NMC clarifies digital authentication of medical records: Key rules on liability, security and foreign experts

The National Medical Commission (NMC) has clarified that registered medical practitioners (RMPs) can remotely review and authenticate medical records, including laboratory reports, pathology reports, radiology findings and discharge summaries, using digital or electronic signatures, subject to applicable legal and professional requirements.

In an advisory issued by its Ethics and Medical Registration Board (EMRB), the NMC stated that the National Medical Commission Act, 2019, the regulations framed under it and the Telemedicine Practice Guidelines, 2020, do not prohibit such authentication using methods recognized under the Information Technology Act, 2000.

Issued by NMC Secretary Dr Raghav Langer on Oct 13, 2026, the advisory asks registered medical practitioners and other stakeholders to comply with the clarified requirements.

It aims to address uncertainty surrounding remote authentication as digital healthcare systems become more widely used across India.

The commission said differences in institutional practices had raised concerns about professional accountability, the adequacy of clinical information, electronic record security, inter-State medical practice and cross-border consultations.

"The High-Level Committee on Non-Financial Regulatory Reforms has also recommended facilitating the use of Digital and Electronic Signatures in medical practice in accordance with the Information Technology Act, 2000, with the objective of promoting ease of healthcare delivery, improving accessibility and reducing avoidable regulatory impediments," the NMC said.

The regulator emphasized that the advisory clarifies the existing legal position rather than creating new statutory rights or removing obligations applicable to medical practitioners and healthcare institutions.

Remote authentication of medical records: What the NMC advisory says

The advisory covers electronic authentication of clinical documents, including laboratory and pathology reports, radiology findings, diagnostic interpretations, discharge summaries and other medical records.

It applies to digital healthcare systems such as Hospital Information Systems (HIS), Electronic Medical Records (EMR), Electronic Health Records (EHR), Laboratory Information Systems (LIS), Radiology Information Systems (RIS), Picture Archiving and Communication Systems (PACS) and telemedicine platforms.

The Information Technology Act, 2000, recognizes electronic records and electronic signatures subject to applicable legal requirements. The Telemedicine Practice Guidelines, 2020, also recognize the use of information and communication technologies for healthcare delivery.

However, the NMC clarified that digital authentication does not replace clinical assessment, independent professional judgment or compliance with medical practice standards.

Doctors must review clinical information before signing reports

Registered medical practitioners must examine the relevant clinical information, medical records, investigations and other material necessary to form a professional opinion before remotely authenticating a document.

Doctors must independently assess whether a report, interpretation or discharge summary is appropriate for authentication. The process cannot be treated as a routine administrative task simply because an electronic signature facility is available.

If the available information is insufficient to form a professional opinion, the practitioner must not authenticate the document until the necessary information, examination, verification or review has been completed.

Digital signatures do not reduce doctors' professional liability

The NMC clarified that digital and electronic signatures are methods of authenticating electronic records and do not reduce or remove a doctor's professional, ethical or legal responsibilities.

Electronic authentication does not absolve the practitioner or healthcare organization of obligations under applicable laws, regulations and professional standards. Doctors cannot use digital signatures to bypass required examinations, verification or clinical review.

The method of authentication may change, but responsibility for the medical judgment and document remains with the practitioner concerned.

Hospitals must secure electronic records and maintain audit trails

Healthcare establishments must implement appropriate security measures to protect the integrity, confidentiality and traceability of electronically authenticated medical records.

The advisory requires hospitals and other healthcare facilities to maintain authentication logs, audit trails and date and time stamps. These records help establish when documents were authenticated and support the traceability of related activities.

Institutions must retain authenticated medical records and associated logs for the period prescribed under applicable law. They must also comply with relevant data protection, privacy, information security and cybersecurity requirements governing the storage, processing, transmission and access of personal health information.

Which doctors can remotely authenticate medical reports?

According to the advisory, registered medical practitioners authorized to practice under the National Medical Commission Act, 2019, may remotely authenticate reports generated by healthcare establishments with which they are duly appointed, empaneled, contracted or otherwise professionally associated.

Doctors must have lawful access to the relevant clinical records, and authentication must take place within their authorized professional engagement.

The clarification does not grant an independent right to practice medicine or remove existing requirements relating to registration, licensing, appointment, jurisdiction or professional practice.

Foreign medical experts can provide opinions but cannot independently certify Indian records

The NMC has clarified that foreign medical experts may provide remote consultations or second opinions to Indian healthcare establishments, subject to applicable law. The treating team in India may consider these opinions when making clinical decisions.

The patient's medical record should document the foreign expert's identity, professional qualifications, registration or licensure, the date and nature of the consultation, and the opinion provided, to the extent applicable.

However, a foreign expert's consultation does not automatically authorize that individual to certify an Indian medical record or confer the right to practice medicine in India. Foreign medical registration alone does not authorize independent medical practice in India under the NMC Act, 2019.

The distinction allows Indian medical teams to seek overseas specialist advice without transferring the authority to authenticate Indian clinical records to a foreign consultant.

Doctors must retain control of digital signature credentials

The advisory requires digital signatures, signature creation data, authentication credentials, access tokens and other mechanisms used to authenticate medical records to remain under the control of the concerned registered medical practitioner.

Doctors must not share, delegate, transfer or knowingly allow others to use these credentials. They must also take reasonable precautions against unauthorized access or misuse.

If a practitioner suspects that their credentials have been compromised or used without authorization, the incident must be reported promptly in accordance with applicable institutional and legal requirements, followed by appropriate corrective measures.

Existing medical and data protection laws remain applicable

The NMC stated that the advisory does not override existing laws governing medical practice, electronic records, patient confidentiality and professional misconduct.

The applicable legal framework includes the National Medical Commission Act, 2019, the Telemedicine Practice Guidelines, 2020, and the Information Technology Act, 2000. It also refers to the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Sakshya Adhiniyam, 2023, the Digital Personal Data Protection (DPDP) Act, the Clinical Establishments Act and other relevant laws.

The advisory is clarificatory in nature and does not create new statutory rights or waive any existing legal or professional requirements.

Why has the NMC issued the advisory?

The growing use of digital healthcare platforms has made it easier for doctors to review clinical information, interpret diagnostic findings and authenticate records without being physically present at the healthcare establishment.

However, differences in institutional practices have raised questions about the validity of electronic authentication and the responsibilities associated with it.

The High-Level Committee on Non-Financial Regulatory Reforms recommended facilitating digital and electronic signatures in medical practice under the Information Technology Act, 2000, to improve healthcare accessibility, simplify service delivery and reduce avoidable regulatory barriers.

The NMC has now clarified how medical records can be authenticated remotely within the existing legal framework. The requirements cover clinical review, professional accountability, institutional record security, the protection of signature credentials and consultations involving foreign experts.

The central condition remains that remote authentication must be performed by an appropriately authorized practitioner who has reviewed the necessary clinical information and accepts responsibility for the document.

The advisory seeks to promote consistent practices across healthcare establishments while ensuring that digital healthcare systems do not compromise patient safety or professional standards.