Remote consents: how to collect them legally in your practice
Collect consent remotely legally: use advanced or qualified electronic signature, traceability, and digital preservation in compliance with standards.
Remote consent: how to collect it legally in the clinic
Yes: it is possible to collect informed consent remotely, but to have legal value, the system must use at least an advanced electronic signature (AES) or a qualified electronic signature (QES). Without this level, the document is worth little in the event of a dispute. A complete audit trail and compliant digital preservation are also required, capable of proving that the patient received and understood the information notice before signing.
In brief:
To guarantee legal value for remote consents, it is necessary to use at least an advanced or qualified electronic signature, with proven traceability and compliant digital preservation.
The process must include identity verification via systems such as SPID, CIE, or CNS, and the registration of metadata such as timestamps, document version, and user ID.
The simple electronic signature has weak evidentiary value and risks being insufficient in the event of a legal dispute; the qualified signature is equivalent to a handwritten signature.
A reliable system must offer an exportable audit trail, integrated support with the clinical management software, and the ability to attach multimedia materials to increase understanding of the consent.
Before implementing, it is advisable to check that the provider is an AgID qualified trust service provider and request demos of the audit logs before signing the contract.
TreatbaseSimplifies clinic managementTreatbase brings together voice charts, invoices, treatments, and automatic reminders in a single dental management software.Discover Treatbase
Table of Contents
What legal value remote consents have: SES, AES, QES
What the regulations stipulate: eIDAS, AgID, and Law 219/2017
How a remote consent workflow works
What evidence is needed to prove valid informed consent
How to choose a solution for remote consents
Why integration with the management software reduces operational risks
What really changes in the adoption of remote consents
Treatbase for managing consents in the dental clinic
Sources
Frequently Asked Questions
What legal value remote consents have: SES, AES, QES
Not all electronic signatures are created equal, and this is the point that confuses most operators. AgID distinguishes three levels, with very different technical requirements and legal consequences.
Simple Electronic Signature (SES): a click, a checked box, a signature drawn with a finger on a screen. It has weak evidentiary value: in the event of a dispute, it is up to the judge to freely assess its effectiveness.
Advanced Electronic Signature (AES): requires a unique link to the signatory, a reliable method of identification, and protection against subsequent modifications to the document, as clarified by AgID in its guide on eIDAS.
Qualified Electronic Signature (QES): is based on a qualified certificate and a qualified signature creation device, and is equivalent in evidentiary value to a handwritten signature.
For informed consent in the healthcare sector, SES alone is a risk that is not worth taking. AES represents the most common practical compromise: it guarantees the non-repudiation of the signatory without requiring dedicated hardware or complex personal certificates to manage on a large scale.
What the regulations stipulate: eIDAS, AgID, and Law 219/2017
The eIDAS Regulation (EU No 910/2014) is the European framework governing electronic signatures and trust services, and mandates the mutual recognition of qualified signatures among all member states, as established by the official text on EUR-Lex. In Italy, AgID supervises qualified trust service providers and certifies their technical compliance.
Law 219/2017 on informed consent does not impose a specific medium, but requires that the information be understandable and documentable: a remote signature platform must therefore guarantee the traceability of what the patient actually read, not just the final signature.
Qualified Trust Services (QTS) include qualified electronic signatures, qualified electronic seals, and qualified electronic time stamps.
The qualified electronic signature is recognized in all EU Member States, as confirmed by AgID on the page dedicated to trust services.
A piece of advice: always check if the provider you are evaluating is a qualified provider listed by AgID: it is the quickest proof that the signature produced actually has QES value.
How a remote consent workflow works
A solid process follows a precise sequence, not improvised on a case-by-case basis.
Prepare and version the information document. Every change to the text must generate a new tracked version, because in the event of a dispute, it is crucial to know exactly which text the patient read.
Send the material to the patient with multimedia support. Short videos or infographics increase real understanding compared to text alone, especially for complex procedures.
Verify identity before signing. SPID, CIE, or CNS are the most solid options available in Italy; the CIE, for example, allows signing in AES mode via the CieSign app on an NFC-enabled smartphone, as indicated by the Ministry of the Interior.
Record the signature with timestamp and metadata. Time, date, device, and verification method must remain associated with the document.
Preserve the file in accordance with regulations, with a qualified time stamp that locks its content over time.
A piece of advice: always ask the provider for a demo of the audit log before signing a contract: if they cannot show you in real-time who signed what and when, the problem will only become apparent when it is too late.
What evidence is needed to prove valid informed consent
Consent collected remotely is only as good as its traceability. Some providers still confuse a scanned image of a signature with a true electronic signature: without verifiable metadata linked to a certificate, that document is neither AES nor QES, it is just an image.
The minimum acceptable audit trail includes:
Precise timestamp of each phase (sending, opening, reading, signing).
Unique identifier of the user and the device used.
Identity verification method applied (SPID, CIE, CNS, or other validated system).
Version number of the signed information document.
The technical rules published by AgID on qualified certificates and time stamps set the minimum standards of interoperability that a serious solution must respect. Experts agree that the main obstacle is not technical but procedural: it is necessary to prove that the patient received and understood the information, not just that they clicked "sign."
When a family member or guardian signs on behalf of the patient, the delegation must be documented with the same care as a direct signature. The model adopted by the Revenue Agency for enabling representatives and trusted persons is a useful reference for understanding how to structure a system of traceable delegations.
How to choose a solution for remote consents
Before adopting a tool, check that it meets precise criteria and not just commercial promises.
Native support for AES and QES, not just simple graphic signatures.
Direct integration with the clinical management software, to avoid isolated and hard-to-retrieve documents.
Exportable audit trail readable even by an external lawyer in the event of a dispute.
Compliant digital preservation with qualified time stamp.
Ability to attach multimedia materials to strengthen understanding of the information.
On the contractual level, ask for clarity regarding liabilities in case of system errors, guaranteed SLA times, and long-term document preservation conditions after contract termination.
A piece of advice: an immediate red flag is the absence of log exporting in a readable format: if the provider does not show it to you immediately during the evaluation phase, they are unlikely to resolve it after activation.
Why integration with the management software reduces operational risks
Consent collected on a separate platform from the clinical management software creates what is jargon-referred to as an orphan document: it exists, but no one can easily find it at the time of the visit. Integrating consent collection directly into the software that manages records and appointments avoids this problem at its root, because the signed consent remains attached to the patient's file from the very first access.
Integrated management software allows the archive of clinical records and consents to be shared, so the staff does not have to cross-reference two different systems during the visit.
Less time wasted searching for signed documents on external platforms.
A single version registry for clinical record and informed consent.
Reduction of administrative errors related to lost or incomplete paper copies.
Integrating consent collection into the management software reduces data silos and improves the correlation between consent and the clinical record at the time of the check.
For a technical pilot, measure the average time to complete consent, the percentage of actual AES/QES signatures, and the time saved in archiving compared to paper before extending the system to the entire clinic.
What really changes in the adoption of remote consents
Most clinics evaluating remote consent focus on signature technology and neglect the part that generates the most litigation: proof that the patient understood, not just clicked. An impeccable audit trail documenting an information notice written in incomprehensible language protects no one.
The priority for anyone starting out today is simple: first check that the provider supports AES or QES in a verifiable way, then evaluate integration with the management software, never the other way around. I recommend starting with a small group of patients on low-risk procedures before extending the system to the entire clinic.
— Matteo
Treatbase for managing consents in the dental clinic
Treatbase is the alternative to signature tools separated from the management software for a dental clinic that wants to stop chasing documents across multiple platforms: signature and archiving of consents remain in the same system where the voice AI already fills in the medical record.
The advantage is operational and technical: when the signed consent is linked directly to the patient card, staff does not waste time cross-referencing exports from different platforms during the visit, and historical data migration can be efficient. You can see in detail how the flow works between calendar, new patient and visit management before deciding whether to test it in your clinic. To get started, visit the Treatbase product page and request a demo to evaluate the integration of consents with your current clinical record.
This article provides general information and does not replace the advice of a qualified doctor. Consult a qualified healthcare professional regarding your specific case before acting on this content.
Sources
Frequently Asked Questions
What are the different types of electronic signature for consent?
There are three levels: simple electronic signature (SES), advanced electronic signature (AES), and qualified electronic signature (QES). For informed consent with solid evidentiary value, AES or QES is required, as clarified by AgID.
How can a medical document be signed remotely in a valid way?
The patient receives the information document, verifies their identity via SPID, CIE, or CNS, and then signs with a system that produces verifiable metadata linked to the certificate. The CIE, for example, allows advanced signature via the CieSign app on an NFC smartphone.
What does Law 219/2017 say about remote informed consent?
Law 219/2017 does not specify a mandatory technical medium, but requires that the information be understandable and documentable. A remote consent system must therefore track not only the signature but also proof that the patient read the correct information notice.
What happens if the informed consent is not signed correctly?
Consent collected without AES or QES, or without an adequate audit trail, has little evidentiary value in the event of a legal dispute. The main risk is not the absence of the signature, but the inability to prove that the patient truly understood the information notice before signing.
For pricing information on the consent management solution, it is recommended to consult the software's official website directly.
Treatbase's price is not published: it is available upon request by contacting the team directly through the official website.