Electronic Consent via e-Nabız: How Is Pre-Surgery Consent Given by SMS, and What Happens to Patient Rights?

"Consent forms" signed before surgery or an interventional procedure are no longer limited to paper. The Regulation on Obtaining Informed Consent Electronically, published in Official Gazette No. 33413 of 27 October 2026, entered into force on its date of publication. Under this regulation, patients can give their consent to medical intervention via e-Nabız or through a link sent to their phone together with a one-time SMS password.

In this article we explain how the new system works, what patients should pay attention to and what these records will mean if a dispute arises.

1. What does the Regulation govern and whom does it cover?

The Regulation sets out the procedures and principles for obtaining informed consent electronically before medical intervention, presenting the consent form to the patient in an accessible manner and keeping records (Art. 1). It covers all primary, secondary and tertiary healthcare facilities (Art. 2). In other words, all healthcare facilities, from family medicine to state and city hospitals, and from private hospitals to university hospitals, fall within its scope.

The legal basis of the regulation is Article 70 of Law No. 1219 on the Practice of Medicine and Medical Sciences and Additional Article 19 of Law No. 3359 on Basic Health Services (Art. 3). Article 70 of Law No. 1219 already required the patient's consent before medical intervention; the new regulation determines how this consent is to be obtained electronically.

2. How does electronic consent work, step by step?

Under Article 8 of the Regulation, the process runs as follows:

1. The physician prepares the form: The healthcare professional conducting the process logs into the system and approves the consent form for the relevant intervention.
2. The form reaches the patient: The form is presented to the patient via a link in an SMS sent to the patient's verified mobile phone or directly via e-Nabız.
3. The patient reviews the form: The patient reads the form; if they accept, they receive a one-time SMS password (SMS OTP) valid only for that intervention.
4. Approval is given: If approving via e-Nabız, the patient enters the password themselves. If the healthcare facility's system is used, the patient shares the password with the healthcare staff, who enter it into the system.
5. A record is created: Upon verification, consent is deemed obtained. The form is transferred to the Ministry of Health's central health data system and made accessible to the patient on e-Nabız.

3. Identity and phone verification: the 12-month period

The identity of the patient and of the healthcare professional conducting the process is verified before the intervention; the electronic consent process cannot be started until identity verification is completed (Art. 6). The healthcare professional must also be registered and active in the Ministry's systems.

For electronic consent, the patient must have a verified mobile phone number (Art. 7). If the number is not registered on e-Nabız, it is entered and confirmed with an SMS password. A number verified through the healthcare facility's system is valid for 12 months; once this period expires, re-verification is required.

Practical note: If your phone number is out of date or your line is registered in someone else's name, check your number on e-Nabız before the procedure. A password received on a line that does not belong to you may make it harder to prove that the consent really came from you.

4. Children and persons under guardianship: consent of the legal representative

If the patient is a minor or under guardianship, the procedure is carried out by the legal representative in accordance with the Patient Rights Regulation; the identity and phone verification rules also apply to the representative (Art. 11). If there is no legal representative, the representative is not present or cannot be verified electronically, consent cannot be obtained electronically. In that case the electronic route is closed; how consent is to be obtained is determined under the general provisions. Where the Regulation contains no provision, the Patient Rights Regulation applies (Art. 13).

5. How are records kept? Evidentiary value

Electronic consent records and audit logs are kept in line with the retention and destruction periods applicable to physical consent documents. Audit logs are stored with an electronic data integrity value and a time stamp, in a manner suitable for judicial and administrative review (Art. 9). At a minimum, the following information is recorded:

• The date, time and transaction details of the declaration of consent,
• The sending and verification details of the SMS password,
• The details of the healthcare professional carrying out the transaction,
• Information on encryption, integrity, time stamping and security measures.

Personal data are protected in accordance with Law No. 6698 on the Protection of Personal Data, and information security in accordance with Cybersecurity Law No. 7545 (Art. 10).

This is a significant change in a potential medical malpractice dispute: which form was approved, when and through whom can now be established by a time-stamped record. The record may be used as evidence for or against both the patient and the healthcare institution.

6. An important distinction: approving by SMS does not mean being "informed"

The electronic system proves by whom and when consent was given. However, for consent to be legally valid, the patient must have been sufficiently informed before the intervention. According to the settled case law of the Court of Cassation, merely consenting to surgery is not enough; the diagnosis, the risks of treatment, the chance of success, the alternatives and possible complications must also be explained to the patient in an understandable way.

The 3rd Civil Chamber of the Court of Cassation has clearly set out the burden of proof on this matter: "In informed consent, the burden of proof lies with the physician or the hospital." (Court of Cassation 3rd CC, Docket 2025/3158, Decision 2026/1767, 31.03.2026; to the same effect Docket 2023/2156, Decision 2024/214, 17.01.2024).

The Chamber has held that a "surgical consent form" that is merely a general consent and does not include complications specific to the surgery does not satisfy the duty to inform, and that the failure to inform renders the intervention unlawful (Court of Cassation 3rd CC, Docket 2023/5637, Decision 2024/3954, 28.11.2024). There are also decisions holding that informing cannot be proven with a consent form not bearing the patient's signature and that the hospital should be held liable in that case (Court of Cassation 3rd CC, Docket 2024/1848, Decision 2025/836, 13.02.2025).

Accordingly, the content of the electronic form will remain decisive. A form consisting of generic boilerplate wording that does not list the risks specific to the intervention may be considered legally insufficient even if approved with an SMS password.

7. Practical recommendations for patients

• Do not share the password without reading the form. The password means you approve that intervention.
• Ask about anything you do not understand. Risks, complications and alternative treatments must be explained to you in an understandable way.
• Download and keep the form you approved from e-Nabız. The form will remain accessible to you on e-Nabız after the procedure.
• Make sure your phone number is up to date and belongs to you.
• You may withdraw your consent. Under Article 5 of the Biomedicine Convention, the patient may freely withdraw consent at any time.
• If you have experienced a problem, gather the records early. The discharge summary, consent form and e-Nabız records are key evidence in a potential compensation claim.

8. For healthcare institutions and physicians

The electronic system does not change the fact that the physician and the hospital bear the burden of proof; it may, however, make it easier to meet that burden. To that end, it is important that forms include intervention-specific risks and complications, that the patient is given sufficient time to consider, and that the password is obtained from the patient personally. Record retention, access permissions and personal data protection are now also obligations open to review.

Frequently Asked Questions

Is giving consent via e-Nabız mandatory?
The Regulation governs the procedure by which consent is obtained electronically. In cases such as where the legal representative cannot be verified, consent cannot be obtained electronically. The Ministry of Health is authorised to determine in which cases the electronic route is to be preferred and the details of its implementation (Art. 12).

Is a separate SMS password sent for each procedure?
Yes. The password is valid only for the relevant medical intervention (Art. 8).

Where can I see the consent form I approved?
A form obtained electronically is transferred to the Ministry's central health data system and made available to you via e-Nabız.

Who gives consent if my child is having surgery?
The legal representative does; identity and phone verification is also carried out for the representative. If the representative cannot be verified electronically, consent cannot be obtained electronically (Art. 11).

I approved the consent form but the risks were not explained to me. Do I have any rights?
Possibly. According to the Court of Cassation, the burden of proving that the patient was informed lies with the physician and the hospital. The content of the form and the circumstances of the case should be assessed together.

If you have suffered harm after a medical intervention or wish to adapt your healthcare institution's consent processes to the new regulation, you can create an appointment or reach us via our contact page. See our Yalova guide for filing routes in Yalova.

Sources: Regulation on Obtaining Informed Consent Electronically (OG 27.10.2026, No. 33413); Law No. 1219 Art. 70; Patient Rights Regulation; European Convention on Human Rights and Biomedicine Art. 5; decisions of the Court of Cassation 3rd Civil Chamber (cited above).