Patient Privacy and Medical Records in Turkey

Who will actually see your test results while you are abroad, and how do you get everything home in a form your own doctor can use? These are fair questions to ask before you book a flight, not after you are packing your bag.

This guide explains how patient privacy and medical records in Turkey work in practice: which law protects your health data, what consent forms actually do, how the national e-Nabız system fits in for foreigners, and how to leave the country with a complete, usable set of documents. It is not legal advice, but it will help you ask the right questions at the right moments.

Patient privacy and medical records in Turkey: the rules that apply to you

Your medical file contains things you would never put on a landing card: diagnoses, medication lists, family history, sometimes genetic or fertility details, plus your passport number and payment information. When you travel for treatment, more people touch that file than at home — coordinators, interpreters, physicians, nurses, insurance contacts and possibly a companion. Understanding patient privacy and medical records in Turkey before you arrive means you decide what is shared, with whom, and in what form.

The core law is the Personal Data Protection Law, known by its Turkish abbreviation KVKK, in force since 2016. Under KVKK, health data belongs to a special category of sensitive personal data, which can generally only be processed with explicit consent or under specific legal exceptions, such as processing by people under a duty of confidentiality for purposes like diagnosis, treatment and care. A separate regulation on personal health data sets out how hospitals should handle, store and share health records, and Turkey’s long-standing Patient Rights Regulation gives patients — including foreign patients — the right to be informed about their condition, to consent to or refuse treatment, to confidentiality and to access their own records.

In day-to-day terms, this means a hospital in Turkey should ask before sharing your information, should limit access to staff involved in your care, and should verify identity before releasing documents. You are entitled to ask how your data is stored, who can see it and how to request copies. Asking these questions is normal, not awkward.

What counts as your medical record in Turkey

Your medical record is not one document. It typically includes physician notes, signed consent forms, nursing observations, laboratory results, pathology reports, radiology reports, the imaging files themselves, medication lists, prescriptions, operative or procedure notes where relevant, discharge summaries and follow-up recommendations. Administrative paperwork — admission forms, invoices, insurance correspondence — is usually stored separately from the clinical record, which matters when you decide what to send to whom later.

For an international patient, the most valuable documents are the ones your local doctor can read quickly: a final discharge report, a clear diagnosis or assessment, a summary of what was done, medication instructions, warning signs to watch for, and the timing of follow-up. If you had imaging, ask for the digital image files (usually DICOM format on a USB drive, disc or download link) as well as the written radiology report. Reports summarise; the images let your home radiologist compare like for like.

Before you leave the ward, check that your name, date of birth and passport number match across all major documents. A single transliteration difference — common when names move between alphabets — can slow down insurers, embassies and home clinics. If you use two surnames or a preferred name, tell the international patient team early so your details are consistent everywhere. If you are still preparing for travel, our guide on what medical records to bring to Turkey covers the outbound side of the same problem.

Does Turkey comply with GDPR?

This is one of the most searched questions, and the honest answer has two parts. Turkey is not a member of the European Union, so the GDPR does not apply within Turkey as domestic law. However, Turkey has its own data protection framework — KVKK — which was drafted with European data protection law in mind and shares its core ideas: lawful basis for processing, special protection for health data, purpose limitation, security obligations and individual rights to access and correction. KVKK is enforced by a national Personal Data Protection Authority.

KVKK and the GDPR are not identical, and Turkey does not currently hold an EU adequacy decision, which mainly matters to organisations transferring data across borders rather than to you as a patient. What you should take from this: your health data in a Turkish hospital is legally protected as sensitive data, hospitals need a lawful basis and usually your explicit consent to process and share it, and you retain the right to ask what is held about you. If a specific GDPR question matters to you — for example, because your employer or insurer has strict data rules — raise it with them and with the hospital’s international office before treatment.

Consent, confidentiality and who may receive updates

Expect to sign several documents: consent for admission and examination, consent for specific treatments or procedures, consent for anaesthesia where relevant, a KVKK data processing notice, and forms covering record release. These are not formalities. Each one records that you were informed and that you agreed to something specific. Read them, and if a form is not in a language you fully understand, ask for interpretation before signing — not after. You are entitled to that.

You also control who receives updates. If you want a spouse, parent, adult child, friend or coordinator to speak with doctors, collect paperwork or take calls on your behalf, that permission should be written into the hospital record, usually with the person’s full name and relationship to you. Equally, if you do not want a companion informed — and some patients travelling for sensitive care do not — say so clearly at admission. Staff cannot respect a boundary they do not know about. For a deeper look at how consent and sharing decisions work, see our guide to consent, sharing and patient rights for medical records in Turkey.

There are limited situations where information may be shared without asking you each time: notifiable public health matters, legal obligations, insurance processing you have authorised, or continuity of care between clinicians treating you. Even then, the working principle is minimum necessary — share only what the purpose requires. If someone asks for a passport copy or a document and the reason is not obvious, ask how it will be used, who will see it and how it will be stored. A good hospital answers that question without friction.

e-Nabız and digital records: what foreigners can and cannot access

Turkey runs a national personal health record system called e-Nabız, which gathers records from public and private providers into one account that patients can view online. It is genuinely useful — for people who can log in. Access is tied to a Turkish identity number or a foreigner identification number, which is normally issued to residents rather than short-stay medical travellers. If you are visiting for a few weeks of treatment, do not plan around e-Nabız access; some international patients will qualify and many will not.

Hospitals also run their own electronic medical record systems, and some offer patient portals or secure delivery of reports by email. The practical rule: before you leave, confirm exactly how each outstanding result will reach you — portal, secure email, download link or courier — and test that the email address on file is spelt correctly. Do not assume a report will simply appear in an app you can open from abroad.

If you are still at the planning stage and need to send documents to Turkey for review, do it through the hospital’s official channel rather than a chain of personal messages. Our step-by-step guide on sending medical records to Turkey securely explains the safest ways to do this.

How to request copies of your records

The best time to request records is before discharge, not from the airport lounge. Tell your patient coordinator or ward team, ideally a day or two ahead, that you need a complete package for your doctor and insurer at home. Some documents are ready immediately; pathology and certain specialised laboratory reports can take longer and may need to be sent after you leave.

A thorough request covers: discharge summary, medication plan, prescriptions, laboratory results, imaging reports, the digital imaging files, procedure or operative notes if applicable, pathology reports if applicable, follow-up instructions, sick-leave or fitness-to-fly documentation if you need it, and invoices with payment receipts. Not every item applies to every patient, but working from a list prevents gaps you only discover at home. At Acibadem, the discharge process is designed to assemble these documents for international patients — our guide on how discharge papers and medical records are prepared shows what to expect.

Because health data is sensitive, hospitals verify identity before releasing records. Bring your passport, and if someone else will collect documents for you, expect the hospital to ask for your written authorisation and that person’s identification. This step can feel bureaucratic; it is also exactly what protects your file from being handed to the wrong person.

Translation, secure communication and internet use in Turkey

Clinical documents in Turkey are often produced in Turkish, though hospitals with large international programmes commonly issue key documents — particularly discharge summaries — in English, or can coordinate translation support. Ask early which documents can be provided in English and which would need extra time. For official use in another country, such as a court, immigration authority or government agency, you may need a certified or sworn translation and possibly legalisation steps that sit outside routine hospital services; the international office can point you in the right direction but usually cannot do this for you.

A related question people ask is whether the internet is monitored in Turkey. Access to some websites and services has been restricted in Turkey at various times, so a specific tool you rely on at home may not work reliably. For your health documents, the sensible habits are the same ones you should use anywhere: avoid public Wi-Fi and shared hotel computers for anything medical, use a private email account with a strong password and two-factor authentication, prefer the hospital’s official secure channel over ad-hoc messaging, and keep files in encrypted storage. If you receive imaging on a USB drive, disc or download link, make a backup immediately — download links expire and discs get lost.

Once documents start accumulating, keep them in one dated folder rather than scattered across inboxes. Our guide on organising your medical records for a faster review works just as well for the journey home as for the journey out.

Sharing records with insurers, home doctors and family

Different people need different slices of your file. Insurers usually want invoices, medical reports, prescriptions and proof of payment. Your home doctor wants the opposite emphasis: clinical detail, medication changes, results and follow-up dates, with no interest in the billing. An employer may only need a sick-leave note or fitness-to-fly confirmation — not a diagnosis. A family member may need practical care instructions and nothing more.

Before sending your full file to anyone, ask what they actually need and whether a smaller document meets the purpose. Ask insurers to list required documents in writing before you send anything. This is not secrecy; it is the same minimum-necessary principle the law expects of hospitals, applied by you.

If your care involved several specialists, you may come home with reports from multiple departments. A one-page timeline — dates, departments, what happened — at the front of your folder makes it far easier for your home physician to reconstruct the story and reduces the chance of repeated tests.