Disputing an SMS-OTP Medical Consent in Turkey: Foreign Patients, Verification Failures and Evidence Under the 2026 Regulation

Short and direct answer: A hospital’s statement that a patient accepted treatment by SMS one-time password does not end the legal examination of informed consent. Under Türkiye’s Regulation on Obtaining Informed Consent Electronically, effective on 27 October 2026, patient and healthcare-professional identity verification must precede the electronic process (Article 6); a verified patient mobile number is mandatory for that process (Article 7); the procedure-specific consent workflow and OTP confirmation are governed by Article 8; and the healthcare institution must preserve the event, verification, professional-identity and data-integrity records identified in Article 9. Article 5 separately requires timely, sufficient and understandable information and free patient choice. A patient disputing the record should therefore request the form and preserve evidence about both the electronic transaction and the information actually given before the intervention.

Have a general question about this article? Ask anonymously

This guide addresses a specific dispute: a foreign or overseas patient who is told that an SMS code proves agreement to dental, cosmetic or other medical treatment in Türkiye, despite a disputed telephone number, missing explanation, mistaken identity, or disagreement about the procedure authorised. It is not a general description of electronic signatures and does not assume that using a foreign mobile number is either prohibited or automatically accepted.

Scope: a valid digital event and informed consent are two separate questions

Articles 1 and 2 of the 2026 regulation define a procedure for recording informed consent electronically before a medical intervention at primary, secondary and tertiary healthcare facilities. Article 4 defines informed consent by reference to a patient’s free and informed acceptance. Article 5 then requires sufficient, understandable and timely information, as well as reliable verification, security and auditability. Accordingly, a record of a technical verification event addresses a different question from whether the patient received the explanation required for an informed decision.

The distinction is important in dental treatment, surgery and other interventions advertised to international patients. Payment of an invoice, attendance at a clinic, appointment confirmation, access to a patient portal and transmission of an SMS code are not interchangeable events. Article 8 identifies a specific electronic informed-consent process. An ordinary promotional SMS, appointment verification code or commercial payment instruction should not be represented as consent under that article merely because all use short messages.

Equally, a disputed consent does not prove professional negligence, causation or entitlement to compensation by itself. The legal record must keep apart the identity and authority of the individual giving consent, the information presented, the intervention covered, the patient’s decision and the actual treatment delivered. Each has its own documents and factual questions. The regulation provides specific records useful for examining the electronic part of that chain, rather than replacing the whole medical file.

Article 6: identity verification must be completed before electronic consent begins

Article 6(1) requires the healthcare facility to verify both the patient and the healthcare professional handling the consent process before the medical intervention. Article 6(2) expressly states that the electronic informed-consent process cannot begin before patient identity verification has been completed successfully. It directs facilities to the applicable patient-identification rules and Ministry healthcare quality standards. The rule does not authorise substituting possession of a telephone for the patient’s verified identity.

Under Article 6(3), the healthcare professional’s identity must also be established through the rules governing that profession and the professional must be recorded as active in the Ministry’s Integrated Institutional Transaction Platform. A complete audit therefore involves the person who conducted the process, not only the patient’s number. The log identifying a staff member is especially important where several employees have access to different hospital devices, treatment rooms and patient records.

Where the treatment is reimbursed by the Social Security Institution, Article 6(2) additionally refers to identification requirements under Law No. 5510 and the relevant Healthcare Implementation Communiqué. That provision does not state that a patient paying privately is exempt from the basic Article 6 checks. The correct legal question is which identity-verification obligations applied to the particular encounter and whether their completion appears in the facility’s contemporaneous records.

Article 7: a verified mobile number is a mandatory precondition

Article 7(1) makes a verified mobile telephone number belonging to the patient a condition of electronic informed consent. For the e-Nabız route, Article 7(2) requires the number to be verified through e-Nabız. If no verified number is on that platform, the prescribed process is to enter the number in the relevant field and verify the SMS one-time password online. A hospital cannot treat an unverified number in an administrative registration form as equivalent to this express requirement.

For the healthcare facility’s own electronic communication device route, Article 7(3) requires a verified patient number in the healthcare information management system, known as SBYS. Without such a number, the facility sends a verification OTP to the patient; the patient tells it to the relevant healthcare professional; and that professional transmits it online through the facility’s electronic communication device. This verification event registers the number as verified in that facility’s records for twelve months starting from the verification date.

The twelve months apply to the verified telephone-number record, not to continuing consent for every treatment. Article 7 requires the facility to verify the number again after twelve months if it later seeks consent through the facility-device channel. Article 8 independently requires an OTP produced for the relevant medical intervention. Confusing a valid phone-verification record with an all-purpose treatment authorisation would erase the distinction between Articles 7 and 8.

Article 8: the patient and clinic channels must be distinguished

Article 8(1) permits two specified electronic routes: e-Nabız and the healthcare facility’s electronic communication device. The professional logs in to the facility system using a username/password or another Ministry-prescribed authentication method. The professional approves the applicable consent form electronically and makes it available to the patient, either through an SMS link sent to the verified number or via e-Nabız. Article 8(5) expressly requires the patient to examine the form.

If the patient accepts the intervention, Article 8(6) requires a valid SMS OTP generated for that particular medical intervention and sent to the verified number. The regulations prescribe distinct transmission steps. Under Article 8(7)(a), when consent is taken through e-Nabız, the patient personally enters the OTP into the relevant e-Nabız interface. Under Article 8(7)(b), when the facility device is used, the patient shares the OTP with the healthcare professional, who enters it on the facility device. It would be inaccurate to tell every patient that the law always requires the patient personally to type the code.

Article 8(8) provides that informed consent is deemed obtained once the applicable verification step in paragraph 7 is completed. That is the defined electronic event. It does not repeal Article 5’s duty to explain the procedure or Article 6’s identity-verification preconditions. Article 8(9) directs transfer of the form to the Ministry’s central health data system and access through e-Nabız. If the institution relies on Article 8, these defined stages create a checkable sequence.

Article 5: the patient still needs sufficient, understandable and timely information

Article 5(a) requires enough information, provided in an understandable manner and in time to permit a free decision about the medical intervention. The obligation precedes the decision. A form delivered immediately before an intervention, a document in a language the patient does not understand, or an explanation omitting the specific operation needs assessment against that legal standard. The regulation does not create an automatic rule that an SMS code cures a missing explanation or establishes what words were communicated orally.

For an international patient, the relevant evidence includes the language of the form actually displayed, available translated patient information, questions sent before consent, the clinician’s explanations and the time allowed to examine the record. Article 5 does not prescribe one universal translation technology or an automatic right to a particular private interpreter in every case. What it does require is adequate and understandable information. The analysis should therefore record the actual language and communications rather than invent a general prohibition on foreign-language forms or an unverified interpreter obligation.

Additional patient rights remain relevant. Article 13 expressly applies the Patient Rights Regulation where the new instrument contains no provision. A dispute over the person’s ability to understand information, capacity, withdrawal of consent or the scope of the proposed intervention must be examined using the applicable patient-rights rules rather than assuming that the OTP process resolves every medical-law issue. The patient’s written questions before treatment often establish the difference between an explanation requested and one actually provided.

Article 9: the required digital audit trail and its evidentiary meaning

Article 9(3) specifies minimum proof-oriented records: the date and time the patient expressed consent electronically, the transaction information, dispatch and verification information relating to the OTP, the identity of the healthcare professional who performed the action, and the encryption, integrity, timestamp and other security measures applied to the electronic data. Article 9(2) requires audit logs to be maintained with confidentiality, accessibility, security and integrity, using an electronic hash value and timestamp so that they can be examined in judicial or administrative proceedings.

An assessment should distinguish the patient-facing form, the phone-verification record under Article 7, and the intervention-specific acceptance event under Article 8. Those are three different things. For example, a record that a number was verified within the last twelve months does not identify the intervention authorised on a later date. Conversely, the consent event must be matched to the form the patient was actually offered and the healthcare professional responsible for the workflow.

Article 9(4) assigns the healthcare institution responsibility for preserving all transaction records made through its electronic communication device in accordance with that article. A patient should ask for the relevant record and the institution’s ability to preserve original logs, not simply a typed statement summarising them. An exported screen, printout or certification can be useful, but checking the original underlying transaction information is crucial when its authenticity or completeness is contested.

When the number belonged to someone else or the OTP was not received

The regulation requires a number verified as belonging to the patient. If a patient disputes ownership or control of the recorded number, the relevant evidence is the Article 7 verification history, the time and method used, the number recorded in e-Nabız or SBYS, the person entering the code and the Article 8 event matching the intervention. A number being written on a registration document is not, by itself, an Article 7 verification result. Nor is a staff statement that “a code was entered” a substitute for the log data required by Article 9.

The legal analysis should not jump to the opposite extreme and conclude that every disputed message makes consent automatically void. The sequence, actual patient identification, available records and information given must be established first. The device workflow expressly permits a healthcare professional to enter the OTP after the patient communicates it under Article 8(7)(b). Therefore the fact that a staff member entered the code is not necessarily irregular; the critical questions are whether this was the approved channel and whether the verified patient supplied the intervention-specific code after examining the form.

For a focused request, identify the date of the appointment, the actual number used, the number on the registration and billing forms, the type of verification applied and the professional responsible. Preserve the patient’s own SMS history, service-provider messages and contemporaneous communications without altering screenshots or metadata. Those items can corroborate or contradict the institutional audit trail, although phone-message absence alone cannot establish every technical event that took place on another system.

One procedure’s consent code is not a standing authorisation for all later treatment

Article 8(6) describes an OTP generated for use only in connection with the relevant medical intervention. That wording matters where treatment plans contain stages, alternative procedures or changes after the original consultation. The documentation should identify the specific intervention and the version of the information form provided before that decision. A clinic should not treat a procedure-specific electronic confirmation as a blanket authorisation for unrelated interventions solely because a valid mobile number remains on file.

Article 7’s twelve-month period concerns the facility’s verified number, not indefinite consent. An institution may retain a verified number for the allowed period while still needing to comply with the Article 8 sequence for each consent transaction covered by the regulation. The separate timing and contents of the patient’s explanation remain governed by Article 5. In an audit, place the relevant treatment record beside the corresponding form, OTP transaction and decision date, rather than combining several appointments into one anonymous consent entry.

This is also a practical reason to preserve correspondence about promised treatment stages. Emails, signed treatment plans, invoice descriptions and appointment changes may show what was proposed and what the patient believed would occur. The Article 9 log is valuable because it can locate the electronic event within that chronology. It does not by itself establish that every subsequent clinical act was part of the intervention identified in the original form.

Foreign patients: what the regulation says, and what it does not say

The text does not create a separate waiver of Articles 5–9 for foreign nationals, overseas Turkish citizens, medical tourists or patients who leave Türkiye after treatment. Article 2 addresses healthcare-facility levels, not nationality. Likewise, the regulation does not contain an express, unconditional promise that any overseas SIM, roaming arrangement or foreign telephone number will function with e-Nabız or a hospital’s SBYS. A patient should therefore obtain confirmation of the institution’s actual approved identity and telephone-verification method before relying on electronic consent.

Distinguish the applicable legal requirement from operational compatibility. The law requires a verified number belonging to the patient, patient and professional identification, access to the form, and the procedure-specific OTP process. The patient should not be told that a foreign number is forbidden unless a separate valid rule establishes that restriction. Conversely, no lawyer should guarantee delivery to every overseas operator, describe SMS reception as proof of understanding or promise access to e-Nabız without verifying account and system eligibility.

Where the patient is already abroad and disputes the consent record, the case file should preserve the treatment date, patient identity documents, clinic name, the mobile number as recorded at the time, consent-form version, communications about language and the medical records. The separate guide to obtaining dental records after returning abroad addresses the broader treatment file; this article focuses on the electronic consent transaction and its audit trail.

Article 11: minors, restricted persons and representative verification

Article 11(1) provides that transactions normally performed by the patient are undertaken by the legal representative for a minor or legally restricted patient, consistently with the Patient Rights Regulation. Article 11(2) applies the identity-verification and telephone-number-verification provisions to that legal representative as well. A child’s telephone number, a parent’s presence at reception and an unverified staff entry cannot replace the required verification of the person legally authorised to act.

Article 11(3) is explicit: electronic consent cannot be obtained where the minor or restricted patient’s legal representative does not exist, is not present, or cannot be verified electronically. This is a limitation on the electronic route. It is not a statement that urgently necessary medical care becomes legally impossible in every situation, nor that every form of alternative consent is automatically permitted. Those separate questions require the applicable patient-rights and treatment legislation.

In a disputed electronic record for a child, examine the patient’s legal status at the time of treatment, proof of legal representation, which person’s telephone number was verified, and which person carried out the Article 8 procedure. An institution should preserve the records identifying the legal representative without making private family information publicly accessible. Article 10’s data-security obligations still apply to this sensitive documentation.

Records must remain intact and protected; twelve months is not the retention period

Article 9(1) requires retention and destruction of electronic informed-consent records and transaction logs according to the rules applicable to physical informed-consent documents. It does not establish a universal twelve-month destruction deadline. The number-verification period in Article 7 serves a different purpose. An institution that deletes consent logs when a telephone record expires would be conflating two distinct statutory subjects.

Article 9(2) calls for electronically verifiable integrity and timestamps, and Article 9(3) sets out the minimum evidence categories. Article 10(1) adds organisational and technical duties under Cybersecurity Law No. 7545 and applicable standards, including role-based access restrictions and audit of those permissions. Article 10(2) subjects the processing of personal data to Law No. 6698 and Additional Article 19 of Law No. 3359. Those provisions support a records-preservation request while also restricting casual disclosure to unrelated individuals.

A patient and the patient’s lawyer should not demand public publication of an entire database or access to unrelated patients’ entries. A properly scoped request identifies the individual’s records and asks for production through an authorised channel. It can seek the facility’s preservation of original event logs and their integrity metadata. The separate English guide on KVKK data requests discusses personal-data access; the specific audit fields here are drawn directly from Article 9.

A precise information and preservation request to the hospital

A records request should identify the patient’s name and identifiers securely, treatment date, facility and department, clinician, intervention and the reason the electronic consent is disputed. It should request the exact form version presented, the relevant clinical information and the route used under Article 8: e-Nabız or facility device. State whether the issue concerns identity, control of the mobile number, lack of understandable information, a changed procedure, a representative, or the absence of the patient’s assent. A clear issue description helps keep the request limited to relevant evidence.

Ask the institution to preserve and identify: the patient identity-verification record under Article 6; the Article 7 telephone verification event, date and method; the Article 8 form approval and delivery mechanism; the intervention-specific OTP dispatch and validation event; the time of consent; the responsible healthcare professional’s identity; and the Article 9 timestamp, hash and integrity records. The request should distinguish preservation of original underlying data from any copies the institution is authorised to provide.

The healthcare facility is responsible under Article 9(4) for logs generated by its own electronic device workflow. The request should not presume that a clinic must provide a third-party telecom company’s full internal database, or that Article 9 obliges a particular screen design. It is stronger to identify the statutory minimum information and request the original record or a reliable, legally shareable representation of it. Sensitive personal and health data should be transferred by an appropriate secure method.

How to construct a reliable chronology for the dispute

Organise the evidence chronologically: first the information given about the proposed procedure; second the patient’s identification; third verification of the recorded mobile number; fourth presentation of the specific form; fifth the acceptance event and its OTP; sixth the medical intervention actually delivered; and finally subsequent communications or complaints. Match each date and document to the relevant article. A log entry has evidentiary significance only when the actual event it describes is identified correctly.

A discrepancy should be stated precisely. “No valid mobile verification was recorded before the consent event” is different from “the patient never understood the risk explained in a language they did not speak”. Both are legally relevant to different provisions, but they are not proof of the same proposition. Likewise, the time the patient signed a hotel check-in form, made a bank transfer or entered the hospital building does not establish the Article 8 acceptance time. The exact sequence is the basis for assessing legal consequences rather than labels chosen by either side.

A formal dispute about payment, clinical standards or compensation needs analysis beyond the 2026 electronic-consent regulation. The guide to Turkish healthcare-tourism package disputes explains a different commercial issue, while the guide to hair-transplant treatment claims addresses clinical and contractual allegations. This article supplies the narrower method of identifying, preserving and interpreting the digital consent evidence.

What the regulation requires healthcare providers to document

For a provider using electronic informed consent, the minimum workflow cannot be reduced to displaying a generic PDF and asking for an SMS code. Article 6 requires patient and professional verification. Article 7 requires the verified patient mobile number. Article 8 requires a professional-approved, accessible form, the patient’s opportunity to examine it, an intervention-specific OTP and use of the prescribed channel. Article 9 requires logs of the identified transaction and security information, and Article 10 requires appropriate protection of the resulting records.

Providers should ensure the workflow does not conflate the twelve-month number-verification period with the current intervention-specific consent. They must also recognise that Article 11 imposes separate conditions when a legal representative is responsible. A technical implementation that allows staff to bypass identity verification or record a consent event without the correct form would not match the sequence specified by the regulation. The legal compliance question is the actual functioning and recorded process, not simply the name of the software vendor.

Article 12 authorises the Ministry to issue supplementary standards on audit logs, retention, timestamps, encryption, SMS infrastructure and related implementation questions. This article reports the text effective on 27 October 2026; it does not assert that a future standard has already been issued. Providers reviewing compliance must compare their current system and institutional instructions with the applicable Ministry acts in force at the time of the transaction.

Legal source hierarchy and practical conclusion

For events on or after 27 October 2026, start with the Ministry-published text of the 2026 electronic informed-consent regulation, particularly Articles 5–11, and the relevant Patient Rights Regulation under Article 13. In a dispute, request evidence proving what happened: identity checks, number verification, the form shown, intervention-specific OTP validation, professional identity and integrity-preserved logs. Do not treat the phone-verification lifetime as a continuing permission to provide treatment, or an electronic verification record as proof of every conversation that preceded it.

Türkiye-wide legal file handling: Bakırcı & Keskin Hukuk Bürosu handles legal matters involving clients residing abroad and disputes concerning Turkish institutions. Individual assessment requires the medical records, consent form and dated audit information. The firm’s physical offices are in Mersin and Istanbul; case management and remote communication can cover matters throughout Türkiye. This publication is general legal information, not a finding that any identified clinic or healthcare professional breached the law.