The Ulutas Medical Journal p-ISSN 2149-0430 e-ISSN 2149-388X

Patient consent for case reports (KVKK and GDPR)

Last updated:

A case report describes a real person. Even without a name, a rare disease, an age, a town and a date can be enough for neighbours, colleagues or relatives to recognise the patient. This guide explains when written consent is needed, what the form should cover, how to remove identifying details and what to do when the patient cannot consent. It is practical guidance, not legal advice; if you are unsure, ask your hospital's data protection officer or ethics committee.

When written consent is needed

For this journal the answer is simple: every case report needs written informed consent for publication, obtained before submission, and the article must state that consent was given (see the journal's Informed Consent page). This matches international guidance:

  • ICMJE says identifying details such as names, initials and hospital numbers should not be published unless they are essential and the patient has given written consent, and that an identifiable patient should be shown the manuscript to be published.
  • CARE, the reporting guideline for case reports, lists informed consent as one of its checklist items.

Data protection law points the same way. In Türkiye, the Personal Data Protection Law No. 6698 (KVKK) treats health data as a special category of personal data whose processing is prohibited unless one of the conditions in Article 6 applies; explicit consent of the data subject is one of them. KVKK defines explicit consent as consent that is freely given, specific and informed. In the European Union, Article 9 of the GDPR likewise treats data concerning health as a special category and allows processing on the basis of explicit consent for specified purposes, among other conditions.

What the consent form must say

The form should let the patient understand exactly what they agree to. Based on ICMJE, KVKK's definition of explicit consent and the journal's policy, a good form:

  • names the patient (or representative), the authors and the journal, and gives the working title of the article;
  • explains that the article will be published open access online and can be read, copied and shared by anyone (the journal publishes under CC BY 4.0, see the Instructions for Authors);
  • states that the patient has been shown the manuscript, including any images, and lists which images will appear;
  • explains which details will be removed or changed to reduce the chance of identification, and that a rare condition may still be recognised by people who know the patient;
  • has a date and the signatures of the patient (or representative) and the author who obtained consent.

ICMJE notes that where the signed form is kept is a matter of local rules, so store it as your institution requires. The journal may ask to see a copy.

Removing identifying details

Consent does not remove the duty to minimise what you publish. ICMJE asks authors to leave out non-essential identifying details, and the journal's policy lists what must not appear:

  • names, initials, hospital and record numbers;
  • exact dates (write "on day 3 of admission" or "two weeks later" instead);
  • identifiable images: crop or mask clinical photographs and remove names, dates and hospital labels from radiology images.

Both ICMJE and the journal note that masking only the eye region of a facial photograph is not enough. A photograph in which the patient can be recognised needs explicit consent for that image.

If you change a detail to protect privacy (for example rounding an age), ICMJE says the change must not distort the scientific meaning, and you should tell the editors what you changed. Remember that anonymisation has a strict meaning in law: KVKK defines it as making data impossible to link to an identified or identifiable person, even by matching with other data, and GDPR Recital 26 says data protection rules do not apply only to information that is truly anonymous. A rare condition in a small town may never be fully anonymous, which is why consent is still required.

When the patient cannot consent

The journal accepts consent from a parent or legal guardian for children and for patients who lack capacity, and from the next of kin for patients who have died. The Declaration of Helsinki similarly says that for a person who cannot give informed consent, consent must be sought from the legally authorised representative, taking into account the person's own preferences and values.

If a patient regains capacity later, consider asking them directly. If no one can give consent and the patient could be identified, do not submit the report. Discuss difficult cases with your ethics committee before writing.

The journal's consent form

The journal's requirements are set out on the Informed Consent page: written consent before submission, a consent statement in every case report, anonymised text and images, and CARE reporting. If your hospital has its own publication consent form, you may use it as long as it covers the points in this guide. In the manuscript, add a short statement under Declarations, for example: "Written informed consent for publication of this case report and the accompanying images was obtained from the patient."

Sources

All guides

WhatsApp Tell the Editor
Submit manuscript Contact