Regulation on Obtaining Informed Consent in an Electronic Environment: A New Era and Medicolegal Risks
Kemal Kumkumoğlu
Yazgülü Taştemir
Of Counsel
The Regulation on Obtaining Informed Consent in an Electronic Environment, published in the Official Gazette dated 27 October 2026 and numbered 33413, sets out the procedures and principles governing the electronic obtaining of informed consent prior to medical interventions at healthcare facilities. The Regulation establishes a digital framework for the entire process, encompassing identity and telephone number verification, delivery of the informed consent form to the patient, the use of SMS-based one-time passwords (OTPs), the retention of electronic records and, where necessary, their submission for judicial or administrative review.
For the purposes of this client alert, the term “electronic consent” is used as an abbreviation for obtaining informed consent in an electronic environment.
How Will Electronic Consent Be Obtained?
Before the electronic consent process begins, the identities of both the patient and the healthcare professional conducting the process must be verified. In addition, the patient must have a verified mobile phone number. A telephone number verified through the healthcare facility’s system will be deemed valid for a period of 12 months from the date of verification.
The informed consent form approved by the healthcare professional will be made available to the patient through e-Nabız or an electronic communication tool connected to the healthcare facility’s Health Information Management System (SBYS). When the patient consents to the intervention, an SMS containing a one-time password (OTP), which may be used exclusively for the relevant procedure, will be sent to the patient’s verified mobile phone number. Where the process is carried out through e-Nabız, the patient enters the OTP into the system. Where the healthcare facility’s electronic communication tool is used, the patient shares the OTP with the healthcare professional, who then enters the code into the system.
What Advantages Will Electronic Consent Offer?
Electronic consent may offer significant advantages, particularly by reducing problems such as the loss of paper consent forms, incomplete filing, inability to retrieve documents from physical archives and difficulties determining the dates on which forms were prepared. Recording the date and time of the patient’s consent, OTP transmission and verification details, and the identity of the healthcare professional performing the procedure in electronic form will enhance the traceability of the consent process.
Making the form approved by the patient accessible to the patient through e-Nabız is also important in terms of the patient’s access to their own health records. The use of hash values and timestamps may provide a stronger evidentiary framework for healthcare facilities, healthcare professionals and patients by enabling the integrity of electronic documents to be verified and any subsequent alterations to be detected.
Standardised electronic processes may also enable the institutional monitoring of consent procedures used by different departments and physicians within healthcare facilities, the auditing of deficiencies and the faster retrieval of records when required. In this respect, the system may serve as an important tool not only for establishing evidence after a dispute has arisen, but also for preventing disputes and managing quality in healthcare services.
Will Electronic Consent Replace the Duty to Inform the Patient?
This is where the most important legal limitation of the electronic system lies. The fact that a form has been sent to the patient and an OTP has been verified does not, in itself, demonstrate that the patient actually read the form, was able to understand the information provided, was informed of material risks specific to their circumstances, was informed about alternative treatments or had an opportunity to ask questions.
Accordingly, although the electronic system is an important tool for obtaining and proving consent, it does not eliminate the physician’s duty to provide adequate, comprehensible, timely and patient-specific information. Particularly in the case of high-risk surgical and invasive procedures, mechanically treating the process as complete on the basis that “the form was sent + the OTP was entered = informed consent obtained” may give rise to new legal risks.
How Will the Process Work for Patients with Limited Digital Access?
The Regulation does not restrict electronic consent to the use of smartphones. A patient using a mobile phone with a keypad that can receive SMS messages may receive the OTP and communicate it to the healthcare professional. However, such a patient may not be able to open and review the informed consent form on their own device. Accordingly, the ability to receive an OTP and the ability to access the consent form are not the same thing.
The Regulation does not provide for an alternative electronic verification method for patients who do not have a mobile phone, cannot receive SMS messages or cannot verify a telephone number registered in their name. Furthermore, for elderly patients, persons with disabilities, foreign patients and individuals with limited digital literacy, the fact that a form is electronically accessible does not necessarily mean that the patient can actually access and understand its contents. The implementation of electronic consent must not create a new practical barrier to accessing healthcare services.
What Happens if a Patient’s Phone or e-Nabız Account Is Used by a Family Member?
The fact that a telephone number has been verified in the patient’s name does not establish that the patient personally uses the phone on the date of the medical intervention. In particular, the phones and e-Nabız accounts of elderly patients or patients who have difficulty using digital tools may in practice be managed by their spouses, children or caregivers. Moreover, the fact that a telephone number verified by the healthcare facility remains valid for 12 months increases the possibility that the actual user may change between the date of verification and the date of the medical intervention.
Accordingly, a “verified telephone number belonging to the patient”, “verification of the OTP” and “the patient personally expressing their intention to consent” are not equivalent facts. A family member’s assistance with digital procedures does not mean that they are authorised to consent on behalf of an adult patient who has decision-making capacity. Similarly, electronic verification does not establish the patient’s decision-making capacity. Where a patient’s capacity to make decisions is affected by sedation, cognitive impairment, their state of consciousness or clinical circumstances, the patient’s technical ability to provide an OTP does not, by itself, demonstrate that valid informed consent has been obtained.
Who Will Be Responsible for Problems Arising from Different HBYS/SBYS Systems?
Healthcare facilities do not all use the same software. As the infrastructures, integration methods, update procedures and technical capabilities of different HBYS/SBYS providers may vary, the implementation of electronic consent systems may give rise to new risks, including integration errors, failure to generate OTP records, inability to transfer forms to the central system, loss of logs, inaccurate timestamps, system outages, loss of records during data migration and the inaccessibility of earlier versions of consent forms.
The Regulation on Health Information Management Systems separately governs the compatibility of SBYSs with the Ministry of Health’s central systems, regular backups, recovery testing and the preservation of audit logs. The existence of technical obligations on the part of an SBYS service provider does not entirely eliminate the healthcare facility’s own responsibilities. Under the Regulation on Obtaining Informed Consent in an Electronic Environment, the healthcare facility is also responsible for retaining, in accordance with applicable legislation, the records of transactions conducted through its own electronic communication tool.
Accordingly, if, for example, an error on the software provider’s side results in the loss of an OTP verification record, the responsibilities arising from the patient–healthcare facility relationship must be distinguished from the contractual and technical responsibilities arising between the healthcare facility and the SBYS provider. It is therefore important for healthcare facilities to clearly regulate, in their SBYS service agreements, responsibilities concerning the integrity and backup of electronic consent records, data loss, system changes, changes of service provider, data migration, accessibility and the delivery of logs.
How Long Must Electronic Consent Records Be Retained?
The Regulation does not establish a separate, fixed retention period for electronic consent records. Instead, it provides that electronic consent records and their associated audit trail records must be retained in accordance with the retention and destruction periods applicable to informed consent documents obtained in physical form. The applicable retention period must therefore be determined by taking into account the type of healthcare facility, medical records and the relevant specific legislation.
This cross-reference may create significant uncertainty in practice. Current legislation governing private healthcare facilities does not provide uniform retention periods for every type of facility and every category of record; certain provisions contain only general requirements that records be retained “in accordance with the applicable legislation”.
A more significant risk arises where the consent form is retained but the electronic evidentiary records associated with it are deleted earlier. If the consent form approved by the patient remains available but the OTP transmission and verification details, logs, hash values or timestamps are no longer available, a substantial part of the evidentiary advantage offered by electronic consent may be lost. Healthcare facilities should therefore treat the consent form, form version, OTP records, date and time of the transaction, healthcare professional details, logs, hash values and timestamps not as independent records, but as interconnected components of the same electronic chain of evidence.
The same applies when an SBYS is changed or the healthcare facility transitions to another software provider. Merely retaining the ability to view historical records may not be sufficient; the integrity of electronic records and their associated audit trails must also be preserved in a manner that allows them to be transferred to the new system and verified when necessary.
How Can It Be Proven Years Later Which Consent Form the Patient Approved?
Healthcare facilities may revise their standard consent forms over time, while a complication or dispute may arise years after the medical intervention. In such circumstances, submitting the current consent form available in the system to the court will not necessarily establish which risks were disclosed to the patient at the time of the intervention.
The version of the form viewed and approved by the patient on the date of the intervention must be retained in an immutable and verifiable manner. Hash values and timestamps are particularly important in this respect. They will make it possible to technically examine allegations such as “this risk was not included in the form at that time”, “the form was subsequently amended” or “a different version was submitted to the court”.
Will Electronic Consent Be Relevant Only in Medical Malpractice Litigation?
Although informed consent is primarily relevant to the patient–physician relationship and the lawfulness of a medical intervention, the use of electronic records is not limited to medical malpractice litigation.
Such records may also be examined in criminal investigations, compensation proceedings before civil and consumer courts, administrative judicial proceedings, inspections conducted by the Ministry of Health and provincial health directorates, professional disciplinary proceedings and insurance disputes. In particular, private health insurers may, within the framework of applicable legislation, access health information for the purpose of assessing risks and compensation claims, and request information and documents from the persons and institutions providing treatment to the insured. Accordingly, depending on the circumstances of the case, the consent form may be among the medical records requested when assessing the scope of an intervention, the procedure performed, the treatment accepted by the patient or another matter forming the subject of a dispute.
Can a Patient Withdraw Consent Given Electronically?
Obtaining informed consent electronically does not deprive the patient of the right to withdraw that consent at a later stage. Under the Patient Rights Regulation, the patient has the right to refuse treatment or request its discontinuation, except in cases where treatment is legally mandatory, while assuming responsibility for any adverse consequences that may arise. Accordingly, consent given electronically may be withdrawn before the medical intervention is performed. In the case of ongoing treatment, the patient’s intention to discontinue treatment must be assessed separately.
Transferring only the consent document between HBYS/SBYS systems will not be sufficient. If the patient withdraws consent, this change must also be reflected in the relevant systems without delay. Otherwise, consent withdrawn in one system may continue to appear valid in another, creating the risk that a medical intervention will be performed despite the absence of consent. It is therefore important to ensure that the current status of consent, the date and time of withdrawal, and the identity of the healthcare professional who received the withdrawal notice are traceable.
For example, if a patient gives electronic consent for surgery and subsequently claims to have withdrawn that consent before the intervention, the dispute will no longer concern solely the validity of the initial consent. It will also concern whether a withdrawal notice was made, the date and channel through which it was communicated, and when it reached the healthcare facility. Accordingly, the procedure for withdrawing electronic consent must be as clear, accessible and capable of being recorded as the procedure for giving consent.
A particular implementation risk arises in relation to HBYS/SBYS infrastructures. If an electronic consent record has been transferred to a central system but the patient subsequently withdraws consent through another channel—for example, orally or in writing at the healthcare facility—the original electronic record may continue to appear in the system as “active/current consent”. This may mislead healthcare professionals. Similar risks may arise where the current status of consent is not synchronised across different systems. Accordingly, for medicolegal risk management purposes, it is important for electronic systems to allow the status of consent to be tracked not merely as “given/not given”, but also through information such as “given – withdrawn – date/time of withdrawal – person who received the withdrawal notice”.
Withdrawal of consent must not mean that the earlier electronic transaction and its associated records are deleted. On the contrary, both the initial consent and the subsequent withdrawal notice must be preserved together with their respective dates and times. This will make it possible, in the event of a dispute, to establish the period during which valid consent existed and when the healthcare facility became aware of the withdrawal. This is particularly important in treatments involving successive stages or multiple medical interventions. The patient’s initial electronic consent to a particular treatment plan cannot be regarded as an irrevocable and indefinite authorisation covering all subsequent interventions. Changes in the patient’s wishes must be monitored on an ongoing basis.
The Regulation governs the procedures and principles applicable when informed consent is obtained electronically; it does not contain any provision abolishing all existing written consent practices or requiring informed consent to be obtained electronically in every case. It should be borne in mind that electronic verification does not replace the obligation to provide the patient with sufficient and comprehensible information regarding the medical intervention. Accordingly, particularly in the case of invasive and high-risk procedures, physicians should separately record in the patient’s file and/or medical records that the patient was informed orally, was given an opportunity to ask questions, received answers to those questions, and completed the electronic consent process following the provision of such information. This is important both for risk management and for demonstrating, in any subsequent dispute, that the duty to inform the patient was duly fulfilled. Where the Regulation contains no express provision or gives rise to uncertainty regarding the implementation of electronic consent, it would be appropriate to proceed in accordance with the provisions of the Patient Rights Regulation, as expressly referenced by the Regulation.
