorization needs to be determined taking into account the purpose of care and the person’s legal/de facto situation. [8]

Can health information be given to patients’ relatives and to attorneys?

The will of an adult patient with decision-making capacity is decisive. Under Article 18 of the Regulation on Patient Rights, the patient may ask for a specific person to be informed instead of themselves; this request should be recorded in signed form. The fact that a close relative has come to the hospital or calls the patient’s phone does not by itself justify passing on the entire diagnosis and treatment history. In special situations such as medical urgency, a statutory reporting obligation or authority of representation, the necessary disclosure is limited to the minimum scope. [2]

Informing the family on the ground that “it would adversely affect the patient”

The Regulation contains exceptional provisions, to be interpreted narrowly, on disclosing serious diagnoses to the patient. These provisions do not give the physician a general authority to disclose any health information they wish to family members. The patient’s right to receive information, any request not to be informed, medical necessity and the procedure under the current rules should be examined together. [2]

The 2025 amendment on attorneys’ access to health records

The former Article 10 of the Regulation on Personal Health Data, which stated that a general power of attorney was not sufficient and that a special consent clause was required, was repealed on December 3, 2025. The former provision therefore cannot be described as if it were still in force. Nevertheless, the repeal of Article 10 does not mean that an attorney may access any patient’s health records without documents or without limit. Representation under Article 16 of the Regulation on Patient Rights, the Attorneyship Law (Avukatlık Kanunu), Article 6 of the KVKK, the purpose of the transfer of personal data and the relevant administrative/judicial procedure should be assessed together. Determining, on the basis of the specific document, the authority and the basis required for sharing special categories of data is important. The Union of Turkish Bar Associations (Türkiye Barolar Birliği) also announced in its notice of December 17, 2025 that the former Article 10 had been repealed. [2] [8] [9]

Are the health data of deceased patients protected?

Yes. Under Article 21 of the Regulation on Patient Rights, death does not end the right to privacy. Article 11 of the Regulation on Personal Health Data contains the provision under which statutory heirs who present a certificate of inheritance (veraset ilamı) may request health data individually. The minimum retention period in the same article was increased from 20 years to 30 years by the December 3, 2025 amendment. This period does not mean that all health documents will be deleted exactly in the 30th year in every case; special retention obligations under other laws and the nature of the requested record should be examined. [2] [8]

The personality rights of the deceased are assessed together with the heirs’ interests in obtaining information, bringing an action and family privacy. Even after the patient’s death, giving reports to the press or sharing hospital records on social media may bring confidentiality obligations into play.

The patient’s right to inspect their file and obtain copies

Article 16 of the Regulation on Patient Rights regulates the patient’s right to inspect their health file and obtain copies of it, directly or through an attorney-in-fact/legal representative whom they have duly authorized. In this context, the discharge summary (epikriz), operative note, anesthesia record, tests, radiology images, pathology, consent documents and discharge records may be requested depending on the nature of the incident. The hospital’s obligation to keep records differs from its obligation to make the records available to the person entitled to them; if a record does not exist, this should be explained and separately assessed within the relevant time limits and in the file. [2]

The request should set out which period and documents are requested, the secure delivery method, identity/representation verification and, where applicable, the statutory limits on fees. The right of access to records should not be confused with a right to disclose the data to the public. Particularly in a dispute concerning medical fault or a privacy violation, preserving the records unaltered is important.

How are an incorrect diagnosis, a report, an e-Nabız record and past health information corrected?

The patient may request the correction of incomplete or incorrect medical and personal records under Article 17 of the Regulation on Patient Rights and Article 13 of the Regulation on Personal Health Data. For this purpose, the examination documents on which the application is based, tests of different dates, specialist assessments and the nature of the error may be submitted. Changing a visibility preference, deleting a verifiable medical record, correcting incorrect data and reassessing a past diagnosis are separate procedures. [2] [10]

July 4, 2026: Reassessment of past diagnoses (Article 13/A)

Under Article 13/A, added by the Regulation of July 4, 2026, previously made diagnoses may be reassessed on the basis of the person’s current state of health. For a diagnosis made by a single physician, a three-physician health board is provided for; for a diagnosis made by a three-physician or full-fledged board, an assessment by a full-fledged board is provided for. Where there is a status-reporting health board report stating that the diagnosis is not present in the current condition, this report needs to be taken into account in future procedures, without prejudice to the provisions of the relevant special legislation. This procedure is not identical to erasing from history a diagnosis that was actually made in the past. In particular, confusing an old diagnosis with the present condition in employment, security assessments or a procedure requiring a medical report may lead to a loss of rights. [10]

Requests for erasure, destruction and anonymization

Under Article 7 of the KVKK, where the reason for processing has ceased to exist, the data controller should assess the obligation to erase, destroy or anonymize within the framework of the applicable legislation. However, a patient saying “I do not want the record” does not create an obligation to immediately destroy mandatory medical archive records or documents that must be retained by law. Anonymization means that the data cannot be linked to the person even by combining it with other information; merely covering the name is not always genuine anonymization. [3]

In which situations may health data be disclosed or transferred?

Data transfer may come into question in situations such as emergency treatment, statutory reporting, public health, forensic examination, a court decision, and social security and healthcare financing procedures. For each transfer, the legal basis, the duty and authority, the necessary scope of data and access security are assessed separately. An obligation to report a crime or a forensic case does not justify disclosing all of the patient’s past diagnoses to a wide group of staff or to the public. [2] [3]

Research, medical education and scientific publications

The use of personal health data in medical research is assessed separately in terms of its legal basis and ethical processes. The use of genuinely anonymized data and the use of re-identifiable patient files do not lead to the same result. If the patient’s image or face is to be used in training, patient privacy, the nature of the image, consent and sector-specific rules are examined separately. Being an educational institution does not provide an exception to privacy. [2] [3]

Cloud, artificial intelligence systems and transfer of data abroad

Where healthcare institutions use cloud records, remote consultations, AI-assisted report analysis, laboratory platforms or foreign service providers, the data processor/data controller relationship, the place of access and storage, the categories of data transferred and the security measures should be documented. Article 9 of the KVKK, as amended with effect from June 1, 2024, provides for a tiered system for transfers abroad that includes adequacy decisions, appropriate safeguards and limited incidental exceptions. The mere fact that data is in the cloud, or that a contract says it is “confidential,” does not by itself make the transfer lawful. [11]

Can a patient’s photograph, video or surgical footage be shared?

Camera footage showing that the patient is in the hospital, a photograph in which their face is visible, before-and-after surgery images, an audio recording or a treatment history constitute personal data and, in some cases, data relating to private life. The mere fact that the patient has previously published their own photograph on a platform does not give the healthcare institution permission to use it for a different purpose. Medical consent, permission to share on social media and compliance with advertising legislation are independent subjects of examination. [3] [5]

In the Personal Data Protection Board’s decision dated May 11, 2023, No. 2023/787, it was found that, although consent documents existed for patient videos filmed for promotional purposes, this activity had no legal basis because of the sector-specific advertising restrictions in the health field. The version of the sector rules on which this decision was based that was in force on the date of the incident should be examined separately; consent alone does not make prohibited advertising lawful. [5]

In the decision of the 13th Civil Chamber of the Court of Cassation (Yargıtay 13. Hukuk Dairesi) dated April 2, 2014, E. 2013/29323, K. 2014/9953, it was held that giving security camera footage relating to the hospital car park to a television channel without the patient’s consent violated personality rights. The fact that camera recordings were obtained for security does not permit their use for broadcasting purposes. [12]

Legal consequences of a privacy violation: Administrative, private-law and criminal liability

Administrative oversight and sanctions under the KVKK

Where personal data is processed unlawfully, accessed without authorization or not protected, the Personal Data Protection Board may examine the data controller; where appropriate measures have not been taken, an administrative fine and decisions aimed at remedying the unlawfulness may come into question. In decision No. 2023/695, the unauthorized e-Nabız query and inadequate password security were assessed together. These sanctions are not compensation automatically paid to the patient; compensation for a violation of personality rights is claimed separately and its conditions are assessed. [6] [7]

The data breach notification provided for in Article 12(5) of the KVKK and in Board decision No. 2019/10 is regulated so that the data controller makes a notification to the Board within 72 hours at the latest after learning of the breach, and that the affected persons are also informed within the shortest reasonable time. Not every incorrect data entry is the same as every incident falling within the scope of statutory breach notification; the scope of the incident should be assessed and the records preserved. [13]

Compensation against private hospitals and physicians

Depending on the nature of the dispute, the provisions on the contract concluded with the private healthcare institution, on tort or on the protection of personality rights may apply. Articles 24–25 of the Turkish Civil Code, Articles 49, 58 and 112 of the Turkish Code of Obligations and, where necessary, the provisions on the acts of auxiliary persons may be relevant. For pecuniary damages, the harm, the unlawful act and causation; for non-pecuniary damages, the nature and specific effect of the violation of personality rights are examined separately. The fact that the victim suffered no pecuniary loss at all does not eliminate the assessment of non-pecuniary damages if the conditions are met. The court with subject-matter jurisdiction and the procedural prerequisites are determined according to whether the relationship qualifies as a consumer transaction and according to the legal nature of the claim; not all lawsuits against private hospitals automatically fall to the commercial court. [12] [14]

In the decision of the 3rd Civil Chamber of the Court of Cassation (Yargıtay 3. Hukuk Dairesi) dated June 4, 2024, E. 2023/2239, K. 2024/1823, the disclosure, before verification was completed, of the result of a test performed without the patient’s consent was assessed; setting the non-pecuniary damages at an inadequate level in light of the specific features of the case was made a ground for reversal. The decision shows that not only the medical procedure but also the disclosure of test information can give rise to legal consequences. [14]

Administrative liability and time limits at public hospitals

A claim of damage arising from a public hospital’s provision of healthcare services may be addressed in the administrative courts, depending on the legal characterization of the incident, within the framework of service fault or other principles of administrative liability. In full remedy claims arising from an administrative action under Article 13 of the Administrative Procedure Law No. 2577 (İYUK), as a rule, an application to the relevant administration within one year of learning of the action causing the damage and in any event within five years of the action, and compliance with the time limit for bringing an action after the response/implied rejection concerning the administrative application, come into question. Damage arising from an administrative act under Article 12 of the Administrative Procedure Law may follow a different procedure. Since learning of the act, the emergence of the damage and the distinction between action and act are critical in the specific file, a rule such as “a straight 60 days in all lawsuits against a public hospital” cannot be applied. [15]

The offense of unlawfully giving or obtaining personal data

Article 135 of TCK No. 5237 (recording of personal data), Article 136 (unlawfully giving, disseminating or obtaining data), Article 137 (certain aggravated forms), Article 138 (failure to destroy data) and Article 134 (violation of the privacy of private life) may be discussed depending on the specific act. TCK Article 136(1) provides for a basic penalty of 2 to 4 years’ imprisonment; the aggravated forms and the date of the act are also taken into account. For criminal liability, the nature of the personal data, the act, unlawfulness, intent, the manner of obtaining and transfer, and the evidence should be examined. Not every breach of data protection legislation automatically means that the offense under TCK Article 136 has been committed. [16]

In the decision of the 12th Criminal Chamber of the Court of Cassation (Yargıtay 12. Ceza Dairesi) dated June 30, 2025, E. 2022/8375, K. 2025/5747, the obtaining of a patient’s emergency examination form by taking advantage of the opportunity afforded by the doctor’s profession, and its publication on the internet, were assessed, and the conviction was upheld with a correction concerning the security measure. In its decision dated March 12, 2026, E. 2023/4676, K. 2026/2628, it was held that the elements of the offense were present where a psychiatric report was obtained by a spouse and transferred to a third person. The fact that health data has been used in a court file does not by itself make the initial obtaining and transfer lawful. [17] [18]

What do the decisions of the Constitutional Court and the high courts show?

In the Cem Özberk (Application No. 2020/15944, March 20, 2025) judgment, the Plenary Assembly of the Constitutional Court (Anayasa Mahkemesi Genel Kurulu) emphasized that, in a complaint concerning an adult’s health information, the criminal proceedings need to carry out an adequate examination with respect to the right to request the protection of personal data. The judgment does not mean that every privacy claim automatically leads to a conviction; it sets out the obligation of effective investigation, justification of the interference and discussion of the constitutional weight of personal data. [19]

When the Court of Cassation decisions described above on hospital camera footage, a test result obtained without consent and the unauthorized sharing of a medical report are assessed together, three distinctions emerge: (i) a hospital obtaining data for a legitimate purpose does not give it the right to use the data without limit for a different purpose; (ii) not only the person’s actual state of health but also putting a record of that state into circulation can give rise to legal consequences; (iii) KVKK oversight, compensation and criminal investigation are subject to different procedures and conditions of proof. [12] [14] [17] [18] [19]

Which evidence needs to be preserved in the event of a privacy violation?

Seeking legal redress generally depends on preserving the records of the first days. If there is an unauthorized image or disclosure, the URL of the post, its date, the account, a screenshot, any video and the manner of publication are preserved. Where access through the hospital system is alleged, the preservation of access and transaction logs is requested, specifying the time of the incident, the application used and the relevant patient file. Where a physical violation in the examination area is alleged, witnesses, shift schedules, entry–exit records, the first report to the patient rights unit (hasta hakları birimi) and the incident report are important.

Limits to observe when requesting evidence

• Obtaining evidence from the hospital system without authorization, collecting other patients’ records or unlawfully using employee accounts may turn into a new violation of rights.
• Health documents to be submitted to the court or the competent authority should be limited to the necessary parts; the records of third persons should be appropriately redacted.
• The authenticity of the post, the possibility of editing/fabrication, the link between device and account, the accuracy of the access log and to whom the data actually reached may be examined by a court-appointed expert where necessary.
• For digital records at risk of deletion, depending on the conditions, preservation measures through a notarial record, preservation of evidence, the public prosecutor’s office or the court may be considered. [6] [7] [17]

Application routes and time limits in the event of a patient privacy violation

Application routes do not replace one another. A report to the patient rights unit may concern a medical/institutional review; an application to the data controller, a data processing request under the KVKK; a referral to the public prosecutor, a criminal investigation; and an action for compensation, a claim of damage and of a violation of personality rights. Whether the healthcare institution is public or private, and the date on which the unlawfulness occurred, affect the competent authority and the time limit.

A first application to the data controller is mandatory for a complaint to the Personal Data Protection Board. If there is a response within 30 days, 30 days from learning of that response apply; if there is no response at all, 60 days from the first application apply. Waiting for a response that arrives after 30 days does not by itself extend the final 60-day limit in the law. A KVKK complaint does not eliminate the patient’s right to bring an action for pecuniary/non-pecuniary damages. [20]

Order of steps for a patient who learns of a violation

1. Identify the nature of the violation: the examination setting, disclosure of health information, a digital query, publication of a photograph/video or an incorrect record.
2. Preserve the initial evidence lawfully; record the link to the post, its date, the institution, the related events and the witnesses.
3. If there is a risk of deletion/alteration of patient records and access logs, send a written preservation request to the relevant institution.
4. For a claim concerning data processing under the KVKK, make an Article 13 application to the correct data controller; track the time limits for a complaint to the Board separately.
5. Assess the possibilities of a criminal offense, private-law compensation or public service fault under separate legal headings; where necessary, examine protective measures and interim requests.
6. Submit health data to the authority you apply to in the necessary amount, without unnecessarily sharing it through unencrypted email, social media or with unrelated persons.

How should privacy compliance be established for hospitals and healthcare staff?

It cannot be assumed that institutions ensure patient privacy merely through signed confidentiality undertakings. Risk-based organization is necessary: mandatory role definitions relating to treatment; individual user accounts; actual oversight of the prohibition on sharing e-signatures/passwords; the visibility of patient screens and physical counters; regular review of access logs; restriction of unnecessary access in admission, consultation and discharge procedures; revoking authorization when staff leave; retention/access rules for camera and training footage; training; incident reporting; secure document transfer; analysis of foreign service providers; and an erasure-retention schedule.

An application received by the patient rights unit should not be considered concluded merely because it has been forwarded to staff within the system; those responsible for the incident, the records examined, the response given and the corrective measure should be identified. The measure of compliance is not only the existence of documents but actual system behavior. In the Board’s e-Nabız decisions, staff authorization, access to accounts and the institution’s technical/administrative measures were assessed together. [6] [7] [13]

Related articles: How to Obtain the Patient File and Medical Records: Application, Missing Records and Preservation of Evidence; Respect for Private Life and Protection of Personal Data: Violations of Rights and Application Routes; Handcuffed Examination in Hospitals and Patient Privacy: The Rights of Pretrial Detainees and Convicts; Doctor Error at a State Hospital: Application to the Administration and Full Remedy Action

Conclusion

Patient privacy is an inseparable part of the trust placed in a healthcare institution and of the person’s legal control over their own body and health information. The fact that data may be processed for treatment does not mean that health records may be viewed by everyone or shared on social media. Lawful access limits should be made concrete in line with the 2024 KVKK amendments and the 2025–2026 personal health data regulations. In a claim of violation, documenting which information was obtained and used by whom, when and on what legal basis, and assessing internal, KVKK, judicial and administrative applications separately in terms of competence and time limits, are decisive. Protection begins, before the right to bring an action after a violation, with the patient’s privacy actually being respected during the treatment process.

Frequently Asked Questions

Can another patient be brought into the room while a patient is being examined?

Bringing another person into the examination area in a way that creates a risk of the patient’s health information being overheard or their body being seen raises a privacy problem. The presence of unrelated persons should be prevented; medically necessary staff, the consent of the patient/person concerned and the conditions for safe service should be assessed separately.

Can a patient ask to speak with their physician alone?

Yes, they may request a private conversation. However, staff who need to be present for medical safety or mandatory healthcare do not have to be sent out in every case. The reason should be explained and whatever confidentiality is possible should be ensured.

Does the “all physicians may view” preference in e-Nabız allow every physician to run queries?

No. The access setting does not make queries based on curiosity or personal reasons, without a medical service purpose, lawful. Each access requires a statutory processing condition and a specific connection with the service. [6] [8]

What can I do if a physician looked at my e-Nabız records without permission?

You may request an explanation of the institution, user and date on which the relevant data was viewed, the preservation of the existing technical records and a written response from the data controller. A KVKK application and, where necessary, the public prosecutor and compensation routes are assessed separately according to the nature of the incident.

After a divorce, can the parent who does not have custody see the child’s data?

The 2025 amendment separated direct access from an application to the Ministry. The application of a parent without custody to the Directorate General may be examined; if deemed appropriate, limited health data stripped of location/address/contact information may be provided. [8]

Can a diagnosis be disclosed to a patient’s relative in every case?

No. The adult patient’s information preference, legal representation and any statutory exceptions are examined. A close relationship does not by itself provide access to the entire health history. [2]

Does the special power of attorney requirement for attorneys’ access to health data still apply?

The former Article 10 of the Regulation was repealed on December 3, 2025. However, this change does not mean unlimited access to health data. Authority of representation, necessity, Article 6 of the KVKK and the relevant judicial/administrative procedure should be assessed separately. [8] [9]

How long are a deceased patient’s health records retained?

Under Article 11 of the Regulation on Personal Health Data, the minimum period is 30 years. Other special regulations and the specific type of record may require longer retention. [8]

Can a past psychiatric diagnosis be deleted from e-Nabız?

Correcting an incorrect record, hiding it on the profile and reassessing a past diagnosis under the 2026 Article 13/A are different routes. A health board report concerning the current condition does not in every case mean that the past record is destroyed. [10]

Can a patient’s image be shared in advertising with their explicit consent?

Explicit consent alone is not sufficient. Sector-specific promotion prohibitions concerning healthcare services and the other data processing conditions also apply. Decision No. 2023/787 of the Personal Data Protection Board illustrates this distinction. [5]

Can the broadcast of a hospital’s security camera footage give rise to compensation?

Yes, if there is no legal basis for the broadcast, the conditions for compensation for a violation of personality rights may be met. Decision No. 2014/9953 of the 13th Civil Chamber of the Court of Cassation assessed in this respect the unauthorized sharing of footage obtained for security purposes. [12]

Can a patient privacy complaint be made directly to the Personal Data Protection Board?

Before a complaint to the Board under Article 14 of the KVKK, an application should be made to the data controller under Article 13. The 30-day and 60-day time limits are important depending on the dates of the response and of the application. Patient rights applications and a criminal report are different processes. [20]

Is the time limit for a compensation action against a public hospital always 60 days?

No. Whether the situation causing the damage is an administrative act or an action, Articles 12–13 of the Administrative Procedure Law, the prior application to the administration and the specific date of learning may lead to different time-limit calculations. [15]

Is storing health records in a cloud abroad prohibited in itself?

No such absolute prohibition or permission can be inferred in itself. The conditions for data processing and transfer abroad, the role of the service provider, the appropriate safeguards/adequacy/exception system of Article 9 of the KVKK and the security measures should be assessed together. [11]

Sources and legal bases

1. Constitution of the Republic of Türkiye (Türkiye Cumhuriyeti Anayasası), Articles 17 and 20; European Convention on Human Rights, Article 8. Legislation Information System (Mevzuat Bilgi Sistemi).
2. Ministry of Health (Sağlık Bakanlığı), Regulation on Patient Rights (Hasta Hakları Yönetmeliği), in particular Articles 15–23.
3. Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), Articles 4 and 6–14; Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
4. Personal Data Protection Authority, Guide on the Processing of Special Categories of Personal Data (Özel Nitelikli Kişisel Verilerin İşlenmesine İlişkin Rehber), 2024 legislative amendments.
5. Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), decision dated May 11, 2023, No. 2023/787, hospital advertising and promotional footage.
6. Personal Data Protection Board, decision dated May 2, 2023, No. 2023/695, unauthorized access to e-Nabız.
7. Personal Data Protection Board, decision dated September 21, 2021, No. 2021/962.
8. Ministry of Health, amendment of December 3, 2025 to the Regulation on Personal Health Data (Kişisel Sağlık Verileri Hakkında Yönetmelik), Official Gazette No. 33096.
9. Union of Turkish Bar Associations (Türkiye Barolar Birliği), Notice 2025/65 dated December 17, 2025, repeal of the provision on attorneys’ access to health data.
10. Ministry of Health, amendment of July 4, 2026 to the Regulation on Personal Health Data, Official Gazette No. 33300, Article 13/A.
11. Personal Data Protection Authority, Transfer Abroad (Yurt Dışına Aktarım), principles for the application of Article 9 of the KVKK.
12. 13th Civil Chamber of the Court of Cassation (Yargıtay 13. Hukuk Dairesi), April 2, 2014, E. 2013/29323, K. 2014/9953; full decision.
13. Personal Data Protection Authority, breach notification decision dated January 24, 2019, No. 2019/10.
14. 3rd Civil Chamber of the Court of Cassation (Yargıtay 3. Hukuk Dairesi), June 4, 2024, E. 2023/2239, K. 2024/1823; full decision.
15. Administrative Procedure Law No. 2577 (İdari Yargılama Usulü Kanunu), Articles 12 and 13; Legislation Information System.
16. Turkish Criminal Code No. 5237 (Türk Ceza Kanunu), Articles 134–140; Legislation Information System.
17. 12th Criminal Chamber of the Court of Cassation (Yargıtay 12. Ceza Dairesi), June 30, 2025, E. 2022/8375, K. 2025/5747; full decision.
18. 12th Criminal Chamber of the Court of Cassation, March 12, 2026, E. 2023/4676, K. 2026/2628; full decision.
19. Plenary Assembly of the Constitutional Court (Anayasa Mahkemesi Genel Kurulu), Cem Özberk, Application No. 2020/15944, March 20, 2025; decision text, Official Gazette of August 5, 2025, No. 32977.
20. Personal Data Protection Authority, Right to Complain and Time Limits (Şikâyet Hakkı); decision No. 2019/9 on the calculation of time limits.