Key Amendments to the Regulation on Personal Health Data
A. Introduction
With the Regulation Amending the Regulation on Personal Health Data (“Amendment Regulation”), published in the Official Gazette dated 3 December 2025 and numbered 33096, amendments have been made to the Regulation on Personal Health Data (“Regulation”).
You can access the Amendment Regulation here.
B. Amendments
(i) Amendments Regarding Healthcare Personnel’s Access to Health Data
The Amendment Regulation has introduced comprehensive changes, especially concerning healthcare personnel's access to personal health data.
Accordingly, a primary care physician (aile hekimi) is now permitted to access the data subject’s personal health data without any time limitation. Furthermore, for other physicians, the prior applicable 24-hour access limit has been extended so that access may continue until all procedures directly related to the healthcare service are fully completed, thereby ensuring uninterrupted care.
In addition, with respect to individuals presenting to emergency departments, it has been stipulated that all physicians on duty in the emergency department may access the patient’s health data until the patient is discharged, provided that such access is limited to the relevant healthcare service.
While the Regulation previously stipulated that the health data of individuals with an e-Nabız account could be accessed in line with their “privacy preferences,” the Amendment Regulation has revised this rule, excluding emergency and inpatient treatment cases, and reorganized it through “security settings”.
In addition, a separate verification mechanism has been introduced for individuals who choose to conceal their past health data, enabling physicians to access the system using a code sent to the patient’s mobile phone. This amendment is expected to significantly address the practical issue where physicians are unable to access patient records due to the inability to log into the e-Nabız system.
(ii) Amendments Regarding Access to Children’s Health Data
Article 7 of the Amendment Regulation modifies Article 8 of the Regulation, which concerns access to children’s health data. Previously, a without custody could access the child’s health data within the limits determined by the General Directorate of Health Information Systems (“General Directorate”), based on the best interests of both the child and the custodial parent. However, with this amendment, it is now explicitly regulated that, the authority to access the child’s health data belongs exclusively to the custodial parent, applying both during divorce proceedings and after the divorce is finalized.
For the parent who is not granted custody, access to the child’s health data is now subject to submitting an application to the General Directorate and obtaining its approval. In these instances, it is stipulated that only health-related information concerning the child may be shared with the requesting parent, explicitly excluding data such as the child’s location, address, or contact details.
(iii) Access of Patient Relatives to Health Data
The Amendment Regulation now stipulates that the health data of individuals holding a disability report may also be accessed by their caregivers. In addition, the definition of “caregivers” has been added to Article 4 of the Regulation as “natural or legal persons authorized to be responsible for the care and supervision of the child, or the child’s parent or guardian.”
(iv) Attorneys’ Access to Health Data
The Amendment Regulation has repealed Article 10 of the Regulation, which previously governed attorneys’ access to their clients’ health data.
Under the former version of the Regulation, attorneys could not access health data with a general power of attorney. Access was permitted only where the power of attorney explicitly included a clause indicating the client’s explicit consent to the processing of health data. This requirement, mandating the inclusion of explicit consent specifically within the power of attorney, had been challenged by bar associations as a violation of Article 2 of the Attorneyship Law No. 1136; however, these annulment actions were dismissed.
The abolition of this article by the Amendment Regulation is consistent with the amendments introduced in 2024 to the Law on the Protection of Personal Data No. 6698 (“DPL”) regarding the processing of special categories of personal data. Prior to these amendments, the processing of such data generally required explicit consent. With the recent DPL amendments, the grounds for processing such data have been broadened. Consequently, attorneys may now process their clients’ health data based on one of the processing conditions set out in Article 6 of the DPL, particularly where “it is necessary for the establishment, exercise, or protection of a right.”
Therefore, the removal of the provision in the Regulation that restricted attorneys’ access to health data solely to cases where explicit consent appears well-founded.
C. Conclusion
The Amendment Regulation has led to significant revisions concerning health data access for healthcare personnel, patient relatives, custodial parents, and attorneys. These amendments aim to ensure the uninterrupted provision of healthcare services, to protect the privacy of children and other vulnerable groups, and to align the Regulation with the current provisions of the DPL concerning the processing of special categories of personal data.
The Amendment Regulation entered into force on its publication date, 3 December 2025.
For more information and support, you can contact us.
With the Regulation Amending the Regulation on Personal Health Data (“Amendment Regulation”), published in the Official Gazette dated 3 December 2025 and numbered 33096, amendments have been made to the Regulation on Personal Health Data (“Regulation”).
You can access the Amendment Regulation here.
B. Amendments
(i) Amendments Regarding Healthcare Personnel’s Access to Health Data
The Amendment Regulation has introduced comprehensive changes, especially concerning healthcare personnel's access to personal health data.
Accordingly, a primary care physician (aile hekimi) is now permitted to access the data subject’s personal health data without any time limitation. Furthermore, for other physicians, the prior applicable 24-hour access limit has been extended so that access may continue until all procedures directly related to the healthcare service are fully completed, thereby ensuring uninterrupted care.
In addition, with respect to individuals presenting to emergency departments, it has been stipulated that all physicians on duty in the emergency department may access the patient’s health data until the patient is discharged, provided that such access is limited to the relevant healthcare service.
While the Regulation previously stipulated that the health data of individuals with an e-Nabız account could be accessed in line with their “privacy preferences,” the Amendment Regulation has revised this rule, excluding emergency and inpatient treatment cases, and reorganized it through “security settings”.
In addition, a separate verification mechanism has been introduced for individuals who choose to conceal their past health data, enabling physicians to access the system using a code sent to the patient’s mobile phone. This amendment is expected to significantly address the practical issue where physicians are unable to access patient records due to the inability to log into the e-Nabız system.
(ii) Amendments Regarding Access to Children’s Health Data
Article 7 of the Amendment Regulation modifies Article 8 of the Regulation, which concerns access to children’s health data. Previously, a without custody could access the child’s health data within the limits determined by the General Directorate of Health Information Systems (“General Directorate”), based on the best interests of both the child and the custodial parent. However, with this amendment, it is now explicitly regulated that, the authority to access the child’s health data belongs exclusively to the custodial parent, applying both during divorce proceedings and after the divorce is finalized.
For the parent who is not granted custody, access to the child’s health data is now subject to submitting an application to the General Directorate and obtaining its approval. In these instances, it is stipulated that only health-related information concerning the child may be shared with the requesting parent, explicitly excluding data such as the child’s location, address, or contact details.
(iii) Access of Patient Relatives to Health Data
The Amendment Regulation now stipulates that the health data of individuals holding a disability report may also be accessed by their caregivers. In addition, the definition of “caregivers” has been added to Article 4 of the Regulation as “natural or legal persons authorized to be responsible for the care and supervision of the child, or the child’s parent or guardian.”
(iv) Attorneys’ Access to Health Data
The Amendment Regulation has repealed Article 10 of the Regulation, which previously governed attorneys’ access to their clients’ health data.
Under the former version of the Regulation, attorneys could not access health data with a general power of attorney. Access was permitted only where the power of attorney explicitly included a clause indicating the client’s explicit consent to the processing of health data. This requirement, mandating the inclusion of explicit consent specifically within the power of attorney, had been challenged by bar associations as a violation of Article 2 of the Attorneyship Law No. 1136; however, these annulment actions were dismissed.
The abolition of this article by the Amendment Regulation is consistent with the amendments introduced in 2024 to the Law on the Protection of Personal Data No. 6698 (“DPL”) regarding the processing of special categories of personal data. Prior to these amendments, the processing of such data generally required explicit consent. With the recent DPL amendments, the grounds for processing such data have been broadened. Consequently, attorneys may now process their clients’ health data based on one of the processing conditions set out in Article 6 of the DPL, particularly where “it is necessary for the establishment, exercise, or protection of a right.”
Therefore, the removal of the provision in the Regulation that restricted attorneys’ access to health data solely to cases where explicit consent appears well-founded.
C. Conclusion
The Amendment Regulation has led to significant revisions concerning health data access for healthcare personnel, patient relatives, custodial parents, and attorneys. These amendments aim to ensure the uninterrupted provision of healthcare services, to protect the privacy of children and other vulnerable groups, and to align the Regulation with the current provisions of the DPL concerning the processing of special categories of personal data.
The Amendment Regulation entered into force on its publication date, 3 December 2025.
For more information and support, you can contact us.
Download PDF
e.copur@lbfpartners.com
